domains / families / security / post-exploiting-microsoft-graph-with-graphrunner

post-exploiting-microsoft-graph-with-graphrunner

separate

Runs GraphRunner, a PowerShell post-exploitation toolset built on

When to use

• After obtaining a valid Microsoft Graph access/refresh token during an authorized M365/Entra engagement.
• When mapping tenant permissions, conditional-access policies, and OAuth app exposure.
• When establishing cloud persistence via OAuth consent grants or inbox forwarding (in scope).
• When demonstrating privilege escalation through updatable/dynamic groups.
• When searching mailboxes, SharePoint/OneDrive, and Teams for sensitive data to evidence impact.

When not to use

• unauthorized use
• tenants not owned or explicitly authorized in writing

Skill page

Source