Core Compute & Isolation
Hyper-V & Cerberus Chip
Relies on a highly modified, security-hardened Hyper-V. Hardware attestation through the custom Cerberus chip validates firmware during boot, neutralizing bootkits and firmware implants.
Entra ID (Active Directory)
Anchors the security ecosystem. Provides the industry's most sophisticated conditional access policies, risk-based authentication matrices, and deep integration with Microsoft 365.
Under the Hood Architecture
Network Security Groups
VNets provide default network isolation utilizing NSGs and ASGs. Deep network visibility is achieved by configuring NSG Flow Logs with Microsoft Sentinel for forensic visibility.
Defender for Identity
Behavioral sensors on domain controllers flag the classic Active Directory attacks — Pass-the-Hash, Golden Ticket, DCSync — making it the blue-team counterpart you practice evading in an Entra ID pentest lab.
Real-World Attack Surface
OMIGOD (Agent RCE)
Exposed a critical flaw in silently installed Linux agents (OMI), enabling single-request remote code execution on externally exposed management ports.
ChaosDB
Completely broke tenant isolation in Cosmos DB, allowing full read/write access without authentication due to underlying flaws in Jupyter Notebooks architecture.
Mandatory Hardening Baseline
- Audit Silent Agents: Relentlessly audit silently deployed extensions and ensure external management ports (5985/5986) are explicitly blocked via NSGs.
- Cosmos DB Auth: Migrate immediately from primary access keys to strict Entra ID RBAC authentication to prevent data theft.
- OAuth Consent Governance: Apply strict governance to OAuth App Registrations in Entra ID to prevent illicit consent grants from causing tenant-wide compromise.
Architecture Comparison
| Component | Azure | AWS |
|---|---|---|
| Isolation Architecture | Hyper-V + Cerberus chip | Nitro System |
| Network Visibility | NSG Flow Logs | VPC Flow Logs |
| Identity Security Tax | High (Entra ID P1/P2) | Moderate |
| Key Management | Key Vault / Managed HSM | KMS / CloudHSM |
