Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [azure]

The tag has no usage guidance.

2
votes
1answer
55 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
1
vote
1answer
125 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
3
votes
0answers
687 views

Are enterprises Office 365 accounts overly exposed to brute force attacks?

Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”. ...
2
votes
0answers
21 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
2
votes
0answers
123 views

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
2
votes
0answers
101 views

Google.com serving *.portal.azure.com SSL certificate?

Just ran across this in my own browser (Chrome, Mac OS) where going to google.com would serve a *.portal.azure.com certificate. It seemed to be signed all the way to the root too. This disappeared ...
2
votes
0answers
339 views

Implementing ACS with REST + many Identity Providers - Problems - Azure

I am trying to integrate ACS to use in my application's authentication system. Currently I have a Javascript client and a WCF so I had to use a REST architecture. I am quite puzzled on how to do ...
1
vote
0answers
25 views

Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?

I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
1
vote
0answers
31 views

Azure publicly exposed resources

Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from ...
1
vote
0answers
30 views

What is the default cipher for SSL connections in Azure for MariaDB?

According to Microsoft's Documentation, Azure should be configured to use SSL for connections. In regards to default settings, they state the following: By default, the database service should be ...
1
vote
0answers
85 views

Building upon SOC 2 Compliance of hosting provider

We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
1
vote
0answers
37 views

How to protect against rogue malicious applications in the Azure AD?

Consider the following hypothetical scenario: I create the PhotoApp - native Android application that is used by users to manage their private photos. I create the PhotoService - Web API that is ...
1
vote
0answers
55 views

What current methods are there to gain access to Azure?

I'm currently working with our development teams and trying to build a threat model for the Azure environment and how attackers may gain access to our instance. So far I haven't found much in the way ...
1
vote
0answers
547 views

Is it possible to allow anonymous users to access part of an Azure website which uses Active Directory

I have a website hosted in Azure that uses Active Directory to prevent anyone from accessing it except for a few test users. Now I would like to expose a single page so that anyone can access it. I've ...
0
votes
0answers
19 views

Azure AD — How to only allow MFA configuration from a trusted network?

Hopefully someone as an idea... In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
0
votes
0answers
43 views

Usage of a self-signed certificate between Akamai and Azure

First of all, some background of what is proposed: The client's browser initialises request The request is resolved by public DNS (CNAME) to Akamai Edge The request is processed by Akamai accordingly ...
0
votes
0answers
141 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
0answers
29 views

Is Azure Key Vault more secure than the machine certificate store?

I'm trying to secure the communication between two on-premise legacy applications (one .NET and one Java) using client certificates. One application is exposed externally so I don't want to rely on ...
0
votes
0answers
83 views

Azure AppService - Configuration vulnerability - Would you also consider this as a vulnerability?

just in short. I was playing around a Azure AppService as I wanted to know how secure it is. I have discovered it is possible (using the regularly deployed application) to write to complete d:\home ...