Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [azure]

A cloud computing platform offered by Microsoft.

Filter by
Sorted by
Tagged with
2 votes
0 answers
59 views

Issue with Single Sign-On (SSO) Implementation for WPF application with ADFS/MSAL

I'm encountering an issue with the implementation of Single Sign-On (SSO) in our WPF application, and I'd appreciate some guidance or insights from the community. Here's a breakdown of our setup: We ...
Barry Allen's user avatar
0 votes
1 answer
106 views

Can an Azure template contain a virus, a backdoor or malware?

Sometimes you can find projects on the internet that can propose you to import a template to Azure, like this one. You have a button and if you click it allows you to deploy: Then you go through the ...
Francesco Mantovani's user avatar
0 votes
0 answers
98 views

alternatives to MDE device isolation for unsupported OS versions

I’ve been exploring options for device isolation within MDE. I have Windows 2008 R2, Windows 2012 (they do not support device isolation at all), Windows 2012 R2, and Windows 2016 (they DO support it, ...
newby88's user avatar
2 votes
0 answers
109 views

Entra ID issuing expired ID Tokens

We are integrating our application with SSO using Entra ID App Registrations and configuring OIDC. When our application receives the ID token from Microsoft Entra, the iap and exp values seem invalid. ...
Brian Swanson's user avatar
1 vote
0 answers
124 views

Local development credential manager and best practices

I've long since been storing credentials to databases and services in local configuration files during development. Sometimes these need to be to production systems, which makes this a security issue. ...
John's user avatar
  • 149
1 vote
1 answer
93 views

Will these actions better secure my web app

I'm trying to figure out what else I should (not) do to reduce the possibility of my web app getting hacked. And like most development efforts, while it would be great to have a security expert on the ...
David Thielen's user avatar
2 votes
0 answers
223 views

Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray

TL;DR I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
CyberKnight's user avatar
1 vote
0 answers
80 views

Is it fine if I share a .pfx self signed certificate generated inside my machine with other users to test and use PnPCore SDK

We want to develop some Azure functions which use PnPCore SDK. For testing purposes, I registered an Azure app which uses self-signed certificate for authentication. Now I configured the Azure app ...
microsoftdeveloperdesigner's user avatar
0 votes
0 answers
79 views

Phishing mails to hidden Azure mailboxes

After some research, I couldn't find a clear answer: in Azure Cloud Domain, some users received phishing emails to hidden mailbox addresses. How can that be? How can those mailbox addresses be known ...
Loay's user avatar
  • 1
1 vote
1 answer
90 views

Do I need to protect my Azure Blobstorage with a WAF if all the contents inside are for public consumption?

Company policy states that all internet-facing components must be protected with a WAF. However, I have an Azure Blobstorage that stores public web assets. I don't think putting it behind a WAF makes ...
tanyehzheng's user avatar
0 votes
0 answers
76 views

pfSense not working properly on Azure VNet? What do i do?

I'm currently working on a project based on creating virtual networks and configuring a virtualized firewall (pfSense) along with access control. I was given this project idea in a cybersecurity ...
Thanos's user avatar
  • 111
1 vote
0 answers
164 views

What's the tradeoff of storing a connection string vs the password as a secret?

This is for an app service + database I am pushing up to Azure. I am using Key Vault + Managed Identity for the secrets. I have several connection strings in the secrets to ApplicationInsights, etc. ...
David Thielen's user avatar
0 votes
0 answers
64 views

Permission model for automated infrastructure provisioning

I am trying to secure automatic infrastructure provisioning but I am having a hard time designing a proper access policy that would not create a single point of failure (I tried and failed about a ...
Michał Dębski's user avatar
0 votes
1 answer
106 views

Security requirements to upload an excel file to a cloud blob storage

I want an authenticated user to upload an excel file to our web application. The Excel file will be parsed to generate structure. Security is important, so we'll need to prove that we follow best ...
Glasnhost's user avatar
  • 151
0 votes
0 answers
141 views

Are there any drawbacks to using TAP (Temporary Access Password)?

