Auditing Azure Active Directory Configuration

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Directory.Read.All","Policy.Read.All","AuditLog.Read.All"

# Get tenant details
Get-MgOrganization | Select-Object DisplayName, Id, VerifiedDomains

# Check if Security Defaults are enabled
Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy | Select-Object IsEnabled

# List authentication methods policies
Get-MgPolicyAuthenticationMethodPolicy | ConvertTo-Json -Depth 5

# Check legacy authentication status via Conditional Access
Get-MgIdentityConditionalAccessPolicy | Where-Object {
    $_.Conditions.ClientAppTypes -contains "exchangeActiveSync" -or
    $_.Conditions.ClientAppTypes -contains "other"
} | Select-Object DisplayName, State

# List all Global Administrator assignments
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/directoryRoles/filterByIds" \
  --body '{"ids":["62e90394-69f5-4237-9190-012177145e10"]}' | \
  az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/directoryRoles?filter=displayName eq 'Global Administrator'" \
  --query "value[0].id" -o tsv

# List all privileged role assignments using Graph API
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?\$expand=principal" \
  --query "value[*].{Role:roleDefinitionId, Principal:principal.displayName, PrincipalType:principal.@odata.type}" \
  -o table

# Check for users with multiple admin roles
az ad user list --query "[].{UPN:userPrincipalName, DisplayName:displayName}" -o table

# List service principals with admin role assignments
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?\$filter=principalOrganizationId eq 'TENANT_ID'" \
  -o json

# List all Conditional Access policies
Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName, State, @{
    N='GrantControls'; E={$_.GrantControls.BuiltInControls -join ', '}
} | Format-Table -AutoSize

# Identify policies in report-only mode (not enforced)
Get-MgIdentityConditionalAccessPolicy | Where-Object {$_.State -eq "enabledForReportingButNotEnforced"} |
    Select-Object DisplayName

# Check MFA enforcement coverage
Get-MgIdentityConditionalAccessPolicy | Where-Object {
    $_.GrantControls.BuiltInControls -contains "mfa"
} | Select-Object DisplayName, State, @{
    N='Users'; E={$_.Conditions.Users.IncludeUsers -join ', '}
}

# Find policies that exclude groups (potential bypass)
Get-MgIdentityConditionalAccessPolicy | Where-Object {
    $_.Conditions.Users.ExcludeGroups.Count -gt 0
} | Select-Object DisplayName, @{
    N='ExcludedGroups'; E={$_.Conditions.Users.ExcludeGroups -join ', '}
}

# Find users who haven't signed in for 90+ days
az ad user list --query "[?signInActivity.lastSignInDateTime < '2025-11-25T00:00:00Z'].{UPN:userPrincipalName, LastSignIn:signInActivity.lastSignInDateTime, Enabled:accountEnabled}" -o table

# List all guest users
az ad user list --filter "userType eq 'Guest'" \
  --query "[].{UPN:userPrincipalName, DisplayName:displayName, CreatedDate:createdDateTime}" \
  -o table

# Find guest users with privileged roles
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?\$expand=principal" \
  --query "value[?principal.userType=='Guest'].{Role:roleDefinitionId,Guest:principal.userPrincipalName}" \
  -o table

# Check for accounts with disabled MFA
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails" \
  --query "value[?!isMfaRegistered].{UPN:userPrincipalName,MfaRegistered:isMfaRegistered}" \
  -o table

# Get risky sign-ins from last 7 days
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=riskLevelDuringSignIn ne 'none' and createdDateTime ge 2026-02-16T00:00:00Z" \
  --query "value[*].{User:userPrincipalName,Risk:riskLevelDuringSignIn,IP:ipAddress,App:appDisplayName,Status:status.errorCode}" \
  -o table

# Get sign-ins from unfamiliar locations
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=riskEventTypes_v2/any(r:r eq 'unfamiliarFeatures')" \
  --query "value[*].{User:userPrincipalName,Location:location.city,IP:ipAddress}" \
  -o table

# Check for legacy authentication sign-ins
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=clientAppUsed ne 'Browser' and clientAppUsed ne 'Mobile Apps and Desktop clients'" \
  --query "value[*].{User:userPrincipalName,ClientApp:clientAppUsed,Status:status.errorCode}" \
  -o table

# Run ScoutSuite against Azure
python3 -m ScoutSuite azure --cli \
  --report-dir ./scoutsuite-azure-report \
  --all-subscriptions

# Review the generated HTML report
open ./scoutsuite-azure-report/azure-report.html