Breaching Azure Advanced
The advanced course for practitioners who have completed Breaching Azure. Covers multi-tenant attacks, PIM abuse, Conditional Access bypass, Azure DevOps pipeline compromise, and advanced persistence techniques.
Offensive Azure Security Expert
Lab environment
The lab scenario
Every lab in the course runs inside one continuous engagement against a single fictional target: a realistic corporate environment taken from external foothold to full tenant compromise. Here is who you are up against and how the attack unfolds.
Target organisation
WindriverTelco
Global telecommunications provider · Founded 1970 · Headquartered in New York
WindriverTelco is a global telecommunications provider offering 5G connectivity, ISP services, global SIM and roaming platforms, VoIP, cloud telephony, and enterprise networking.
To accelerate its digital transformation, the board has migrated WindriverTelco's core services and supporting infrastructure to Microsoft Azure. Every lab in the course takes place inside this environment.
Your objective
Compromise WindriverTelco's Azure environment, starting from an external foothold and working through identity, compute, and supply-chain layers until the tenant is fully breached.
The attack path
Hover or tap any service to see how it is attacked in the labs.
External attacker
Initial accessRecon and phishing against the corporate perimeter to gain a first foothold.
WindriverTelco corporate
Pivot pointOn-premises identity and servers that bridge into the newly migrated Azure environment.
WindriverTelco Azure tenant
Target · 23 servicesIdentity & access
Compute & containers
Data & secrets
DevOps & supply chain
Collaboration
Cloud Breached
Objective metFull control of the tenant: identity, compute, data, and the supply chain that feeds it.
What you'll be able to do
Abuse PIM and Conditional Access to bypass modern identity controls
Execute cross-tenant attacks and establish persistent cross-boundary access
Compromise Azure DevOps pipelines and exfiltrate pipeline secrets
Execute advanced lateral movement and persistence across complex enterprise Azure environments
Abuse the Microsoft Graph API for stealthy enumeration and persistence
Build multi-stage attack chains across complex enterprise Azure environments
Write professional attack path reports documenting advanced compromise paths for OASE certification
Attack techniques covered
Each technique is taught through a dedicated lab with a real target environment, not a walkthrough video.
Course structure
20 modules · 35 topics · 16 video lessons · 1 certification exam
01Before You Start4 topics
Get your lab environment ready, review the support channels, and understand how to approach the OASE certification exam.
02Rules of Engagement2 topics
Ethical and legal boundaries for the course labs, plus Command & Control setup used throughout the attack chains.
03BAA 00 – Introduction to Azure9 topics
Core Azure and Entra ID concepts: managed identities, delegated vs. application permissions, administrative units, Azure Lighthouse, Policy, and Cloud Shell.
04BAA 01 – Subdomain Takeover, Teams Phishing & ConsentFix6 topics
Claim dangling Azure subdomains, deliver phishing payloads via Microsoft Teams, and exploit OAuth consent flows with the ConsentFix attack.
05BAA 02 – Azure VM Metadata Enumeration3 topics
Query the Instance Metadata Service (IMDS) from a compromised VM to extract managed identity tokens and escalate access across the subscription.
06BAA 03 – Key Vault Access Policies and Secrets3 topics
Abuse misconfigured Key Vault access policies to retrieve secrets, keys, and certificates stored for other workloads.
07BAA 04 – CosmosDB Data Decryption3 topics
Chain Key Vault key access and a Function App to decrypt customer-at-rest data stored inside a CosmosDB instance.
08BAA 05 – Entra ID User Creation3 topics
Exploit an over-permissioned Azure Function App to create rogue Entra ID users and establish persistence in the tenant.
09BAA 06 – Entra ID Enumeration3 topics
Map the tenant attack surface using the Microsoft Graph API: users, groups, roles, service principals, and application registrations.
10BAA 07 – Getting RCE on Azure Arc Machine3 topics
Exploit Azure Arc-managed servers to achieve remote code execution and pivot from the cloud control plane into on-premises infrastructure.
11BAA 08 – RCE on AKS via Container Registry3 topics
Push a malicious image to an Azure Container Registry, trigger its deployment in an AKS cluster, and achieve container escape.
12BAA 09 – Compromising Entra ID Joined Device3 topics
Take over an Entra ID joined device to extract cached tokens, certificates, and credentials usable for lateral movement.
13BAA 10 – Exporting PRT and PIM Escalation3 topics
Export a Primary Refresh Token (PRT) from a compromised device and abuse Privileged Identity Management (PIM) roles to escalate to Global Admin.
14BAA 11 – RCE on Self-Hosted DevOps Agent3 topics
Compromise a self-hosted Azure DevOps pipeline agent to execute arbitrary code and exfiltrate secrets injected into pipeline runs.
