Stay informed on Azure security with the latest insights, trends, and updates. Your hub for all Azure-related information security news.
Search across headline titles and summaries.
Background for this topic.
Azure is a cloud platform offering computing, storage, and networking services that organizations use to run applications and manage data. Security in Azure depends on a shared responsibility model: Microsoft protects the physical infrastructure and core services, while users must secure their configurations, identities, and data within the environment.
Key security concerns include misconfigured access controls that expose resources, vulnerabilities in deployed applications or services, and risks from exposed management endpoints. Effective security requires enforcing least privilege through identity and access management, segmenting networks to limit lateral movement, and continuously monitoring for suspicious activity. Regular patching of workloads and careful configuration of Azure-native security features are critical to reducing attack surfaces and preventing unauthorized access or data exposure.
Weekly headline count for the current query.
Experts have revealed an Azure AD vulnerability exposing ClientId and ClientSecret in a publicly accessible appsettings.json file
Microsoft observed Storm-0501 pivot to the victim’s cloud environment to exfiltrate data rapidly and prevent the victim’s recovery
A critical Azure Machine Learning flaw allows privilege escalation, risking subscription compromise
New research by Security Intelligence has revealed security risks in MLOps platforms including Azure ML, BigML and Google Vertex AI
Microsoft MFA flaw exposed that allowed attackers to bypass security within an hour, putting 400m Office 365 accounts at risk
Microsoft is mandating MFA for all Azure sign-ins, with customers given 60-day advance notices to start implementation
Tenable detailed two privilege escalation vulnerabilities in the Azure Health Bot Service, one of which has been rated critical
Orca Security said the issue mirrors a previously identified vulnerability in Azure CLI
Proofpoint has observed an ongoing campaign targeting the Microsoft Azure applications of hundreds of individuals with operational and executive roles
Vulnerability could be exploited to gain elevated privileges
They could allow unauthorized access to sessions within the compromised Azure service iframe
The cross-site scripting flaw affects SFX version 9.1.1436.9590 or earlier and has a CVSS of 8.2
Microsoft said it saw between 40 and 60 daily attacks in February
Some users could not sign-in using Azure Active Directory
Unsecured data of 80,000 ISOC members discovered on Microsoft Azure blob repository