> For the complete documentation index, see [llms.txt](https://blog.pepperclipp.com/pepperclipp-public/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.pepperclipp.com/pepperclipp-public/azure/to-cname-or-not-to-cname-that-is-the-enumeration-question.md).

# To CNAME or not to CNAME: That is the (Enumeration) Question

### **Introduction**

Back in 2018, NetSPI researcher Karl Fosaaen published an article that shed light on something often overlooked in cloud reconnaissance: a number of Azure services expose globally unique, DNS-resolvable endpoints tied to the resources they host. By querying these, an attacker can do more than just confirm a service is running and then they can start mapping out which cloud services a target relies on and, more interestingly, identify the naming conventions the organization uses when provisioning resources. That kind of pattern recognition can be surprisingly valuable when building a broader picture of a target’s infrastructure. In total, his research identified 18 such resources, all of which are listed below.

That work served as a solid foundation, but we wanted to see how far the surface actually extended. After digging into additional services beyond Fosaaen’s original scope, we found a much wider set of queryable endpoints than was initially known.

### **Azure Endpoints**

In [his article, ](https://www.netspi.com/blog/technical-blog/cloud-pentesting/enumerating-azure-services/)Karl Fosaaen lists 18 resources with globally unique endpoints that follow the format `<basename>.<resource endpoint>`. Some of these basenames can be configured by the resource creator during provisioning, such as storage accounts, apps, and databases, while others are configured automatically when the service is used, especially Microsoft 365-related resources such as Microsoft domains, email, and SharePoint.

```
| **Nr** | **Endpoint** | **Suffixes** |

| --- | --- | --- |
| 1 | azurewebsites.net | App Services |
| 2 | scm.azurewebsites.net | App Services Management |
| 3 | p.azurewebsites.net | App Services |
| 4 | cloudapp.net | App Services |
| 5 | file.core.windows.net | Storage Accounts: Files |
| 6 | blob.core.windows.net | Storage Accounts: Blobs |
| 7 | queue.core.windows.net | Storage Accounts: Queues |
| 8 | table.core.windows.net | Storage Accounts - Tables |
| 9 | redis.cache.windows.net | Databases - Redis |
| 10 | documents.azure.com | Databases - Cosmos DB |
| 11 | database.windows.net | Databases - MSSQL |
| 12 | vault.azure.net | Key Vaults |
| 13 | onmicrosoft.com | Microsoft Hosted Domain |
| 14 | mail.protection.outlook.com | Email |
| 15 | sharepoint.com | SharePoint |
| 16 | azureedge.net | CDN |
| 17 | search.windows.net | Search Appliance |
| 18 | azure-api.net | API Services |
```

In 2022, I found an endpoint leading to Microsoft ATP, the cloud version of Microsoft ATA, which contains an endpoint of `<basename>.atp.azure.com.`

```
| **Nr** | **Endpoint** | **Suffixes** |
| --- | --- | --- |
| 1 | atp.azure.com | Advanced Threat Protection |
```

Ever since then, I have been interested in exploring other resources that use globally unique endpoints. These resources span storage, CI/CD, security, AI, databases, and many services in between. Microsoft provides a partial list of endpoints used by its services.

Some of these services were introduced after the original NetSPI article was published. For example, the article examined four types of cloud storage endpoints: Blob, File, Queue, and Table storage. Since then, when a Storage Account is created, an Azure Data Lake File System endpoint (`dfs.core.windows.net`) is provisioned by default. We can also look at additional storage-related endpoints, such as those used for Azure Static Website Hosting (`web.core.usgovcloudapi.net`).

