Run an Azure Cloud Pentest¶
This page covers how to configure, monitor, review, and act on Azure Cloud pentests.
Navigate to Pentest Configuration Form¶
After creating an Azure connection, you can navigate directly to the configuration form for an Azure Cloud Pentest.
Otherwise, from the Pentests page, click + Run Pentest, then select the Azure Cloud Pentest (within the Infrastructure Attack Surface category).
Configure the Pentest¶
Name and Template¶
Name your pentest. Then, if using a template other than the default, select the template you need.
Deployment Options¶
The Deployment section is what makes the Azure Cloud Pentest unique — it’s where you define the Azure-specific scope and deployment target for the test.
Select your Tenant ID and Subscription ID. The subscription you select determines which Azure resources NodeZero will enumerate and test. NodeZero will then enumerate subnets that have space to deploy a VM — the subnet you select is where NodeZero deploys, not the scope of what it tests.
Once enumeration is finished, select the Role to test with. You’ll typically see built‑in Azure roles such as Reader, Contributor, and Virtual Machine Contributor. Any custom roles that exist on the selected subscription will also appear in the list.
- Reader provides read‑only visibility into resources, and is useful for identity- and configuration-focused tests.
- Contributor can create and modify most resources in a subscription, and enables deeper gray‑box testing, including provisioning infrastructure where needed.
- Virtual Machine Contributor focuses on managing virtual machines and related resources, and is often used when the test is primarily about compute deployment and VM‑level attack paths.
Pre-launch Validation¶
When you submit the form, NodeZero runs a series of checks before allowing the pentest to launch:
| Check | What NodeZero verifies |
|---|---|
| Subnet IP Space | The selected subnet has at least one available IPv4 address beyond Azure's 5 reserved addresses. |
| NSG Outbound Connectivity | The selected subnet can reach the internet outbound — via default outbound access, a NAT gateway, or an NSG rule that allows TCP 443 outbound before any deny rule. |
| Total Regional vCPUs | At least 4 vCPU cores are available in the target region. |
| Standard DSv3 Family vCPUs | At least 4 Standard DSv3 Family vCPUs are available. |
| Virtual Machine count | At least 1 virtual machine is available in the quota. |
| Network Interface count | At least 1 network interface is available in the quota. |
| Allowed VM SKUs | If a policy restricts allowed VM SKUs, Standard_D4s_v3 must be included. |
| Allowed Locations | If a policy restricts allowed locations, the VNet's region must be in the allowlist. |
| Not Allowed Resource Types | Microsoft.Compute/virtualMachines must not be blocked by a denied resource types policy. |
| Audit VMs Without Managed Disks | Flagged as a warning, or blocking if the policy effect is set to Deny. |
| Require Tag + Value | If the subscription or resource group enforces required tag-value pairs, they must be provided in the Tags field. |
| Require Tag Only | If the subscription or resource group enforces required tag keys (any value), they must be provided in the Tags field. |
If any check fails, the form will surface an inline error describing the issue. For help resolving common launch errors, see Azure Cloud Pentest Troubleshooting.
Set Up Rest of Pentest¶
The remaining sections of the config form are the same as a standard Internal Pentest — scope, credentials, and advanced settings all apply here. For details on those sections, check out Run an Internal Pentest.
Review and Run Pentest¶
Once you’ve finalized your pentest selections, confirm your review of all advanced configuration settings by checking the designated box.
Finally, click Run Pentest to initiate the Azure Cloud pentest.
Monitor in Real Time¶
Click Real-Time View to track the progress of the pentest, watch identified vulnerabilities, and gain instant feedback on any issues that arise.
Review Test Results¶
After the pentest is complete, review the findings to identify vulnerabilities, misconfigurations, and potential attack vectors.
Take Action¶
Prioritize and address the vulnerabilities identified during the pentest. NodeZero provides recommendations and remediation steps to help you secure your environment.
Congratulations!¶
You've successfully run an Azure Cloud Pentest with NodeZero. You're now ready to assess and improve the security of your Azure Cloud environments. Continue exploring NodeZero for further guidance and advanced features to stay ahead of potential threats.