Recommendations for pen test?

A client of mine runs a medium-size web app in Azure, utilising many of their services (SQL, web apps, function/logic apps, AAD B2C auth, etc).

They're looking to engage an external company to run a pen test to see if there's any (obvious) holes in the app.

They've got one quote from a local (Australian) company, who have quoted "5 to 10 days" to complete the pen test. Not sure what the pricing is at this stage. To be honest …

aad app apps australian auth azure b2c client cybersecurity etc external function local logic medium mine pen pen test recommendations run services size sql test web web app web apps