# Hacker vs Azure: 5 Attacks, 5 Defences

> Each attack, matched to the Azure feature that stops it.

- **Format:** short video, 8 steps, ~25 seconds
- **Topic:** Five attacks on a mobile backend and the five named Azure defences that stop each one — WAF, Microsoft Entra ID, authorization in your API, Key Vault and a private endpoint — plus the one default setting that quietly opens a door.
- **Author:** Suthahar Jegatheesan (MSDEVBUILD)
- **Category:** Azure · Azure Security
- **Published:** 2026-08-17
- **Tags:** azure, security, cybersecurity, apisecurity, azurefrontdoor, microsoftentraid, azurekeyvault, cloudsecurity, devsecops, owasp, dotnet, microsoftazure, az500, msdevbuild
- **Canonical URL:** https://blog.msdevbuild.com/shorts/hacker-vs-azure-defences/

---
## What you'll learn

- Which Azure service stops which specific attack, by name
- Why a valid token from a real user is still an attack you must block
- Why "allow Azure services" is far broader than it sounds

## Understand it one step at a time

### 1. One attacker, one target

He wants your customer data. Five defences stand between him and it — skip any one and the rest don’t cover for it.

### 2. Attack 1: a flood of junk

The WAF runs the OWASP ruleset at the edge — but it ships in Detection mode by default, which only logs. Switch it to Prevention.

### 3. Attack 2: no token at all

He calls your API with no token at all. Entra ID checks the signature — validate the audience claim too, not just that it’s signed.

### 4. Attack 3: a real token

His own valid login, someone else’s order id. This is OWASP API’s #1 flaw — a valid token doesn’t stop it, an owner check does.

### 5. Attack 4: your public repo

He searches your public repo for keys and finds none — they live in Key Vault. Check git history too, not just the current HEAD.

### 6. Attack 5: straight at the data

He skips every layer and dials the database directly. A private endpoint means there’s no public address left to even try.

### 7. One setting opens a door

“Allow Azure services and resources” sounds like it means yours. It means any Azure subscription on earth, including one he just made.

### 8. Five doors, five questions

Five doors, five different questions — garbage, identity, ownership, secrets, reachability. Miss one and the rest don’t cover for it.

---

## The takeaway

**Five doors. Five different questions.**

And one default setting that quietly opens the last one — check it today.