Detect and close cloud attacks on Microsoft Azure.

See what attackers see – with real-world ProSec assessment techniques. A hands-on workshop for administrators who want to understand their own Microsoft cloud environment from an attacker's perspective and harden it effectively.

 
Microsoft Azure
Entra ID
Hands-on
Offense & Defense
3 days
ProSec Lab
Book now — €1.590 per person
View content
Workshop details
Format
3-day workshop + 2 weeks of self-study
Dates
November 03rd/11th/17th, 2026 March 02nd, 09th, and 16th, 2027
Execution
Remote
Time of day
8:30 - 16:30 PM
Participants
Max. 12 people
En casa
On request
Completion
Practical focus / Certificate of participation
1.590 € per person net

What attackers see – and admins often overlook.

Microsoft cloud environments grow over years. Permissions, configurations, and trust relationships change without anyone taking the attacker's perspective.

 

Established configurations

Roles, access rights, and cloud configurations change over time. In this workshop, participants learn to systematically understand their own Azure and Entra-ID environment and to visualize security-relevant relationships.

Lack of attacker perspective

Administrators typically view their environment from an operational perspective. In the practical lab, participants experience how attackers use identities, login flows, OAuth, and tokens to expand existing access channels.

Unclear priorities

Isolated anomalies don't necessarily reveal where the greatest risk lies. The workshop combines attack execution and defense, enabling participants to identify relevant attack vectors and derive targeted hardening measures.

External dependency

External assessments provide important insights, but they don't replace internal understanding. Through real-world lab scenarios and working on their own environment, teams learn to interpret observations themselves and implement safety measures more effectively.
Security professionals see several paths to global administration within a typical cloud assessment, all within just a few hours. Most of these paths aren't new; they've just never been viewed from this perspective.

For those who are responsible for Microsoft cloud environments on a daily basis.

For people who need to operate and secure Azure and Entra ID within the company.

 

👤

IT admins

With practical Azure experience. Responsible for identities, access, and configurations.

 
 

🛡️

Security Engineers

Responsible for cloud identities and configurations. Basic Azure knowledge is required.

 

🏳️

Cloud/System Architects

Technical decision-makers who want to understand the structural aspects of attack surfaces and evaluate hardening measures.

 

⚠️

Not suitable for: Cloud beginners with no prior practical experience · Pure certification preparation (SC-900/AZ-900) · Expectation of a classic administration training course. Practical Azure experience is required.
 

Five blocks. One common thread.

From the basic conceptual understanding to the practical execution of the attack and the hardening recommendation.

 
  • Shared responsibility model and cloud service types
  • Entra ID as an Identity Provider, interaction with Azure and M365
  • Attack surface & login flow, OAuth basics, access/refresh tokens
  • Independently understanding Identity & OAuth based on one's own environment
  • Transfer of Tag 1 content to your own Entra ID configuration
  • Offensive: Phishing/Adversary-in-the-Middle, Token Replay, Conditional Access Bypass, FOCI/BroCI
  • Defensive: Policy Design & Detection, Sign-In Risk, Named Locations, Report-Only Mode
  • Hands-on learning in a deliberately vulnerable lab environment
  • Compare observations regarding the effect of conditional access and attack surfaces from day 1/2 with your own environment.
  • Collect open questions and examples of protocol depth on day 3
  • Tokens, claims and authorization flows in detail
  • Architectural relationships between Azure, Entra ID and Microsoft 365: a case study
  • Final exercise with direct practical application

Developed by penetration testers. Intended for administrators.

The workshop is conducted by practitioners from the ProSec project business. The lab scenarios are based on real cloud assessments.

Real Lab Scenarios

The exercise environment reflects patterns that ProSec regularly encounters in real cloud assessments, not a constructed teaching scenario.

 

Trainers from the project business

The workshop leader comes from ProSec's active penetration testing and consulting operations.

 

Direct transferability

Participants leave the workshop with a clear logic for action applicable to their own environment.

 

In-house at the customer's premises

On request
  • ProSec comes to you. Particularly useful as a follow-up to a cloud assessment.
  • Advantages: Adapting to one's own environment
Inquire about in-house training →

Open Workshop

November 03rd/11th/17th, 2026
pP net 1.590 €
  • Fixed dates, open group of participants. Bookable individually or as a team.
  • Advantages: Exchange with participants from other companies
Book an open appointment
12 max

Open Workshop

March 02nd, 09th, and 16th, 2027
pP net 1.590 €
  • Fixed dates, open group of participants. Bookable individually or as a team.
  • Advantages: Exchange with participants from other companies
Book an open appointment
12 max

Register now.

REGISTRATION FORM

MS Azure

Workshop

Open workshop: €1.590 per person net. In-house format: on request. Contact us — we'll discuss dates and formats.

 
Book an open appointment →
Inquire about in-house training
edu@prosec-networks.com

Contact form

Share your feedback and help us improve our services!

Share your feedback and help us improve our services!

Take 1 minute to give us some feedback. This way we can ensure that our IT security solutions meet your exact needs.

Survey
Survey