Comprehensive Azure & Microsoft Graph Enumeration Playbook
1. Connect to Microsoft Graph & Azure Modules
# Microsoft Graph PowerShell
Connect-MgGraph -Scopes "Directory.Read.All", "User.Read.All", "Group.Read.All", "RoleManagement.Read.Directory",
"Policy.Read.All", "Application.Read.All", "Device.Read.All"
# Azure PowerShell
Connect-AzAccount
2. Enumerate All Users, Groups, and Roles
# Users
Get-MgUser -All | Select-Object DisplayName, UserPrincipalName, Id
Get-AzADUser | Select-Object DisplayName, UserPrincipalName
# Groups
Get-MgGroup -All | Select-Object DisplayName, GroupTypes
Get-MgGroupMember -GroupId <group-id>
Get-AzADGroup
Get-AzADGroupMember -GroupObjectId <group-id>
# Roles and Assignments
Get-MgRoleManagementDirectoryRoleAssignment
Get-MgDirectoryRole
Get-AzRoleAssignment
Get-AzRoleDefinition
3. Enumerate Applications, SPNs, and Permissions
Comprehensive Azure & Microsoft Graph Enumeration Playbook
# Applications and Service Principals
Get-MgApplication -All | Select-Object DisplayName, AppId
Get-MgServicePrincipal -All | Select-Object DisplayName, AppId, Id
Get-AzADApplication
Get-AzADServicePrincipal
# App Permissions
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId <id>
Get-MgOauth2PermissionGrant
4. Check Policies (Conditional Access, MFA, Token Lifetime)
# Conditional Access Policies
Get-MgConditionalAccessPolicy
# Authentication Methods & Strength Policies
Get-MgPolicyAuthenticationMethodsPolicy
Get-MgPolicyAuthenticationStrengthPolicy
# Token Lifetime Policies
Get-MgPolicyTokenLifetimePolicy
5. Enumerate Subscriptions, Key Vaults, and Storage
# Subscriptions
Get-AzSubscription
Set-AzContext -SubscriptionId <id>
# Key Vaults and Secrets
Get-AzKeyVault
Comprehensive Azure & Microsoft Graph Enumeration Playbook
Get-AzKeyVaultSecret -VaultName <vault>
Get-AzKeyVaultKey -VaultName <vault>
# Storage Accounts
Get-AzStorageAccount
Get-AzStorageContainer -StorageAccountName <account>
$key = (Get-AzStorageAccountKey -ResourceGroup <rg> -AccountName <acc>)[0].Value
$ctx = New-AzStorageContext -StorageAccountName <acc> -StorageAccountKey $key
Get-AzStorageBlob -Container <container> -Context $ctx
6. Detect Over-Privileged Identities
# List all role assignments
Get-AzRoleAssignment | Select-Object DisplayName, RoleDefinitionName, Scope
# Identify Global Admins and Privileged Roles
Get-MgDirectoryRole | Where-Object {$_.DisplayName -match "Admin"}
Get-MgDirectoryRoleMember -DirectoryRoleId <id>
7. Cross-Reference Roles and App Registrations for Abuse
# Find SPNs with privileged roles
Get-AzRoleAssignment | Where-Object { $_.PrincipalType -eq "ServicePrincipal" }
# List app roles assigned to SPNs
Get-MgServicePrincipalAppRoleAssignedTo
# Identify apps with high privileges
Get-MgServicePrincipal | Where-Object { $_.AppRoles -ne $null -and $_.AppRoles.AllowedMemberTypes -contains
"Application" }
