Hacker vs Azure: 5 Attacks, 5 Defences

Frequently asked questions

Which Azure service stops which kind of attack?

Front Door's WAF blocks junk traffic and injection at the edge, Microsoft Entra ID proves identity, an owner check inside your API blocks a valid token being used against someone else's data, Key Vault plus managed identity removes the value of a leaked key, and a private endpoint removes a database's public address entirely.

What does "allow Azure services" actually permit on a firewall?

Far more than it sounds — it permits any resource in any Azure subscription in the world, not just your own, including one an attacker can create in minutes. Leave it off and use specific service tags or private endpoints instead.

Read deeper on Azure

Twenty seconds gets the shape of an idea across. These go into how it behaves in production.

• Hacker vs Azure Defences: Five Attacks on a Mobile Backend, Five Controls

  Five common attacks on one Azure mobile backend and the control that stops each: WAF, Entra ID, an owner check, Key Vault and a private endpoint.

• AI Bot Attacks on a Mobile App Login, and How Azure Stops Them

  A script tries 8,000 passwords a minute against your login API at 3am. Rate limiting, smart lockout and Defender for Cloud make speed the losing move.

• Azure Key Vault Explained: The One Secret Tutorials Never Remove

  Moving every secret into Key Vault leaves exactly one behind: the credential that opens the vault. A managed identity is what removes it.