Azure Red Team Certification (MCRTP)

Azure Red Team Certification (MCRTP) is earned through the Microsoft Cloud Attack and Defense bootcamp, an on-demand Pwned Labs program that goes deep on modern attack chains and the detections that catch them, then certifies you hands-on.

Attackers rarely break into Microsoft cloud environments by exploiting a server. They sign in. Identity is the perimeter in Azure and Microsoft 365, and an Azure red team certification worth holding should prove you can abuse that identity layer the way a real intrusion does. The Microsoft Cloud Red Team Professional (MCRTP) is built to test exactly that, hands-on, in live tenants.

What the MCRTP certification proves

MCRTP is a practical Azure and Microsoft 365 red team certification. Instead of a multiple choice exam, you are assessed inside a live Microsoft cloud environment with realistic misconfigurations and logging. You have to enumerate Entra ID, find a foothold, escalate, and move laterally across Azure and M365 to reach the objective. Passing means you demonstrated tradecraft against a real tenant, which is a far stronger signal to an employer than a knowledge test.

Who this certification is for

MCRTP suits penetration testers expanding into Microsoft cloud, red teamers who need Entra ID and M365 depth, and defenders who want to understand attacker tradecraft to build better detections. Prior Azure expertise is not required. The Microsoft Cloud Attack and Defense bootcamp that leads into MCRTP starts with fundamentals and builds toward advanced identity attacks, so a strong general security background is enough to begin.

What you learn on the path to MCRTP

The curriculum follows how Microsoft cloud tenants are actually compromised, with identity at the center. Core areas include:

• Entra ID enumeration and abuse, including role and application permission misconfigurations that lead to privilege escalation.
• Consent and OAuth application attacks, token theft, and abuse of conditional access gaps.
• Lateral movement between Microsoft 365 workloads and Azure resources, and pivoting from cloud identity into subscriptions.
• Abusing Azure services and hybrid join scenarios that connect on-premises Active Directory to Entra ID.
• Detection awareness across Microsoft Entra sign-in logs, unified audit logging, and Microsoft Defender signals.

Working against production-like telemetry means you learn what defenders can see while you operate, which is the purple team perspective that makes a cloud red teamer valuable.

MCRTP compared to other Microsoft security certifications

The Microsoft Certified Azure Security Engineer Associate, known as AZ-500, is a defensive knowledge exam. It validates that you can implement and manage Azure security controls, and it is well regarded for blue team and engineering roles. It is not an offensive assessment and does not require you to compromise anything. Other offensive exams prove penetration testing fundamentals but cover little of the Entra ID and M365 identity abuse that dominates real Microsoft cloud intrusions. MCRTP fills that gap with a fully hands-on, offense-focused assessment specific to Azure and Microsoft 365.

How the MCRTP exam works

The certification is assessed in a live Microsoft cloud tenant, not a simulation. You receive objectives and a time window and must accomplish them with real tradecraft against real services that are logging your activity. There is no quiz and nothing to memorize. The credential is hard to fake because the only way to earn it is to execute the attack.

Inside the MCRTP exam environment

The exam is a single realistic scenario rather than a question bank. Once you start, you have 24 hours to work through it. You are given an entry point into a live Azure and Microsoft 365 tenant and you have to build a complete exploitation chain from that foothold to the flag. Nothing is abstracted away: the services are real, the misconfigurations are the kind that appear in production tenants, and the logging is live while you operate.

The environment is completely self-contained. You do not need to spin up your own infrastructure, register a phishing domain, or bring any external tooling beyond what you would normally carry into an engagement. The exam is not proctored, so there is no screen recording or invigilator on a call. You receive an invitation confirming your start time and the rest is down to your tradecraft.

Because the scenario is a chain rather than a set of isolated tasks, partial knowledge tends to show. You cannot memorize your way past a step that depends on understanding how an Entra ID token is issued and validated, or why a conditional access policy blocks one sign-in path and not another. That is the point: the format rewards operators who understand the mechanics rather than candidates who have rehearsed a checklist.

There is also no report to write. Some offensive certifications require a full pentest report after the practical component, which turns a technical assessment into a documentation exercise. MCRTP does not. You either build the chain and capture the flag or you do not, and that binary outcome is what makes the credential straightforward for a hiring manager to interpret.

Preparing for the MCRTP exam

You do not need prior Azure expertise to start. What you do need is comfort on the Windows or Linux command line and a general security foundation. Familiarity with Azure helps, but the bootcamp opens with cloud fundamentals before moving into the advanced material, so the ramp is built into the path.

Registration includes 45 days of Academy access, which opens every lab on the platform rather than only the bootcamp material. The bootcamp is fully on-demand, so there is no cohort to wait for and no start date to work around. You enroll and begin immediately. The recommended approach is to claim your Academy access when you start rather than saving it, since the premium labs in the learning path are the fastest way to get comfortable with the tooling before you move into the harder material.

Worth knowing before you start: the labs run against production-like logging, so you see what the platform's native telemetry captures while you operate. Most offensive training treats detection as somebody else's problem. Here it runs alongside the attack path, which builds the purple team awareness that employers increasingly expect from cloud red teamers.

