Azure identity and access review
Identity is the main security boundary in Azure, so our identity and access review looks at who can reach what, whether they still need it and how your credentials and secrets are stored.
RBAC, privileged access and Conditional Access
We go through role assignments in every subscription and management group, looking for access that's broader than it needs to be or no longer justified. Standing Owner and Contributor roles come up here, and we'll say where Privileged Identity Management (PIM) should replace them. Your Conditional Access policies are then checked for gaps in MFA enforcement, device compliance and the handling of risky sign-ins.
Secrets, Key Vault and certificate management
We check whether Azure Key Vault is used for every secret, key and certificate and flag any credentials left in plain text in application settings, environment variables or code. The review also covers Key Vault access policies and certificates that have expired or are about to, along with any secret that is shared between environments or never rotated.
Other Azure reviews
- Security & compliance
- Network & infrastructure
- Endpoint & VM security
- Architecture & operations
- Cost optimisation
Also on AWS? See our AWS identity and access review.