Azure security review and assessment for Australian organisations.
An Azure cyber security review of your subscriptions and Entra ID tenant across identity, privilege, networking, secrets, logging and workloads, read-only wherever possible.
Microsoft 365 and Azure security review from $3,500 ex GST.
Fixed scope, written findings and a remediation plan.
- Access wherever possible
- Read-only
- Findings report and remediation plan
- Two documents
- CyberCert public registry
- SMB1001:2026 Gold
The review reads the tenant configuration directly: which identities hold privileged roles, which resources accept traffic from the internet, where credentials are stored, and which logs are kept long enough to investigate an incident. Each finding is tied to the Azure control that closes it.
Prioritised findings, and the Azure estate we run
Findings are prioritised by the risk they create in your environment and mapped to the Azure controls required to address them.
Black Shard runs production workloads on Azure in the Australia East region. Aurii, a clinical software platform the firm built and operates, runs on Container Apps with PostgreSQL row-level security isolating tenant health data, Key Vault for secrets, and GitHub Actions deploying through workload identity federation so no long-lived credential sits in the pipeline. Client tenants are reviewed against the same configuration decisions.
Azure security: what Microsoft secures and what the tenant owns
Azure security is divided under Microsoft's shared responsibility model. Microsoft secures the physical datacentres, hosts and network the platform runs on. The customer always keeps responsibility for its data, its accounts and identities, and the devices that connect, whichever Azure services it deploys.
The customer side of the model
The customer side is largely configuration: which identities hold privileged roles, which resources accept traffic from the internet, where credentials are stored, and which logs are kept long enough to investigate an incident. Defender for Cloud and Azure Policy report on that configuration. The review reads it directly and weighs each permission and exposure against what the tenant runs.
What the Azure security review covers
Each area is assessed against what the tenant runs, who touches it, and what an attacker positioned inside it could reach.
- Identity: privileged Entra ID roles, conditional access coverage, admin MFA, guest and dormant accounts, legacy authentication
- Privilege: Owner and Contributor at subscription scope, over-privileged service principals, and access that outlived its project
- Networking: internet-facing resources, public storage and database endpoints, network security group rules and private endpoints
- Secrets: where credentials live, Key Vault use, secrets in settings or code, rotation, and workload identity federation
- Logging: diagnostic settings, activity and sign-in log retention, and the telemetry to detect and reconstruct an attack
- Workload configuration: resource-level settings on storage accounts, databases, container platforms and TLS, checked against the platform's own hardening guidance.
What the review produces
Two documents. The findings report records where the tenant stands, with each finding manually verified and the evidence to reproduce it.
The remediation plan
The remediation plan lists what to change, in what order, using controls the tenant already licenses: Entra ID conditional access, Azure Policy, Key Vault, private endpoints, diagnostic settings, and Defender for Cloud where it applies.
Findings are ordered by the risk they create in the environment, so remediation starts with the changes that remove the most exposure. The plan is written for the team that will do the work.
How the Azure security assessment runs, step by step
Every assessment follows the same sequence. The timeframe is fixed in writing at scoping and depends on the subscriptions, environments and workloads in scope.
Black Shard holds SMB1001:2026 Gold, verifiable on CyberCert's public registry, and runs at ASD Essential Eight Maturity Level 3.
- Scoping: a free 30-minute call records the tenancy layout, key workloads, obligations and the report deadline
- Access: Global Reader in Entra ID and Reader at agreed subscription scopes, time-boxed to the engagement
- Collection: configuration read across Entra ID, management groups, subscriptions and resources
- Analysis: each permission and exposure weighed against the workload, with Defender for Cloud and secure score as inputs
- Verification: every finding confirmed by an engineer, with the evidence to reproduce it recorded alongside
- Reporting: the findings report and the remediation plan, walked through with the people who will do the work
Close-out
- Close-out: the review roles removed at the end of the engagement
How the review runs
Scoping records the tenancy layout, the workloads that matter and the obligations the organisation carries. Access is read-only wherever possible: typically Global Reader in Entra ID and Reader at the relevant subscription scopes, agreed at scoping and removed when the engagement ends.
The timeframe is agreed before work starts, and the review is delivered remotely. It runs as a one-off assessment or as the opening of an ongoing advisory arrangement. Remediation can follow as advisory support or hands-on engineering.
The Azure security checklist behind the review
The six areas break down into specific checks. Each one is read against the tenant as configured on the day, with the result recorded as a finding, a confirmed control or a gap in coverage.
- Entra ID: Global Administrator count, break-glass accounts, Privileged Identity Management for standing roles, conditional access exclusions and legacy authentication
- Role-based access control: Owner, Contributor and User Access Administrator assignments, and custom roles with wildcard actions
- Workload identities: service principals and managed identities, client secret and certificate lifetimes, and federated credentials on deployment pipelines
- Storage: public blob access, shared key authorisation, public network access, minimum TLS version and soft delete
- Databases: public endpoints, firewall rules open to all Azure services, Entra-only authentication and auditing
- Key Vault: RBAC or access policies, purge protection, soft delete and network restrictions
Network, logging, governance and recovery checks
- Network: network security group rules open to the internet on management ports, private endpoint coverage, and web application firewall placement
- Logging: activity log export, diagnostic settings to a Log Analytics workspace, retention periods and sign-in log coverage
- Governance: Azure Policy assignments and exemptions, Defender for Cloud plans enabled per subscription, and resource locks on production
- Recovery: backup coverage, Recovery Services vault soft delete and immutability
Common findings
The same patterns recur. Privilege accretes: an Owner assignment handed out during a migration is still there years later, attached to an account nobody has reviewed. Service principals carry client secrets that never expire, created before workload identity federation was available.
