What is the procedure to be followed in performing prohibited activities in Azure Penetration Testing?

Question

Do we need to get authorization from the Azure team by producing any documents before starting to test for the prohibited activities mentioned in Azure Penetration Testing https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement? If so can you please share the template for the document?

Also I wanted to know that can we perform testing for DDoS Attack, Fuzzing directly onto our client account without any authorization from the Azure team? Is it in compliance with the Azure Policy?

Answer 1

Hi thanks for the question

As per the linked document; I do not believe it is possible to get authorization to perform prohibited Penetration-Test activities (as detailed in the rules of engagement) as by definition the actions listed would be in violation of policy terms & conditions and (as also noted in the doc) may also have legal consequence

For further clarification you could raise a request through your Account representative or support.

For DDoS simulation/testing please refer to https://learn.microsoft.com/en-us/azure/ddos-protection/test-through-simulations

Hope this comment helps