Beyond storage, Azure now includes a wide range of services with globally unique endpoints, including AI and Cognitive Services, IoT services, CI/CD platforms, database services, serverless offerings, security services, and many others. The endpoints we identified are listed and categorized in the table below.

```

| **Nr** | **Endpoint** | **Suffixes** |
| --- | --- | --- |
|  | **IoT Devices** |  |
| 1 | azure-devices.net | IoT Hub |
| 2 | azure-devices-provisioning.net | IoT Hub Device Provisioning Service |
| 3 | api.adu.microsoft.com | Device Update for IoT Hubs |
|  | **Cosmos DB** |  |
| 4 | postgres.cosmos.azure.com | Cosmos DB for PostgreSQL |
|  | **Databases** |  |
| 5 | mariadb.database.azure.com | Azure Database for MariaDB |
| 6 | mysql.database.azure.com | Azure Database for MySQL |
| 7 | postgres.database.azure.com | Azure Database for PostgreSQL |
|  | **AI and Machine Learning** |  |
| 8 | openai.azure.com | Azure OpenAI Service |
| 9 | cognitiveservices.azure.com | Azure Cognitive Services |
|  | **CI/CD** |  |
| 10 | azurecr.io | Azure Container Registry |
| 11 | azmk8s.io | Azure Kubernetes Service |
| 12 | azconfig.io | Azure App Configuration |
| 13 | data.azurecr.io | Azure Container Registry Data |
|  | **Storage** |  |
| 14 | dfs.core.windows.net | Data Lake Storage Gen2 |
| 15 | web.core.windows.net | Static Website Storage |
|  | **HDInsight cluster** |  |
| 16 | azurehdinsight.net | HDInsight Cluster HTTP Endpoint |
| 17 | <basename>-ssh.azurehdinsight.net | HDInsight Cluster SSH Endpoint |
| 18 | <basename>-int.azurehdinsight.net | HDInsight Cluster Internal Endpoint |
|  | **Serverless** |  |
| 19 | eventgrid.azure.net | Azure Event Grid |
|  | **Azure Synapse** |  |
| 20 | dev.azuresynapse.net | Azure Synapse Analytics Dev |
| 21 | sql.azuresynapse.net | Dedicated Azure Synapse SQL endpoint |
| 22 | <basename>-ondemand.sql.azuresynapse.net | Serverless Azure Synapse SQL endpoint |
|  | **Hardware** |  |
| 23 | managedhsm.azure.net | Managed HSM |
|  | **Health Data** |  |
| 24 | <basename>-<storage account>.dicom.azurehealthcareapis.com | Azure Health Data Services DICOM |
| 25 | fhir.azurehealthcareapis.com | Azure Health Data Services FHIR |
|  | **Security** |  |
| 26 | purview.azure.com | Microsoft Purview Account |
|  | **Other** |  |
| 27 | service.signalr.net | Azure SignalR Service |
| 28 | servicebus.windows.net | Service Bus / Event Hubs / Relay / Notification Hubs |
| 29 | <region>.attest.azure.net | Azure Attestation |
| 30 | trafficmanager.net | Traffic Manager |
| 31 | <region>.batch.azure.com | Azure Batch |
| 32 | webpubsub.azure.com | Azure Web PubSub |
| 33 | <region>.ts.eventgrid.azure.net | Azure Event Grid Topic Spaces |
| 34 | crm.dynamics.com | Dynamics CRM |
```

````
```jsx
**[*] Testing basename exaforce**
[*] Found service Storage Accounts: Files at host exaforce.file.core.windows.net
[*] Found service Storage Accounts: Blobs at host exaforce.blob.core.windows.net
[*] Found service Storage Accounts: Queues at host exaforce.queue.core.windows.net
[*] Found service Storage Accounts - Tables at host exaforce.table.core.windows.net
[*] Found service Email at host exaforce.mail.protection.outlook.com
[*] Found service SharePoint at host exaforce.sharepoint.com
[*] Found service Azure Container Registry at host exaforce.azurecr.io
[*] Found service Data Lake Storage Gen2 at host exaforce.dfs.core.windows.net
[*] Testing basename exaforce-com
[*] Found service Email at host exaforce-com.mail.protection.outlook.com

**[*] Testing basename exaforce-io**
[*] Found service Email at host exaforce-io.mail.protection.outlook.com

**[*] Testing basename exaforceprod**
[*] Found service Databases - Cosmos DB at host exaforceprod.documents.azure.com

**[*] Testing basename exaforcetest**
[*] Found service Storage Accounts: Files at host exaforcetest.file.core.windows.net
[*] Found service Storage Accounts: Blobs at host exaforcetest.blob.core.windows.net
[*] Found service Storage Accounts: Queues at host exaforcetest.queue.core.windows.net
[*] Found service Storage Accounts - Tables at host exaforcetest.table.core.windows.net
[*] Found service Databases - Cosmos DB at host exaforcetest.documents.azure.com
[*] Found service Azure Cognitive Services at host exaforcetest.cognitiveservices.azure.com
[*] Found service Data Lake Storage Gen2 at host exaforcetest.dfs.core.windows.net
[*] Found service Azure Attestation East US at host exaforcetest.eus.attest.azure.net

