{"id":4583,"date":"2023-09-28T07:00:00","date_gmt":"2023-09-28T07:00:00","guid":{"rendered":"http:\/\/www.sumologic.com\/blog\/azure-cloud-purple-team"},"modified":"2026-03-23T11:11:28","modified_gmt":"2026-03-23T19:11:28","slug":"azure-cloud-purple-team","status":"publish","type":"blog","link":"https:\/\/www.sumologic.com\/blog\/azure-cloud-purple-team","title":{"rendered":"How to execute an Azure Cloud purple team exercise"},"content":{"rendered":"\n
\n
\n
\n
\n
\"Threat_Azure_blog_700x200\"<\/figure>\n<\/div>\n\n\n


<\/p>\n\n\n\n

For folks who are responsible for threat detection of any kind for their organizations, the cloud can often be a difficult area to approach. <\/p>\n\n\n\n

At the time of writing, Amazon Web Services contains over two hundred services, while the Azure cloud offers six hundred. <\/p>\n\n\n\n

Each of these services can generate unique telemetry<\/a> and each surface can present defenders with a unique attack path to handle. Adding to this complexity is the diversity of cloud workload configurations, as well as varying architecture models. <\/p>\n\n\n\n

How do we, as protectors of the enterprise, begin to tackle visibility and threat detection use cases for these types of environments? <\/p>\n\n\n\n

In previous blog posts<\/a>, we have outlined what purple teaming is and why it\u2019s a powerful tool to bring to bear in your enterprise. Now, let\u2019s continue this theme and cover how to apply the purple teaming concept to a Microsoft Entra\/Microsoft Azure environment which consists of compute, identity and productivity components. <\/p>\n\n\n\n

Why purple team the cloud?<\/h2>\n\n\n\n

As noted in the introduction to this post, the Azure cloud is associated with hundreds of services. <\/p>\n\n\n\n

Complicating this is the fact that the Azure cloud provides mechanisms for identity management via Microsoft Entra, compute options via Microsoft Azure, as well as various productivity services via Office 365. <\/p>\n\n\n\n

Each of these three \u201cpillars\u201d has a unique set of telemetry and use cases tied to it, with various attack surfaces. In addition, from a threat actor point of view, the tradecraft necessary to meet objectives will no doubt differ depending on which component or service is being attacked or targeted. <\/p>\n\n\n\n

In this context, a purple team can be a valuable exercise that can be executed on an Azure cloud environment. <\/p>\n\n\n\n

It is difficult to start from scratch in this regard, so let\u2019s briefly mind map the following broad areas of purple teaming in the context of the Azure cloud: planning, desired outcomes, areas of focus and finally, pitfalls.
<\/strong><\/p>\n\n\n

\n
\"Why<\/figure>\n<\/div>\n\n\n

Tactics, techniques and procedures selection<\/h2>\n\n\n\n

Let\u2019s apply this approach to a fictitious organization named FakeORG that utilizes the following Azure cloud services:<\/p>\n\n\n\n