domains / families / security / attacking-entra-id-with-roadtools

attacking-entra-id-with-roadtools

separate

Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and

When to use

• During an authorized Azure / Entra ID red-team or cloud penetration test.
• When you have a foothold credential, refresh token, or PRT and need to enumerate the tenant.
• When you must pivot a token from one resource (e.g., Azure CLI) to another (e.g., Microsoft Graph).
• When validating that conditional-access, device-compliance, and token controls actually constrain an attacker.
• When mapping Entra attack paths (export to BloodHound for graph analysis).

When not to use

• unauthorized access to a cloud tenant

Skill page

Source