Auditing Azure Active Directory ConfigurationSAFE

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains ·

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: auditing-azure-active-directory-configuration
description: 'Auditing Microsoft Entra ID (Azure Active Directory) configuration to
  identify risky authentication policies, overly permissive role assignments, stale
  accounts, conditional access gaps, and guest user risks using AzureAD PowerShell,
  Microsoft Graph API, and ScoutSuite.

  '
domain: cybersecurity
subdomain: cloud-security
tags:
- cloud-security
- azure
- entra-id
- active-directory
- iam-audit
- conditional-access
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.IR-01
- ID.AM-08
- GV.SC-06
- DE.CM-01
mitre_attack:
- T1078.004
- T1098.003
- T1556.006
- T1069.003
- T1526
---

# Auditing Azure Active Directory Configuration

## When to Use

- When performing a security assessment of an Azure tenant's identity configuration
- When compliance audits require review of authentication policies, MFA enforcement, and role assignments
- When onboarding a new Azure tenant after merger or acquisition
- When investigating suspicious sign-in activity or compromised accounts
- When validating conditional access policies adequately protect against identity-based attacks

**Do not use** for on-premises Active Directory auditing (use PingCastle or BloodHound AD), for Azure resource-level RBAC auditing without identity context, or for real-time threat detection (use Microsoft Defender for Identity).

## Prerequisites

- Global Reader or Security Reader role in the target Microsoft Entra ID tenant
- Microsoft Graph PowerShell SDK installed (`Install-Module Microsoft.Graph`)
- Az CLI authenticated to the target tenant (`az login --tenant TENANT_ID`)
- ScoutSuite with Azure provider configured for automated assessment
- Access to Azure AD audit logs and sign-in logs (requires Azure AD Premium P1/P2)

## Workflow

### Step 1: Enumerate Tenant Configuration and Security Defaults

Assess the tenant's baseline identity security settings including security defaults and legacy authentication status.

```powershell
# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Directory.Read.All","Policy.Read.All","AuditLog.Read.All"

# Get tenant details
Get-MgOrganization | Select-Object DisplayName, Id, VerifiedDomains

# Check if Security Defaults are enabled
Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy | Select-Object IsEnabled

# List authentication methods policies
Get-MgPolicyAuthenticationMethodPolicy | ConvertTo-Json -Depth 5

# Check legacy authentication status via Conditional Access
Get-MgIdentityConditionalAccessPolicy | Where-Object {
    $_.Conditions.ClientAppTypes -contains "exchangeActiveSync" -or
    $_.Conditions.ClientAppTypes -contains "other"
} | Select-Object DisplayName, State
```

### Step 2: Audit Privileged Role Assignments

Review directory role assignments to identify over-privileged users, permanent admin accounts, and risky role configurations.

```bash
# List all Global Administrator assignments
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/directoryRoles/filterByIds" \
  --body '{"ids":["62e90394-69f5-4237-9190-012177145e10"]}' | \
  az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/directoryRoles?filter=displayName eq 'Global Administrator'" \
  --query "value[0].id" -o tsv

# List all privileged role assignments using Graph API
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?\$expand=principal" \
  --query "value[*].{Role:roleDefinitionId, Principal:principal.displayName, PrincipalType:[email protected]}" \
  -o table

# Check for users with multiple admin roles
az ad user list --query "[].{UPN:userPrincipalName, DisplayName:displayName}" -o table

# List service principals with admin role assignments
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?\$filter=principalOrganizationId eq 'TENANT_ID'" \
  -o json
```

### Step 3: Review Conditional Access Policies

Audit conditional access policies for coverage gaps, particularly around MFA enforcement, device compliance, and location-based restrictions.

```powershell
# List all Conditional Access policies
Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName, State, @{
    N='GrantControls'; E={$_.GrantControls.BuiltInControls -join ', '}
} | Format-Table -AutoSize

# Identify policies in report-only mode (not enforced)
Get-MgIdentityConditionalAccessPolicy | Where-Object {$_.State -eq "enabledForReportingButNotEnforced"} |
    Select-Object DisplayName

# Check MFA enforcement coverage
Get-MgIdentityConditionalAccessPolicy | Where-Object {
    $_.GrantControls.BuiltInControls -contains "mfa"
} | Select-Object DisplayName, State, @{
    N='Users'; E={$_.Conditions.Users.IncludeUsers -join ', '}
}

# Find policies that exclude groups (potential bypass)
Get-MgIdentityConditionalAccessPolicy | Where-Object {
    $_.Conditions.Users.ExcludeGroups.Count -gt 0
} | Select-Object DisplayName, @{
    N='ExcludedGroups'; E={$_.Conditions.Users.ExcludeGroups -join ', '}
}
```

### Step 4: Identify Stale Accounts and Guest Users

Find accounts that have not signed in recently, disabled accounts with active role assignments, and risky guest user configurations.

```bash
# Find users who haven't signed in for 90+ days
az ad user list --query "[?signInActivity.lastSignInDateTime < '2025-11-25T00:00:00Z'].{UPN:userPrincipalName, LastSignIn:signInActivity.lastSignInDateTime, Enabled:accountEnabled}" -o table

# List all guest users
az ad user list --filter "userType eq 'Guest'" \
  --query "[].{UPN:userPrincipalName, DisplayName:displayName, CreatedDate:createdDateTime}" \
  -o table

# Find guest users with privileged roles
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?\$expand=principal" \
  --query "value[?principal.userType=='Guest'].{Role:roleDefinitionId,Guest:principal.userPrincipalName}" \
  -o table

# Check for accounts with dis

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

declared (1 observation(s))

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.