O365 on a Pentesting device? Am I right to think that this is horrible practice?

Hello,

Working at my company as a security engineer. I recently discovered that our pentesting team is deploying O365 to their pentesting laptops. These are normally segregated from our standard environment, but because they have registered in O365 they become visible in our Azure Defender for Endpoint tenant.

This seems like a dangerous practice to me. We did put in place MFA and Conditional Access policies for the accounts which have the licenses assigned to them. But I can't help …

azure cybersecurity defender device engineer environment hello laptops o365 pentesting practice security security engineer standard team visible working