Auditing Azure Active Directory Configuration

When to Use

• When performing a security assessment of an Azure tenant's identity configuration
• When compliance audits require review of authentication policies, MFA enforcement, and role assignments
• When onboarding a new Azure tenant after merger or acquisition
• When investigating suspicious sign-in activity or compromised accounts
• When validating conditional access policies adequately protect against identity-based attacks

Do not use for on-premises Active Directory auditing (use PingCastle or BloodHound AD), for Azure resource-level RBAC auditing without identity context, or for real-time threat detection (use Microsoft Defender for Identity).

Prerequisites

• Global Reader or Security Reader role in the target Microsoft Entra ID tenant
• Microsoft Graph PowerShell SDK installed (Install-Module Microsoft.Graph)
• Az CLI authenticated to the target tenant (az login --tenant TENANT_ID)
• ScoutSuite with Azure provider configured for automated assessment
• Access to Azure AD audit logs and sign-in logs (requires Azure AD Premium P1/P2)

Workflow

Step 1: Enumerate Tenant Configuration and Security Defaults

Assess the tenant's baseline identity security settings including security defaults and legacy authentication status.

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Directory.Read.All","Policy.Read.All","AuditLog.Read.All"

# Get tenant details
Get-MgOrganization | Select-Object DisplayName, Id, VerifiedDomains

# Check if Security Defaults are enabled
Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy | Select-Object IsEnabled

# List authentication methods policies
Get-MgPolicyAuthenticationMethodPolicy | ConvertTo-Json -Depth 5

# Check legacy authentication status via Conditional Access
Get-MgIdentityConditionalAccessPolicy | Where-Object {
    $_.Conditions.ClientAppTypes -contains "exchangeActiveSync" -or
    $_.Conditions.ClientAppTypes -contains "other"
} | Select-Object DisplayName, State

Step 2: Audit Privileged Role Assignments

Review directory role assignments to identify over-privileged users, permanent admin accounts, and risky role configurations.

# List all Global Administrator assignments
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/directoryRoles/filterByIds" \
  --body '{"ids":["62e90394-69f5-4237-9190-012177145e10"]}' | \
  az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/directoryRoles?filter=displayName eq 'Global Administrator'" \
  --query "value[0].id" -o tsv

# List all privileged role assignments using Graph API
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?\$expand=principal" \
  --query "value[*].{Role:roleDefinitionId, Principal:principal.displayName, PrincipalType:principal.@odata.type}" \
  -o table

# Check for users with multiple admin roles
az ad user list --query "[].{UPN:userPrincipalName, DisplayName:displayName}" -o table

# List service principals with admin role assignments
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?\$filter=principalOrganizationId eq 'TENANT_ID'" \
  -o json

Step 3: Review Conditional Access Policies

Audit conditional access policies for coverage gaps, particularly around MFA enforcement, device compliance, and location-based restrictions.

# List all Conditional Access policies
Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName, State, @{
    N='GrantControls'; E={$_.GrantControls.BuiltInControls -join ', '}
} | Format-Table -AutoSize

# Identify policies in report-only mode (not enforced)
Get-MgIdentityConditionalAccessPolicy | Where-Object {$_.State -eq "enabledForReportingButNotEnforced"} |
    Select-Object DisplayName

# Check MFA enforcement coverage
Get-MgIdentityConditionalAccessPolicy | Where-Object {
    $_.GrantControls.BuiltInControls -contains "mfa"
} | Select-Object DisplayName, State, @{
    N='Users'; E={$_.Conditions.Users.IncludeUsers -join ', '}
}

# Find policies that exclude groups (potential bypass)
Get-MgIdentityConditionalAccessPolicy | Where-Object {
    $_.Conditions.Users.ExcludeGroups.Count -gt 0
} | Select-Object DisplayName, @{
    N='ExcludedGroups'; E={$_.Conditions.Users.ExcludeGroups -join ', '}
}

Step 4: Identify Stale Accounts and Guest Users

…