Entra Cloud Pentest

---
name: entra-cloud-pentest
description: "Use when testing Microsoft Entra ID (Azure AD) and Microsoft 365 identity security — tenant/user enumeration, authentication attacks (password spray, MFA gaps, legacy auth), conditional-access bypass, OAuth/app-consent abuse, privileged-role and Graph API abuse, and hybrid AD-to-cloud (and cloud-to-AD) attack paths. Maps to MITRE ATT&CK, with detection and remediation. Authorized engagements only."
---

# Entra ID (Azure AD) & M365 Identity Testing

Assessment of cloud identity — the modern crown jewels. Covers Entra ID, M365, and hybrid attack paths bridging on-prem AD and the cloud. Mapped to **MITRE ATT&CK**.

## 0. Authorization gate
- [ ] Written authorization from the tenant owner (cloud provider ToS also apply).
- [ ] Scope: tenant, in-scope identities/apps, allowed auth testing (spray limits).
- [ ] Coordination with the SOC (identity attacks generate alerts).

## 1. Enumeration
- Tenant existence/details, federation/managed domains, user enumeration via auth responses, guest accounts.
- Enumerate roles, service principals, enterprise apps, app registrations, and API permissions.

## 2. Authentication attacks
- **Password spray** (lockout- and lockout-alert-aware), against exposed auth endpoints.
- **Legacy auth** protocols that bypass modern controls / MFA.
- **MFA gaps & fatigue:** accounts without MFA, weak methods, push-fatigue susceptibility (test per RoE).
- **Fix:** disable legacy auth, enforce phishing-resistant MFA, smart lockout, block-legacy conditional access.

## 3. Conditional Access (CA) review & bypass
- Enumerate CA policies; look for gaps: excluded apps/users, device/location loopholes, report-only policies, missing coverage.
- **Fix:** close exclusions, require compliant devices + MFA broadly, remove report-only gaps.

## 4. OAuth / application & consent abuse
- Illicit consent grants, over-privileged app registrations, dangerous Graph permissions, credential/secret exposure on service principals.
- **Fix:** restrict user consent, review app permissions (least privilege), monitor consent grants, rotate SP secrets.

## 5. Privilege escalation & Graph abuse
- Escalation via role assignments, service principals with high privilege, group-based role grants, and Microsoft Graph API abuse.
- **Fix:** PIM (just-in-time roles), least-privilege role model, monitor privileged role/SP changes.

## 6. Hybrid attack paths (the high-value part)
- **On-prem → cloud:** connect-sync account abuse, Seamless SSO/PRT abuse, federation (token-signing) trust abuse.
- **Cloud → on-prem:** management endpoints (Intune/config) to run code on enrolled/hybrid devices.
- Correlate with `active-directory-pentest` — hybrid paths are prime `vuln-chaining` territory.
- **Fix:** protect sync/federation servers as tier-0, restrict privileged identities, segment management planes.

## 7. Tooling
AADInternals, ROADtools/roadrecon, GraphRunner, MSOLSpray (spray, lockout-aware), Microsoft Graph queries. Follow RoE and provider ToS.

## 8. Reporting
Present as identity attack paths with detection guidance; emphasize MFA/CA hardening and tier-0 protection of sync/federation. Checklist: `references/entra-checklist.md`.

---
<sub>© 2026 noahfranklin · Part of the [Gideon](https://github.com/noahfranklin/gideon) security suite · MIT License · Original work.</sub>