Unableto do Prenetration testing on our AZure hosted Web app,

Question

We are currently in the process of conducting a Vulnerability Assessment and Penetration Testing (VAPT) on our web application which is hosted in Azure . 

However, we have encountered an issue where our vendor's VAPT scanning tool is unable to access our application’s login page and perform the necessary tests.

Our network security team has already confirmed that inbound and outbound traffic has been allowed for the IP addresses of the testing tool. Despite this, the scanning tool continues to face access issues.

We have reviewed our NSG and other rules too .

We would like to ask if there are any inbuilt features or security measures within Azure that could potentially block or restrict the usage of VAPT tools on our web application. Specifically, we are concerned about any network-level protections, firewall rules, or other security mechanisms that may be preventing the tool from completing the scan.

Any insights or recommendations you could provide would be greatly appreciated to help us proceed with the VAPT testing

Answer 1

Hi @chitra manju
Welcome to MS Q&A
Addition of Deepanshu response ,
You do not need to seek permission from Microsoft to conduct penetration testing on your Azure resources, as pre-approval is no longer required. However, compliance with the Microsoft Cloud Unified Penetration Testing Rules of Engagement is mandatory. If you encounter issues with your penetration testing tools, it is advisable to contact your Azure account manager for assistance or clarification regarding your specific setup and any potential restrictions.

To contact your Azure account manager, you can do so through the Azure portal or by using the support options provided by Microsoft. Look for the "Help + support" section in the Azure portal where you can create a support request or find contact information for your account manager.
Penetration testing

Develop secure applications on Azure

Azure guidance for secure isolation
Let me know if you have any further assistances.
If the answer is helpful, please click Accept Answer and kindly upvote it so that other people who faces similar issue may get benefitted from it.

Answer 2

Hello Chitra, Welcome to MS Q&A

To address the issue where your VAPT scanning tool is unable to access your application's login page, you might want to consider the following steps:

1. Web Application Firewall (WAF) Settings: If you have a Web Application Firewall (WAF) in place, verify that it is not blocking the requests from the VAPT tool. You may need to whitelist the IP addresses of the tool.
2. Application Gateway or Load Balancer: If your application or webapp is behind an Application Gateway or Load Balancer, ensure that the configuration allows traffic from the VAPT tool.
3. Authentication and Access Control: Ensure that there are no authentication or access control mechanisms that might be preventing the tool from accessing the login page. This could include IP restrictions in azure webapps.

Please try this and let us know

If you have any further questions , please let us know

Kindly accept if it works

Thanks
Deepanshu