We assess your Azure tenant, subscriptions and Entra ID against the CIS Microsoft Azure Benchmark and Microsoft Cloud Security Benchmark, reviewing identity, conditional access, networking, storage and Defender for Cloud, and help you harden it with Azure Policy and management-group guardrails.
What’s included
What you receive
- Risk-ranked findings
- Bicep or Terraform remediation where possible
- Policy recommendations
- Retest
Every layer of your cloud, reviewed.
We work through the same layers in AWS, Azure and Google Cloud, so results are comparable across providers.
- 01OrganisationAccounts, projects, guardrailsSCP · policy
- 02IdentityPeople and workloadsIAM · SSO
- 03NetworkExposure and segmentationVPC · firewall
- 04DataStorage and encryptionKMS · DLP
- 05WorkloadsVMs, containers, serverlessK8s · images
- 06DetectionLogging and alertingSOC-ready
How an engagement runs.
Scope & access
Agree accounts, subscriptions and projects in scope and set up read-only review access.
Review configuration
Identity, network, storage, logging, encryption and workloads against CIS Benchmarks and provider guidance.
Validate risk
Confirm which issues are genuinely reachable and exploitable, so effort goes where it counts.
Harden & guard
Risk-ranked fixes, infrastructure-as-code changes and guardrails, followed by a retest.
Questions we hear often.
Do you cover Microsoft 365 too?
Yes. Entra ID and Microsoft 365 security settings are often reviewed together with Azure, since they share identity.
What access do you need?
Reader and Security Reader roles, plus Global Reader in Entra ID, are sufficient for a review.