domains / families / security / auditing-entra-id-with-aadinternals

auditing-entra-id-with-aadinternals

separate

Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testing (Golden SAML, T1606.002) for defensive validation. Use during an authorized Entra ID/Microsoft 365 red-team assessment to map external attack surface or verify AD FS signing certs resist Golden SAML.

When to use

• During an authorized Entra ID / Microsoft 365 red-team or assumed-breach assessment
• To enumerate external attack surface (verified domains, federation type, SSO) before credential attacks
• To validate that federation and AD FS token-signing certificates are protected against Golden SAML
• To test token acquisition and replay across Microsoft first-party APIs
• When building detections (pair with the blue-team Graph-log hunting skill) and you need real AADInternals telemetry

When not to use

• unauthorized security testing
• tenants without explicit written authorization

Skill page

Source