In 2021 Microsoft introduced TAP (Temporary Access Password) and it became popular especially for onboarding users. Are there any drawbacks generally to consider when implementing this option for user ...
Akam's user avatar
  • 1,357
0 votes
1 answer
190 views

Which kind of data breaches or risk can happen if there is no virtual/physical disk encryption

There is an Azure-based internal database server and is not public-facing. There is another front-end application. A specific user group can connect with a VPN. There is no encryption applied at the ...
steavesec07's user avatar
0 votes
0 answers
25 views

Which is more secure: Certificate or Secret inside our Azure Active Directory App, and why? [duplicate]

Inside our Azure Active Directory, we have 2 options to secure our calls to the Active Directory App: Secret Certificate Which option is more secure and why? Inside our applications which will be ...
test test's user avatar
1 vote
1 answer
310 views

Azure Shared Access Signature (SAS) token security

I'm learning Azure Storage and I am doing my best to make sure access from Internet is as safe as possible. When I generate a connection string there is a SAS token embedded in the URL. That token has ...
Ozwel's user avatar
  • 173
1 vote
1 answer
245 views

How SSO with OpenID and Azure AD works?

I try to understand how the integration we are using with OpenID works. I have read documents and different websites, but I feel that something escapes me related with SSO - I didn´t find so much ...
Kenzo_Gilead's user avatar
0 votes
1 answer
140 views

Secret security in containerised environment

I've been having a discussion with a developer about storing sensitive information in environment variables. Specifically within a containerised environment such as Azures Container apps. Background ...
Drifter104's user avatar
1 vote
1 answer
170 views

How do I remove malware with Defender for Cloud Apps? [closed]

I'm new to the role and my operational analyst left a few days before I started, I'm his manager, now it's just me. I'm familiar with the tooling but have never had to operate it myself. I've had an ...
mak47's user avatar
  • 113
2 votes
2 answers
3k views

OAuth2 - What is the advantage of using certificate over client secret credentials? (Azure)

When using OAuth2 in Azure, why Certificates are more secure than using Secrets? The Secrets have expiration and are strong, and generated automatically. The application needs to send a JWT containing ...
danilo's user avatar
  • 121
0 votes
0 answers
579 views

Change default classification label (Azure Information Protection) in Microsoft Office (Outlook, Word, Excel) by user

We have Azure Information Protection (AIP) configured for our organisation, we have 4 labels defined (public, internal, confidential, secret). The default label set for the organization is to "...
Marcello's user avatar
1 vote
0 answers
237 views

Intercept API calls of powershell module

I am looking at a way to intercept the API call made by the AzureAD powershell module. Wireshark is not able to decrypt the TLS packets sent and I'd also like to work with the HTTP requests rather ...
LucaBonadia's user avatar
0 votes
0 answers
421 views

Best way to encrypt client side data for SaaS inside the web

I am planning a SaaS-solution, where my clients store and save sensitive data on my servers. Security is a big point as it makes a product more trustworthy, so my thought was that the data which I ...
Robert Wolf's user avatar
2 votes
1 answer
2k views

What would be the best way to mitigate Azure Application Gateway WAF False Positive?

We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
Pranav Jituri's user avatar
1 vote
0 answers
623 views

Azure WAF support for OData

I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF? 1. ...
CuriousGuy's user avatar
0 votes
1 answer
628 views

Does "validating" a JWT token from prove authentication with OpenId?

I have a static react app which users login via an Okta SPA app. The app receives a JWT, which it is stored in the browser, and passed to the backend API via Authentication header on every request. ...
NSjonas's user avatar
  • 143
0 votes
1 answer
280 views

How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?

I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory Application is using the below details in-...
kudlatiger's user avatar
34 votes
4 answers
13k views

Is serverless code immune to DDoS attacks?

In classic hosting we have a virtual machine with limited resources allocated by hosting provider for running our web application. But with serverless code such as AWS Lambda or Azure Functions, our ...
Mr. Engineer's user avatar
0 votes
1 answer
162 views

Storing client keys in cloud app

I'm using Azure to store customer data. In a specific country, there are multiple partners. Each partner has his clients. The issue is they don't want us to have access to this data. In other words, ...
Houssem Ben Dhaou's user avatar
1 vote
4 answers
235 views

Ingress client certificate authenticate requires CA certificate to be stored in secret?

I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be ...
sg1993's user avatar
  • 113
1 vote
0 answers
205 views

Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?

I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow. Now, every user must enter an e-...
Alexei's user avatar
  • 2,193
2 votes
1 answer
1k views

How to restrict access to API in Azure API Management to known applications?

