This list groups the open-source Azure security tools we recommend by what they help you do. Looking for AWS instead? See our open-source AWS security tools.

Disclaimer: We do our best to list only reputable tools, but we can't inspect every one of them, so we can't guarantee they work as advertised. Use them at your own risk, and test them outside of production first.

Security assessments

  • AzureInspect - Modular PowerShell scripts that check your Azure subscriptions for security best practices around VMs, RBAC roles and assignments, subscription policies, and more, then produce an HTML report with step-by-step remediation.
  • 365Inspect - The Microsoft 365 counterpart: checks users, roles, applications, email, sharing settings, and more in a Microsoft 365 tenant, with remediation steps in the report.

Pentesting and red teaming

  • AzureGoat - A "vulnerable by design" Azure environment with multiple escalation paths, covering services like Functions, Cosmos DB, Storage Accounts, Automation, and managed identities.
  • ROADtools - A framework for interacting with Microsoft Entra ID (Azure AD), including the ROADrecon exploration tool and the roadtx token exchange tool.
  • MicroBurst - PowerShell functions and scripts for Azure service discovery, weak configuration auditing, and post-exploitation actions like credential dumping during pentests.
  • AzureHound - The BloodHound data collector for Microsoft Azure and Entra ID, for analyzing attack paths.
  • GraphRunner - A post-exploitation toolset for the Microsoft Graph API, for reconnaissance, persistence, and pillaging data from a Microsoft Entra ID account. (Introduction from Black Hills Information Security)

Threat detection

  • CloudGrappler - Queries for high-fidelity detections related to well-known threat actors in AWS and Azure.

Attack simulation

These tools help you test your defenses to make sure they detect common Azure attacks:

  • Stratus Red Team by Datadog - Granular, actionable adversary emulation for the cloud.
  • Atomic Red Team - Small, portable detection tests mapped to MITRE ATT&CK. Not specific to the cloud, but it includes Azure tests.

For more options, Christophe Tafani-Dereeper maintains a comparison of attack simulation tools.

Threat and vulnerability databases

Thanks to gvoden and Carl Littrell, who contributed most of these tools when this list lived on CloudSec.Cybr.

Learn Azure security hands-on

Want to practice in real Azure environments? Our Learn Azure in 30 Days course and Azure hands-on labs let you build, attack, and defend Azure resources without using your own subscription.