Acceptable use regarding utilizing Azure services to perform penetration testing

Question

I've been trying to find guidance regarding acceptable use of Azure services to perform penetration testing activities against systems external to Azure that have been approved by a client. I've seen this question asked before, but doesn't appear there is any clear answer:

• https://learn.microsoft.com/en-us/answers/questions/1433275/can-i-conduct-pentesting-from-azure-resources-to-c
• https://learn.microsoft.com/en-us/answers/questions/863835/allowed-to-perform-penetration-testing-from-azure

Thanks

Answer 1

@cmiller

I recommend not performing external penetration testing utilizing Azure resources. There are third parties that could be involved in this, which could lead to issues. Only the specific actions on the Penetration Testing Rules of Engagement should be performed.

---

If you still have questions, please let us know in the "comments" and we would be happy to help you. Comment is the fastest way of notifying the experts.

If the answer has been helpful, we appreciate hearing from you and would love to help others who may have the same question. Accepting answers helps increase visibility of this question for other members of the Microsoft Q&A community.

Thank you for helping to improve Microsoft Q&A!