---
title: "Open-Source Azure Security Tools, Grouped by What They Help You Do - Cybr"
description: "A curated list of open-source Azure security tools for security assessments, pentesting, threat detection, and attack simulation."
url: https://cybr.com/cloud-security/open-source-azure-security-tools/
---

# Open-Source Azure Security Tools, Grouped by What They Help You Do

A curated list of open-source Azure security tools for security assessments, pentesting, threat detection, and attack simulation.

Christophe

Published March 11, 2024 · Updated October 27, 2026

This list groups the open-source Azure security tools we recommend by what they help you do. Looking for AWS instead? See our [open-source AWS security tools](https://cybr.com/cloud-security/open-source-aws-security-tools/).

> **Disclaimer:** We do our best to list only reputable tools, but we can't inspect every one of them, so we can't guarantee they work as advertised. Use them at your own risk, and test them outside of production first.

## Security assessments

- [AzureInspect](https://github.com/soteria-security/AzureInspect) - Modular PowerShell scripts that check your Azure subscriptions for security best practices around VMs, RBAC roles and assignments, subscription policies, and more, then produce an HTML report with step-by-step remediation.
- [365Inspect](https://github.com/soteria-security/365Inspect) - The Microsoft 365 counterpart: checks users, roles, applications, email, sharing settings, and more in a Microsoft 365 tenant, with remediation steps in the report.

## Pentesting and red teaming

- [AzureGoat](https://github.com/ine-labs/AzureGoat) - A "vulnerable by design" Azure environment with multiple escalation paths, covering services like Functions, Cosmos DB, Storage Accounts, Automation, and managed identities.
- [ROADtools](https://github.com/dirkjanm/ROADtools) - A framework for interacting with Microsoft Entra ID (Azure AD), including the ROADrecon exploration tool and the roadtx token exchange tool.
- [MicroBurst](https://github.com/NetSPI/MicroBurst) - PowerShell functions and scripts for Azure service discovery, weak configuration auditing, and post-exploitation actions like credential dumping during pentests.
- [AzureHound](https://github.com/SpecterOps/AzureHound) - The BloodHound data collector for Microsoft Azure and Entra ID, for analyzing attack paths.
- [GraphRunner](https://github.com/dafthack/GraphRunner) - A post-exploitation toolset for the Microsoft Graph API, for reconnaissance, persistence, and pillaging data from a Microsoft Entra ID account. ([Introduction from Black Hills Information Security](https://www.blackhillsinfosec.com/introducing-graphrunner/))

## Threat detection

- [CloudGrappler](https://github.com/Permiso-io-tools/CloudGrappler) - Queries for high-fidelity detections related to well-known threat actors in AWS and Azure.

## Attack simulation

These tools help you test your defenses to make sure they detect common Azure attacks:

- [Stratus Red Team](https://github.com/DataDog/stratus-red-team) by Datadog - Granular, actionable adversary emulation for the cloud.
- [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) - Small, portable detection tests mapped to MITRE ATT&CK. Not specific to the cloud, but it includes Azure tests.

For more options, Christophe Tafani-Dereeper maintains a [comparison of attack simulation tools](https://stratus-red-team.cloud/comparison/).

## Threat and vulnerability databases

- [The Open Cloud Vulnerability & Security Issue Database](https://www.cloudvulndb.org/results?tags=Azure)

Thanks to gvoden and Carl Littrell, who contributed most of these tools when this list lived on CloudSec.Cybr.

## Learn Azure security hands-on

Want to practice in real Azure environments? Our [Learn Azure in 30 Days](https://cybr.com/announcements/new-azure-course-and-hands-on-labs/) course and [Azure hands-on labs](https://cybr.com/hands-on-labs/?category=azure) let you build, attack, and defend Azure resources without using your own subscription.

## Filed under

- [Cloud Security](https://cybr.com/cloud-security/)
- [Azure](https://cybr.com/tag/azure/)
- [Azure Security](https://cybr.com/tag/azure-security/)
- [Open-source](https://cybr.com/tag/open-source/)
- [Tools](https://cybr.com/tag/tools/)

## Comments

Loading comments…

Recommended resources

[![Explore the Getting Started with Microsoft Defender for Cloud course](https://media.cybr.com/2025/06/Linkedin_Microsoft-Defender-for-Cloud-1024x683.jpg)](https://cybr.com/courses/getting-started-with-microsoft-defender-for-cloud/)

## Build practical Azure security skills

Learn how to protect cloud workloads with Microsoft Defender for Cloud, then practice Azure security in hands-on environments.

[Microsoft Defender for Cloud course](https://cybr.com/courses/getting-started-with-microsoft-defender-for-cloud/) [Explore Azure hands-on labs](https://cybr.com/hands-on-labs/)