Secrets, network and ownership
Secrets drift out of Key Vault into app settings, pipeline variables and the occasional repository.
On the network side, storage accounts keep public network access because an integration needed it once. Legacy authentication stays enabled for one workload nobody can name. Diagnostic settings were never configured, so when something happens the activity log has aged out and there is nothing to investigate. Underneath sits ambiguous ownership: a tenant stood up by a partner who has since moved on, with nobody inside the organisation holding the whole picture.
When organisations commission an Azure security review
The common triggers are a migration into Azure that moved faster than its access model, a tenant built by a partner who has since moved on, a customer security questionnaire or insurer renewal that asks about cloud configuration, an Essential Eight or ISO 27001 programme that needs the cloud estate measured, and the weeks after an incident when the question is what else is exposed.
Organisations running Microsoft 365 alongside Azure usually take the two together, since the identity plane is shared. The review reads Entra ID once and reports on both sides of the tenant from it.
How much does an Azure security review cost?
A Microsoft 365 and Azure security review starts at $3,500 ex GST, for a fixed scope with a written findings report and a remediation plan.
What drives the effort
Above that starting price, effort is driven by the number of subscriptions and environments, the workload running in the tenant, and the size of the identity estate: users, service principals and privileged roles.
Scope, timeframe and deliverable are agreed before any work starts, on a free 30-minute scoping call or from a brief to info@blackshard.com.au with the shape of the environment.
Questions, answered
What is an Azure security assessment?
An Azure security assessment is a structured review of how a Microsoft Azure tenant is configured: who holds privilege in Entra ID and on subscriptions, what is exposed to the internet, where secrets are stored, and whether logging is in place to investigate an incident. It ends in a findings report and a remediation plan ordered by risk.
How much does an Azure security assessment cost in Australia?
A Microsoft 365 and Azure security review from Black Shard starts at $3,500 ex GST for a fixed scope with a written findings report and a remediation plan. The price above that is set by the number of subscriptions and environments, the workloads in the tenant and the size of the identity estate, and is agreed before work starts.
What does an Azure security assessment cover?
Six areas, assessed against what the tenant runs: identity in Entra ID, privilege at subscription scope, networking and internet exposure, secrets and Key Vault, logging and retention, and workload configuration. The review produces a findings report with each finding manually verified, and a remediation plan ordered by risk.
What access do you need to our tenant?
Reader-level roles scoped to the review: typically Global Reader in Entra ID and Reader at the relevant subscription scopes, agreed at scoping and removed when the engagement ends. Write access is not required to run a review.
How long does an Azure security review take?
The review runs as a fixed-scope engagement, with the target, timeframe and deliverable agreed before work starts. Subscriptions, environments and workload count drive the effort; a single-subscription tenant reviews faster than a multi-subscription estate.
Is this an audit or a certification?
No. It is an engineering review of the tenant and carries no certificate. Black Shard holds SMB1001:2026 Gold, verifiable on the CyberCert public registry, and works against the ASD Essential Eight as a framework. If certification is the goal, the review's findings feed compliance readiness work.
How is an Azure security assessment different from a penetration test?
An Azure security assessment reads the tenant's configuration with read-only roles and establishes who holds privilege, what the control plane exposes to the internet and whether telemetry is collected. A penetration test attempts to exploit what is reachable and shows whether a control holds against a real attempt. Where a finding needs that proof before it is rated, the assessment flags it for a live test, which Black Shard also runs.
We already have Defender for Cloud and a secure score. Do we still need a review?
Secure score is read as part of the review. It does not judge whether a permission is proportionate to its purpose, whether an exposure is deliberate, or whether anyone would act on an alert. The review adds that judgement.
Do you review Entra ID as part of this?
Yes. Entra ID is the identity control plane of the tenant, so privileged roles, conditional access, service principals and their credentials are in scope by default. Where the Microsoft 365 identity estate needs examining on its own, the Entra ID security review is the deeper engagement.
Can you fix what you find?
Yes. Black Shard is a software engineering firm as well as a cybersecurity firm, so remediation can run as advisory support or hands-on engineering after the review. The plan is also written so your own team can execute it.
Does the review cover Microsoft 365 as well as Azure?
It can. The entry offer is a Microsoft 365 and Azure security review, because both sit on the same Entra ID tenant. Exchange Online, SharePoint and Teams settings are added to the scope where the organisation runs them.
How do we start an Azure security review?
Book the free 30-minute scoping call, or send a brief with the number of subscriptions, the main workloads and any deadline. The scope, timeframe and price are confirmed in writing, and the review starts once read-only access is granted.
Related reading
The full practice: Security advisory & vCISO.
Tell us what you need built, reviewed or secured.
Brisbane head office.
Book a free 30-minute scoping callOpen a briefinfo@blackshard.com.au