Entra ID Security Audit
Fixed project price from 7,000 €, no hourly billing
30 minutes, no preparation needed. You will receive a written offer within a few working days.
Martin Grottenthaler, Founder and Lead Penetration Tester. OSCP, CISSP, GCFA, GWAPT. Pentesting since 2017.
Diese Seite ist auch auf Deutsch verfügbar.
An Entra ID Audit (formerly Azure AD) is a white-box review of your Microsoft Entra ID tenant that uncovers identity and access misconfigurations, weak Conditional Access policies, and privilege escalation paths.
EntraID (Microsoft Entra ID) is Microsoft’s central identity and access management (IAM) solution, especially in Microsoft 365 environments, and forms the basis for single sign-on (SSO) and access control. A misconfiguration can lead to unauthorized access to company resources or facilitate social engineering attacks. Therefore, this component must be thoroughly tested.
Scope
This type of test is typically performed as white-box, meaning that the testers receive full access to the tested system and its documentation. This allows a comprehensive analysis of vulnerabilities and misconfigurations in a short time frame. These are the main focus points of the test:
- Audit of the implementation status of the tier model and possible vulnerabilities
- Review of all accounts and their password age
- Review of the permissions of users, computers, and groups
- Review of group memberships of highly privileged groups
- Interview with administrators on how they typically administer the system
- Conditional access policies
- Verification against best practices
- The link to the on-premises Active Directory
Typical Duration
3-5 days (scope-dependent). Reporting takes roughly 30-50% of the test time on top.
Typical Price
from 7,000 €
The final price depends on the scope and is calculated from the planned effort, which the offer itemizes transparently (person-days times daily rate). The offer total is the final price: if the actual effort ends up a little over or under the estimate, the price stays the same.
Deliverables
Every engagement includes:
- Written findings report with all misconfigurations, prioritized by severity, with remediation steps
- Management summary tailored to your audience (technical or executive)
- Live debriefing to walk through findings and answer questions
- Retesting after remediation available on request
See example reports for what a VidraSec report looks like.
Compliance
Directly relevant for NIS2, ISO 27001, and TISAX. Identity and access management is a core control domain in all major security frameworks.
Frequently asked questions
What is Entra ID?
Entra ID (formerly Azure AD) is Microsoft’s cloud-based identity and access management system. It underpins single sign-on and access control in Microsoft 365 and is separate from Microsoft’s on-premises Active Directory. An Entra ID Security Audit reviews this cloud identity environment for misconfigurations and privilege escalation paths.What is the difference between Entra ID and Active Directory?
Active Directory is Microsoft’s on-premises identity system; Entra ID (formerly Azure AD) is the cloud identity platform behind Microsoft 365 and single sign-on. They are separate systems and are covered by separate audits, though VidraSec also reviews how the two are connected.Does the Entra ID Audit cover Conditional Access and MFA?
Yes. Conditional Access policies, MFA enforcement, and common MFA bypass and social engineering risks are a core focus of the audit, alongside privileged role assignments and app registration permissions.How long does an Entra ID Audit take?
Typically 3 to 5 days depending on tenant complexity, plus roughly 30 to 50 percent of that time for reporting.How much does an Entra ID Audit cost?
From 7,000 euros. The final price depends on scope and the maturity level of your environment and is calculated individually.More questions on pricing, lead times, NDAs, or compliance: see the general FAQ
