CARTP: Certified Azure Red Team Professional

What CARTP is and who runs it

Certified Azure Red Team Professional (CARTP) is Altered Security’s cloud red-team certification, focused on attacking Microsoft Azure and Entra ID (formerly Azure AD). It is built and taught by Nikhil Mittal, the same instructor behind CRTP and CRTE, and shares their philosophy: abuse legitimate cloud features and misconfigurations rather than exploits. Where CRTE is on-prem Active Directory, CARTP is its cloud sibling — covering enterprise applications, managed identities, hybrid identity, Conditional Access, and pivoting between on-prem and cloud. It is the entry point of Altered Security’s Azure track, with the more advanced CARTE sitting above it.

Cost and what’s included

Pricing follows the same lab-duration model as the rest of the catalogue. The official page lists $449 for 30 days, $649 for 60 days, and $849 for 90 days (USD), each bundling the course, lab, and one certification exam attempt, with lifetime access to the course material. There are 15+ hours of video with English captions and a large live-Azure lab — the page cites 26 learning objectives and 77 tasks across live tenants. A 30-day lab extension is $349 and an extra exam attempt is $99. You are paying for real cloud infrastructure, which is why CARTP costs more than the on-prem CRTP.

Time: the exam and the report

The exam is a 24-hour hands-on assessment in a dedicated lab containing multiple resources spread across multiple Azure tenants. The task is to compromise all the resources and then submit a report documenting your attack paths — so, unlike a pure flag hunt, write-up quality counts. The 24-hour clock is for the hands-on work; the vendor page does not state how long you then have to submit the report, so treat the report window as check-vendor-page. Budget your time for enumeration and note-taking, not just exploitation.

How hard it is, honestly

By the standards of red-team certs, CARTP is approachable. Multiple reviewers who understood the course material describe the exam as fair and even easier than expected — the environment reflects what you practised, and 24 hours is comfortable if you are organised. The real challenge is conceptual: Azure and Entra ID have many moving identity pieces, and you must internalise how tokens, roles, and hybrid trust actually work. Get the concepts down in the lab and the exam is very passable; treat it casually and the breadth of Azure services will catch you out.

Is it worth it — and for whom

CARTP is worth it for pentesters, red teamers, and cloud/identity defenders who need practical Azure attack skills — an area where hands-on certs are still scarce. It is a good first cloud red-team credential and pairs naturally with on-prem AD experience, since real environments are hybrid. At $449 to start it is not cheap for hobbyists, but for anyone doing Azure security work it is reasonable and respected. If you want on-prem AD instead, take CRTP/CRTE; if you are past CARTP, CARTE is the next step. Renewal is free before the three-year expiry.

How to prepare

Work through every learning objective in the live lab — that hands-on repetition is the preparation, and the exam mirrors it. Make sure you genuinely understand Entra ID identity: service principals, managed identities, Conditional Access, consent grants, and how on-prem sync (hybrid identity) opens cloud paths. Keep a clean methodology and take report-ready notes as you go, because you submit a write-up. Basic Azure familiarity helps but is not mandatory per the vendor. Community cheatsheets exist, but lean on the course material and your own lab notes first.

SourcesAltered Security — CARTP