**[*] Testing basename exaforce-test**
[*] Found service Databases - Cosmos DB at host exaforce-test.documents.azure.com
[*] Found service Databases - MSSQL at host exaforce-test.database.windows.net
[*] Found service IoT Hub at host exaforce-test.azure-devices.net
[*] Found service Device Update for IoT Hubs at host exaforce-test.api.adu.microsoft.com
[*] Found service Azure OpenAI Service at host exaforce-test.openai.azure.com
[*] Found service Azure App Configuration at host exaforce-test.azconfig.io
[*] Found service Azure Synapse Analytics Dev at host exaforce-test.dev.azuresynapse.net
[*] Found service Dedicated Azure Synapse SQL endpoint at host exaforce-test.sql.azuresynapse.net
[*] Found service Managed HSM at host exaforce-test.managedhsm.azure.net
[*] Found service Azure SignalR Service at host exaforce-test.service.signalr.net
[*] Found service Azure Web PubSub at host exaforce-test.webpubsub.azure.com

**[*] Testing basename exaforce-my**
[*] Found service One Drive Business at host exaforce-my.sharepoint.com
```
````

### Private Links

There are times when some services do not need to be accessible to everyone. Services such as Storage Accounts, for example, are publicly reachable by default, with access typically restricted through ACLs and other access controls. Private Endpoints can be configured on a resource to restrict access, allowing connections only from approved networks or IP addresses. Access can even be limited to a specific VNet, ensuring that only resources within the authorized network can reach the service.

Private Link endpoints are created when a Private Endpoint is configured for a resource. These endpoints use the `privatelink` prefix to indicate the endpoint type.

!image.png

The way this works is that when the endpoint is accessed from within the private network, DNS resolves it to a private IP address. When the same endpoint is queried from outside the network associated with the Private Endpoint, it resolves to a public IP address, where access is restricted according to the resource’s public access settings.

```
# From inside VNet with private endpoint:

nslookup mystorageaccount.privatelink.blob.core.windows.net

# Returns: 10.0.1.5 (private IP)

# From public internet:

nslookup mystorageaccount.privatelink.blob.core.windows.net

# Returns: 52.xxx.xxx.xxx (public IP)

# But connection fails if public access is disabled
```

Like public endpoints, some Private Link endpoints return successful DNS responses when queried, which can be used to enumerate resources if the basename is known. The endpoint format is simply `<basename>.privatelink.<endpoint>`.

Microsoft maintains a list of Private Link endpoints that maps each service and resource type to its corresponding public endpoint. While some of these endpoints do not return valid DNS responses when queried, others do. During our research, we identified several services and resources whose Private Link endpoints resolve successfully, allowing us to enumerate them.

```
| **Nr** | **Endpoint** | **Suffixes** |
| --- | --- | --- |
|  | **IoT Devices** |  |
| 1 | privatelink.azure-devices.net | IoT Hub |
| 2 | privatelink.azure-devices-provisioning.net | IoT Hub Device Provisioning Service |
| 3 | privatelink.api.adu.microsoft.com | Device Update for IoT Hubs |
|  | **Cosmos DB** |  |
| 4 | privatelink.postgres.cosmos.azure.com | Cosmos DB for PostgreSQL |
|  | **Databases** |  |
| 5 | privatelink.mariadb.database.azure.com | Azure Database for MariaDB |
| 6 | privatelink.mysql.database.azure.com | Azure Database for MySQL |
| 7 | privatelink.postgres.database.azure.com | Azure Database for PostgreSQL |
| 8 | privatelink.redis.cache.windows.net
privatelink.<region>.redis.azure.net
privatelink.<region>.redisenterprise.cache.azure.net | Databases - Redis |
| 9 | privatelink.documents.azure.com | Databases - Cosmos DB |
|  | **AI and Machine Learning** |  |
| 11 | privatelink.openai.azure.com | Azure OpenAI Service |
| 12 | privatelink.cognitiveservices.azure.com | Azure Cognitive Services |
|  | **CI/CD** |  |
| 13 | privatelink.azurecr.io | Azure Container Registry |
| 14 | privatelink.<region>.azmk8s.io | Azure Kubernetes Service |
| 15 | privatelink.azconfig.io | Azure App Configuration |
| 16 | privatelink.data.azurecr.io | Azure Container Registry Data |
|  | **Storage** |  |
| 17 | privatelink.dfs.core.windows.net | Data Lake Storage Gen2 |
| 18 | privatelink.web.core.windows.net | Static Website Storage |
| 19 | privatelink.file.core.windows.net | Storage Accounts: Files |
| 20 | privatelink.blob.core.windows.net | Storage Accounts: Blobs |
| 21 | privatelink.queue.core.windows.net | Storage Accounts: Queues |
| 22 | privatelink.table.core.windows.net | Storage Accounts - Tables |
|  | **HDInsight cluster** |  |
| 23 | privatelink.azurehdinsight.net | HDInsight Cluster HTTP Endpoint |
|  | **Serverless** |  |
| 24 | privatelink.eventgrid.azure.net | Azure Event Grid |
|  | **Hardware** |  |
| 25 | privatelink.managedhsm.azure.net | Managed HSM |
|  | **Security** |  |
| 26 | privatelink.purview.azure.com | Microsoft Purview Account |
|  | **App Services** |  |
| 27 | <region>.privatelink.azurewebsites.net | App Services |
| 28 | scm.privatelink.azurewebsites.net | App Services Management |
|  | **Other** |  |
| 29 | privatelink.service.signalr.net | Azure SignalR Service |
| 30 | privatelink.servicebus.windows.net | Service Bus / Event Hubs / Relay / Notification Hubs |
| 31 | privatelinl.<region>.attest.azure.net | Azure Attestation |
| 32 | privatelink.<region>.batch.azure.com | Azure Batch |
| 33 | privatelink.webpubsub.azure.com | Azure Web PubSub |
| 34 | privatelink.vault.azure.net | Key Vaults |
```

