Cloud identity hardening
Privileged directory roles, risky configuration, and Conditional Access — including MFA required directly or through an authentication strength. Risky users are read from Identity Protection on tenants licensed for it.
AthonisOne module 02 of 08
Cloud
Cloud posture — plus the collaboration layer where data actually leaks.
Cloud posture is more than infrastructure. Most day-to-day data exposure happens in the collaboration layer — a sharing link, a permissive default, a team nobody owns. This module reads cloud identity, cloud resources in Azure and Oracle Cloud, and Microsoft 365 together and shows where the posture is weakest. Each source works on its own, so an organisation on Oracle Cloud or Azure alone is covered without connecting a directory.
What it answers
The questions this module exists for.
- 01 Are any cloud resources publicly exposed or left un-hardened?
- 02 Which cloud identities hold excessive privilege?
- 03 What content is shared outside the organization, and how permissively?
- 04 Are our tenant-wide sharing defaults safe?
- 05 Which of our Azure applications and public addresses reach the Internet without passing our firewall and WAF?
- 06 Is any application published on a domain we don't own?
- 07 How compliant is our cloud environment against best practice?
- 08 How is our cloud posture trending?
What it checks
In detail.
Cloud resource posture
Exposure, hardening and compliance of cloud services across subscriptions, with resources that share a name across resource groups kept apart.
What bypasses the perimeter
For an estate that publishes through one path — DNS, perimeter firewall, web application firewall, application — three checks find what reaches the Internet some other way: an App Service whose own address, or whose deployment site, accepts connections from anywhere; an App Service bound to a domain that isn't one of yours, typically a supplier's; and an Azure public address on a gateway, cluster, virtual machine or load balancer that is neither behind nor published by the perimeter firewall.
Oracle Cloud posture
Tenancy administrators and who is granted what, multi-factor and sign-in policy, long-lived credentials, security rules that open management ports to the Internet, public storage buckets, logging and monitoring switched off, and load balancers and their listeners. Identity checks cite the CIS Oracle Cloud Infrastructure Foundations Benchmark.
Oracle Cloud databases
Whether the service backs each database up, and where its listener can be reached from. Each container database lists its pluggable databases, with how each is open and whether a database audit reaches it — and coverage is judged per pluggable database, not only per container. A database audited from the inside by Database Security is linked to the Oracle Cloud database it is.
Microsoft 365 collaboration
Sites, drives and teams inventoried across SharePoint Online, OneDrive and Teams, with dedicated explorers alongside the findings they produce.
External sharing
Where content is shared outside the organization, which links exist and how permissive they are — and tenant-level sharing settings evaluated against best practice, so a permissive default is caught once, at the tenant, rather than one site at a time.
Typed findings
Each with the evidence behind it, not just a severity label.
Finding Wiki
A built-in explainer on every finding — what it is, why it matters, what to do.
A posture score
Rolled up from the findings and trended over time.
Compliance evidence
Findings mapped to the framework controls they evidence.
How it judges
Where it refuses to over-claim.
A check that guesses produces false findings, and false findings teach a team to ignore the real ones. These are the places this module holds back.
- Activity is judged on the last successful sign-in, interactive or not. A guest or licensed user who works through apps and token refresh is not reported as dormant, and failed password attempts do not count as activity.
- It does not read a user's full sign-in history.
- One finding per person, with every privileged role listed.
- A Conditional Access policy set that could not be read reads as not measured — never as absent.
- An App Service whose access restrictions could not be read is not judged, and apps inside an App Service Environment are not judged. A private endpoint alone does not close an app. The finding lists the sources a site allows; it does not decide whether they are your WAF.
- The public-address check needs the Network module reading at least one firewall that runs in Azure. Until the first Azure and directory syncs after an upgrade, these checks read not measured.
- If part of an Oracle Cloud tenancy can't be read on a sync — a region or a service that did not answer — what was last read stays on screen, dated, and checks on it are held rather than raised or resolved.
- Every cloud finding has a Finding Wiki page.
What it reads
Connected to what you already run.
- Microsoft Entra IDCloud users, groups, memberships and directory roles, through Microsoft Graph on read scopes
- Microsoft AzureResource configuration and posture across subscriptions, through the Azure management API
- Microsoft 365SharePoint, OneDrive and Teams sharing and configuration, through Microsoft Graph on read scopes
- Oracle Cloud InfrastructureTenancy identity, network, compute, database service, storage, logging and edge configuration, through the Oracle Cloud API with a signing key used only to read
What it never does
The boundary, stated plainly.
- Never writes to a tenant, a tenancy or a subscription. Every connector only reads — the product never sends a change, whatever its credential is allowed to do.
- Never reads content — it reads how content is shared, not what it says.
Findings from this module evidence the configuration, access-control and cloud-hardening control areas of every activated framework.
Works with
One dataset, so the modules answer each other.
See what Cloud would say about your estate.
Licensed on its own, and on the same platform as every other module. We'll show you the answer — and what it would say it couldn't measure.