15BAA 12 – ADFS Exploitation3 topics
Attack Active Directory Federation Services to forge SAML tokens and authenticate as any federated user without their credentials.
16BAA 13 – Extracting Access Token from Browser3 topics
Steal Azure access tokens directly from browser memory and session storage to silently impersonate authenticated users.
17BAA 14 – Exploiting JWT Assertions3 topics
Forge signed JWT client assertions to authenticate as service principals, bypassing secret-based credential requirements entirely.
18BAA 15 – Private Endpoints & ARM Template Exposure3 topics
Abuse exposed ARM deployment templates and private endpoint misconfigurations to access restricted resources and exfiltrate sensitive data.
19BAA 16 – Device Registration via ADFS Certificate3 topics
Register a new device using an ADFS-issued certificate to obtain a compliant device identity and bypass Conditional Access policies.
20BAA 17 – Exploit Misconfigured Anonymous Storage3 topics
Discover and exploit publicly accessible Azure Storage containers to retrieve sensitive data and capture the final lab flag.
Want a look inside first?
Create a free account and open the trial topics of this course in the CloudBreach portal. No card needed.
Offensive Azure Security Expert (OASE)
The OASE exam is a practical, report-based challenge against a live cloud environment, with no multiple choice. Book your first attempt within 12 months of purchase, and each later attempt within 6 months of your previous result.
Exam format
Report submission
Attempts included
1–2 depending on plan
Certification validity
Lifetime, never expires
Offensive Azure Security Expert
Pricing
Choose your plan
All plans include lifetime access to course material, video lessons, and at least one certification exam attempt; the Plus plan includes two.
Breaching Azure Advanced
Essential
$599
- 30 Days Cloud Labs Access
- Lifetime Access to Course Material
- Digital Content
- Video Lessons
- 1x OASE Exam Attempt
- Certificate of Completion
- Not included: PDF Training Guide
- Not included: 2x OASE Exam Attempts
- Not included: Priority Support
Breaching Azure Advanced
Extended
$999
- 60 Days Cloud Labs Access
- Lifetime Access to Course Material
- Digital Content
- Video Lessons
- 1x OASE Exam Attempt
- Certificate of Completion
- Not included: PDF Training Guide
- Not included: 2x OASE Exam Attempts
- Not included: Priority Support
Breaching Azure Advanced+
$1,099
- 90 Days Cloud Labs Access
- Lifetime Access to Course Material
- Digital Content
- PDF Training Guide
- 2x OASE Exam Attempts
- Video Lessons
- Priority Support
- Certificate of Completion
Teams & Enterprise
All Plus features · Dynamic group discount · Custom onboarding · Instant quote
FAQ
Frequently asked questions
The exam is practical and based on the advanced course material. You are given access to a live Azure environment for 24 hours and must compromise the target and capture the final flag. You then have 24 hours to submit a professional attack path report. Passing earns your OASE digital badge.
Yes. Write your report in the CloudBreach exam report template. It lays out the structure we grade against: your attack path, the tools and commands used at each step, evidence screenshots, and a risk analysis with remediation recommendations. Using the template makes sure nothing the graders look for is left out.
Open the exam report templateYour first attempt must be booked within 12 months of purchase. After each result, or when you purchase a retake, you have 6 months to book your next attempt. We email reminders 60, 30, and 15 days before a booking window closes. Once earned, your OASE certification never expires.
You can book another attempt if your plan includes one (the Plus plan includes two). Once your included attempts are used, you can purchase a retake for the OASE exam from the Exams page in the CloudBreach portal. A retake purchase opens a new 6-month window to book the attempt.
No. Exam attempts are included with course enrollment and cannot be purchased separately.
At least one year of Microsoft Azure infrastructure experience is recommended. Completing Breaching Azure first is strongly advised. Labs include hints and CloudBreach administrators are available to help.
No. You only need a standard web browser. The training environments are fully hosted on Microsoft Azure cloud and remote access is provided through the browser.
Yes. You can purchase the course today and schedule your lab start date for whenever works best for you.
Pausing is not currently possible. The lab runs continuously from your scheduled start date for 30, 60, or 90 days depending on your plan.
Yes. Lab access can be extended at any time with a lab extension Booster, available on your course page in the CloudBreach portal. Contact an administrator if you need assistance.
Open the CloudBreach portalWe do not offer refunds for digital training courses. Please review the course description, objectives, and prerequisites carefully before purchasing.
Join Discord
Active community of students, certified practitioners, and course authors. Get unstuck, share techniques, and discuss findings without spoilers.
Earn your OASE.
Complete Breaching Azure Advanced and prove your offensive cloud security skills with a report-based certification exam.