### US Gov and China Cloud

In addition to standard Azure endpoints, there are also Government Cloud endpoints, specifically for US Gov and China Cloud environments. These environments use different service domains, most commonly `usgovcloudapi.net` or `azure.us` for US Gov Cloud (for example, `blob.core.usgovcloudapi.net`), and `chinacloudapi.cn` or `azure.cn` for China Cloud (for example, `blob.core.chinacloudapi.cn`).

There are also services whose domains do not follow these conventions, such as Azure Container Registry (`azurecr.io`) and Azure Kubernetes Service (`azmk8s.io`). In those cases, the domain suffix changes to `.us` for US Gov Cloud and `.cn` for China Cloud.

Private Link endpoints in Government Cloud environments work the same way as in Azure. They include a `privatelink` prefix between the basename and the resource endpoint (for example, `<basename>.privatelink.blob.core.usgovcloudapi.net`).

### Globally Unique Endpoints That Cannot Be Enumerated

Some services use globally unique endpoint names, but their DNS behavior prevents reliable enumeration. Rather than mapping each endpoint to a distinct IP address or DNS record, all endpoint names resolve to the same service infrastructure.

As a result, DNS lookups for these endpoints will always return a valid response, regardless of whether the specific resource exists. This behavior makes DNS-based enumeration unreliable and can lead to false positives.

The hosts I managed to find are listed below.

* **Azure Static Web Apps**:[ azurestaticapps.net](http://azurestaticapps.net/)
* **Azure Front Door**:[ azurefd.net](http://azurefd.net/)
* **Azure Databricks**:[ azuredatabricks.net](http://azuredatabricks.net/)
* **IoT Central**:[ azureiotcentral.com](http://azureiotcentral.com/)
* **IoT Central Private Link**:[ privatelink.azureiotcentral.com](http://privatelink.azureiotcentral.com/)
* **Azure Communication Services**:[ communication.azure.com](http://communication.azure.com/)
* **Azure Monitor ADX**:[ adx.monitor.azure.com](http://adx.monitor.azure.com/)
* **Azure Monitor ADX Private Link**:[ privatelink.adx.monitor.azure.com](http://privatelink.adx.monitor.azure.com/)
* **Azure Maps**:[ atlas.microsoft.com](http://atlas.microsoft.com/)
* **Azure Machine Learning Notebooks (China)**:[ notebookschinacloudapi.cn](http://notebookschinacloudapi.cn/)
* **Azure Machine Learning Notebooks Private Link (China)**:[ privatelink.notebooks.chinacloudapi.cn](http://privatelink.notebooks.chinacloudapi.cn/)

### Conclusion

In conclusion, reconnaissance in cloud environments still relies on the same core techniques: port and endpoint scanning, subdomain enumeration, and passive online research, but it introduces a unique challenge: some configurations simply can’t be changed. This means certain resources may be exposed or accessible by default, with no straightforward way to restrict them, and the engineer responsible might not even know there’s a problem.

We should always keep in mind that cloud environments are designed to make hosting and managing resources easier than traditional on-prem setups, but that convenience comes with a trade-off. The reduced maintenance overhead can quietly mask risks that go unnoticed and unaddressed for far too long.