We need to create an API in Azure API Management and allow only known, registered applications to call it. We can require authentication, which restricts access to only people in our AAD, but how can ...
TimTheEnchanter's user avatar
1 vote
2 answers
3k views

Requesting an SSL certificate without a CSR, can it be done?

Please excuse me if this is a dumb or obvious question, I'm self taught and have not been able to find an exact answer to my question after much Googling and reading through StacEx! I'm having issues ...
Chris Butler's user avatar
1 vote
1 answer
369 views

Why if a server response contain both Public: TRACE and Allow: TRACE then responds with 405 NOT allowed?

SCENARIO: I'm testing a web application. To test if TRACE is enabled I used both nmap --script http-methods target.com and curl -k -i -X OPTIONS target.com After running the former I get 443/tcp ...
Maicake's user avatar
  • 567
0 votes
1 answer
412 views

Azure Ad B2C Users access resources in other directory

I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
Lukas Méndez Duus's user avatar
1 vote
2 answers
376 views

Verifying the security of SAML SSO

I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
eden881's user avatar
  • 237
9 votes
1 answer
9k views

Should I consider my Azure tenant ID as a secret?

As the title says: Should I consider my Azure tenant ID (GUID) as a secret? Are there any security implications when someone knows about this id?
Matthias Güntert's user avatar
22 votes
2 answers
4k views

How critical is encryption-at-rest for public cloud hosted systems?

I work as a solutions architect for web-based systems on AWS. As part of this role, I often respond to Information Security questionnaires. Nearly all questionnaires request information about data ...
jdog's user avatar
  • 345
2 votes
1 answer
782 views

Is it safe to expose port 22 on a database VM? [closed]

I have seen many answers to this question in different scenarios but I am still unsure of the actual answer. I have a VM in the cloud (Azure), which will be hosting my production database. Is it safe ...
james's user avatar
  • 123
1 vote
1 answer
3k views

Wrap key operation in Azure Key Vault - symmetric keys

Could anyone explain why the bolded part of the wrap key description? Wraps a symmetric key using a specified key. The WRAP operation supports encryption of a symmetric key using a key encryption key ...
user4205580's user avatar
1 vote
2 answers
2k views

How often should we force users to re-authenticate when not on the network?

Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
catfactory's user avatar
1 vote
1 answer
371 views

Security pattern for third party uploads to Azure blob container

Scenario: Vendor 1 needs to upload data (.json, compressed .csv files, images and video) to an Azure blob storage container owned by Vendor 2 Vendor 1 is issued a limited duration SAS token each day ...
SeaDude's user avatar
  • 113
3 votes
1 answer
518 views

How to prevent azure pipelines (yaml) from being used as an attack vector?

Let's say the following scenario exists: A git repository exists on Azure DevOps Repos. The repository uses yaml pipelines (azure-pipelines.yml). The repository has branch policies to ensure that ...
myermian's user avatar
  • 131
0 votes
1 answer
215 views

Is there a current best practice for authorizing an SPA to get/post to API

I have an API and an SPA. The SPA is all anonymous but I want to ensure the caller of the API is authorized to do so. It seems that all of the OAuth best practices, e.g. PKCE, depend on a user ...
Chris Rockwell's user avatar
3 votes
4 answers
3k views

How do I configure Azure Web Apps so that the only access is via CloudFlare?

I have a Web Apps (Linux) application on Azure, and I added a custom domain which I have protected with CloudFlare. I added Azure Security Center to my subscription. At the moment one can access the ...
gordon613's user avatar
  • 291
2 votes
0 answers
114 views

IPS solution for a medium sized web application

As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
Anonymous Platypus's user avatar
45 votes
9 answers
9k views

I have just 4 hours a month to security check a cloud based application - How to use my time?

I've been tasked with looking after an application deployed to azure. I have been allocated 4 hours a month. I essentially have half a workday to secure this application / keep it secure. What is an ...
user230910's user avatar
  • 1,015
0 votes
1 answer
197 views

What protocol is NPS server using to send Secondary Auth to Azure MFA?

We are using PAP to pass data between our on-prem VMware and on-prem NPS server. But our on-prem NPS Server passes data to Azure MFA in the cloud. I want to ensure a stronger protocol than PAP is ...
Alan Inman's user avatar