Your access to the custom bootcamp content is lifetime, and that is a separate thing from the 45 day Academy window. The bootcamp labs, the capstone CTF, the course materials, and the private Discord channels remain available to you indefinitely. Only the wider Academy catalog is time boxed, and registration includes a code for 50 percent off the annual subscription if you want to keep that catalog open afterwards. Exam scheduling uses a rolling three day buffer, so you can book any available date at least three days ahead. You sit it when you are ready rather than waiting for a schedule to come round.

After you pass: certification, badge, and retakes

The MCRTP certification does not expire and never needs renewing. There are no continuing education credits to log and no annual maintenance fee. Once you have demonstrated the capability, the credential stands.

Alongside the official certificate you receive a Credly digital badge, which is the format most recruiters and internal HR systems can verify directly. That matters more than it sounds: a verifiable badge removes the step where someone has to email you asking for proof.

If an attempt does not go your way, you can book a new slot. Retakes are scheduled at least two weeks after the previous attempt, which is deliberate. That gap is enough to work back through the labs covering whatever stage of the chain stopped you rather than immediately repeating the same approach. Exam attempts themselves do not expire and there is no deadline by which you must sit the exam, so you can prepare at whatever pace your workload allows.

MCRTP as part of the multi-cloud path

Most organizations do not run on a single provider. Identity federates across AWS, Azure, and Google Cloud, and an attacker who lands in one tenant frequently pivots into another through trust relationships that nobody mapped. Proving capability in one provider is useful, but proving it across all three is what reflects how modern estates actually break.

MCRTP is the Azure component of that path. Its counterparts are the Amazon Cloud Red Team Professional (ACRTP), covering AWS, and the Google Cloud Red Team Professional (GCRTP), covering Google Cloud and Google Workspace. Completing all three earns the Multi-Cloud Red Team Professional (M-CRTP3) certification, a single credential validating offensive capability across every major provider.

The M-CRTP3 bundle covers all three bootcamps with two exam attempts for each of the three certifications. If multi-cloud work is where you are heading, taking the bundled route is more economical than certifying one provider at a time. Each provider certification also stands on its own, so there is no requirement to commit to all three at the outset. Many practitioners certify in the provider they work with daily, then add the others as their remit widens. Details of the bundled route are at pwnedlabs.io/bootcamps/m-crtp3-certification.

Related labs to build the skills first

Before committing to the certification, you can practice free starter labs for Azure that run live in your browser. They are the fastest way to test your readiness on real Entra ID and Azure attack techniques. Browse the full catalog at pwnedlabs.io/explore.

Gain career-ready skills

Employers hire for what you can do, not what you can recall. Every objective in this certification maps to a skill you will use on real engagements. By the time you certify, you can:

• Enumerate and abuse Entra ID roles, applications, and permissions
• Execute OAuth consent and token theft attacks
• Identify and exploit conditional access gaps
• Move laterally between Microsoft 365 workloads and Azure resources
• Attack hybrid join scenarios that connect on-premises Active Directory to Entra ID
• Interpret Entra sign-in logs and unified audit logging to operate with defensive awareness

These are the capabilities behind cloud penetration tester, Microsoft cloud red teamer, and cloud security engineer roles. You can build the foundations first with free hands-on labs at pwnedlabs.io/explore, then go deep and certify through the Microsoft Cloud Attack and Defense bootcamp.

Pricing and enrollment

Enrollment includes the full self-paced curriculum, lab access, and certification exam attempts. Full details are on the Microsoft Cloud Attack and Defense bootcamp page.

The Microsoft Cloud Red Team Professional (MCRTP) bootcamp is $399. That covers the full curriculum, 45 days of Academy access across every lab on the platform, lifetime access to the custom bootcamp labs and the capstone CTF, the course materials, and the private Discord channels. Certification exam attempts are included, and registration also carries a code for 50 percent off the annual Academy subscription if you want to keep the wider catalog open after the 45 days.

If you plan to certify across more than one provider, the M-CRTP3 bundle covers ACRTP, MCRTP and GCRTP together for $999 and awards the Multi-Cloud Red Team Professional certification. That is roughly $200 less than buying the three separately, and it includes two exam attempts for each of the three certifications.

Need employer sponsorship? Download the employer funding request letter.

Frequently asked questions

Is MCRTP a hands-on certification?

Yes. MCRTP is assessed in a live Azure and Microsoft 365 tenant with realistic misconfigurations and logging. There is no multiple choice component.

Do I need Azure experience before starting?

No prior Azure expertise is required. The bootcamp starts with fundamentals and builds toward advanced Entra ID and M365 attacks. A general security foundation is enough.

How is MCRTP different from AZ-500?

AZ-500 focuses on implementing and managing Azure security. MCRTP is an offensive, fully practical certification earned by operating in a live Microsoft cloud environment. The two complement each other well.

What is the difference between MCRTP and MCRTE?

MCRTP is the professional-level certification. The Microsoft Cloud Red Team Expert (MCRTE) is the expert-level path focused on enterprise-scale attack chains for experienced practitioners.

Does MCRTP cover hybrid Active Directory attacks?

Yes. The curriculum includes hybrid join scenarios that connect on-premises Active Directory to Entra ID, reflecting how real enterprise environments are built.