EntraFalcon

EntraFalcon is a PowerShell-based assessment tool for pentesters, security analysts, and system administrators to evaluate the security posture of a Microsoft Entra ID environment.

Designed for ease of use, EntraFalcon runs on PowerShell 5.1 and 7, supports both Windows and Linux, and requires no additional PowerShell modules, extra installations, or Microsoft Graph API consent.

The tool helps uncover privileged objects, potentially risky assignments and Conditional Access misconfigurations that are often overlooked, such as:

• Users with control over high-privilege groups or applications
• External or internal enterprise applications with excessive permissions (e.g., Microsoft Graph API, Azure roles)
• Users with Azure IAM role assignments directly on resources
• Privileged accounts synced from on-premises
• Inactive users or users without MFA capability
• Unprotected groups used in sensitive assignments (e.g., Conditional Access exclusions, Subscription Owner, or eligible member of a privileged group)

Findings are presented in interactive HTML reports to support efficient exploration and analysis.

🚀 Features

• Simple PowerShell script compatible with PowerShell 5.1 and 7. Works on Windows and Linux
• Built-in authentication supporting multiple methods
• Uses first-party Microsoft applications with pre-consented scopes to bypass Graph API consent prompts
• Generates navigable HTML reports that support filtering, sorting, data export, etc.
• Performs >80 automated checks and summarizes the results in a Security Findings Report
  • Includes checks for weak tenant configurations and risky object properties or permissions
  • Provides severity ratings as well as descriptions of the issue, potential threats, and remediation guidance
  • Lists affected objects and links directly to their detailed reports for further investigation
• Performs basic impact, likelihood, and risk scoring to highlight weakly protected high-privilege objects and sort the data.
• Displays warnings for risky configurations and elevated privileges
• Enumerates Entra ID objects, including:
  • Users (including Agent Users)
  • Groups
  • Enterprise Applications
  • App Registrations
  • Managed Identities
  • Agent identities (BETA)
  • Agent identity blueprint principals (BETA)
  • Agent identity blueprints (BETA)
  • PIM assignments:
    • PIM for Entra Roles
    • PIM for Entra Groups
    • PIM for Azure Roles
  • Entra Role Assignments
  • Azure Role Assignments
  • Conditional Access Policies
  • Administrative Units
  • PIM settings:
    • PIM for Entra Roles
    • PIM for Groups (BroCi auth only)

✅ Requirements

Furthermore, you must be able to authenticate to the Microsoft Graph API and optionally the Azure ARM API from the device where you run the tool. Ensure that Conditional Access Policies do not block your authentication.

▶️ Usage

Download EntraFalcon

To get started, clone the repository and navigate into the project directory:

git clone https://github.com/CompassSecurity/EntraFalcon
cd EntraFalcon

Note: You may need to temporarily change the PowerShell execution policy to run the script. Only do this for trusted scripts!

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Process

Run EntraFalcon

EntraFalcon includes built-in support for Entra ID authentication.
Multiple authentication flows are available to support different environments and restrictions.
Depending on the selected flow, this requires multiple interactive authentications.

Use -AuthFlow to select the authentication flow.

Use BroCi flow (default / Windows only)

BroCi uses alternate first-party applications and requires only one interactive sign-in.
It is further useful, when the Azure Active Directory PowerShell client requires assignment and must be avoided.

.\run_EntraFalcon.ps1

Explicit BroCi selection:

.\run_EntraFalcon.ps1 -AuthFlow BroCi

Auth Code Flow (Windows only)

.\run_EntraFalcon.ps1 -AuthFlow AuthCode

Device Code Flow

It is often restricted by Conditional Access in hardened environments.
With DeviceCode, two Security Findings checks run with reduced depth (CAP-004 and CAP-005).

.\run_EntraFalcon.ps1 -AuthFlow DeviceCode

Use Auth Code + Manual Code Flow Authentication

.\run_EntraFalcon.ps1 -AuthFlow ManualCode

1. The script copies the authentication URL to the clipboard.
2. Paste the URL into a browser (optionally on another device for SSO support).
3. Complete authentication.
4. Copy the final redirect URL from the browser address bar (containing the authorization code) to the clipboard.
5. Press Enter to continue; the script reads the code from the clipboard and completes token acquisition.

BroCi + Manual Code Flow

.\run_EntraFalcon.ps1 -AuthFlow BroCiManualCode

1. The script copies the authentication URL to the clipboard.
2. Paste the URL into a browser (optionally on another device for SSO support).
3. Open the browser developer tools and, in the Network tab, enable Preserve log.
4. Complete authentication.
5. Search the network log for code=1. and copy the request URL containing the code to the clipboard.
6. Press Enter to continue; the script reads the code from the clipboard and completes token acquisition.

BroCi with Token

If a valid Azure Portal refresh token is already available (client c44b4083-3bb0-49c1-b47d-974e53cbdf3c), it can be used directly. Example: Obtaining the refresh token from the browser

1. Open the browser developer tools and, in the Network tab, enable Preserve log.
2. Authenticate at https://entra.microsoft.com.
3. Search the network log for brk_client_id=c44b4083-3bb0-49c1-b47d-974e53cbdf3c and extract the refresh token from the response.

.\run_EntraFalcon.ps1 -AuthFlow BroCiToken -BroCiToken "1.XXXXXXXXXXX"

Service Principal

Authenticates as a registered application using the OAuth2 client credentials grant — no user interaction required. Useful for automated executions.
Requires a custom Entra app registration with Application-type Graph API permissions (see below).

With client secret:

.\run_EntraFalcon.ps1 -AuthFlow ServicePrincipal -Tenant "mysecuretenant.ch" -SPClientId "<AppId>" -SPClientSecret "<Secret>"

With PFX certificate:

.\run_EntraFalcon.ps1 -AuthFlow ServicePrincipal -Tenant "mysecuretenant.ch" -SPClientId "<AppId>" -SPCertificatePath "C:\certs\app.pfx"

For a password-protected PFX, add -SPCertificatePassword (Read-Host -Prompt "Certificate password" -AsSecureString).

With PEM certificate + private key (PowerShell 7+ only):

.\run_EntraFalcon.ps1 -AuthFlow ServicePrincipal -Tenant "mysecuretenant.ch" -SPClientId "<AppId>" -SPCertificatePemPath "C:\certs\cert.pem" -SPPrivateKeyPemPath "C:\certs\key.pem"

For an encrypted private key, add -SPPrivateKeyPemPassword (Read-Host -Prompt "Private key password" -AsSecureString).

Required App Registration Permissions

Grant the following Application permissions (not Delegated) on the app registration and admin-consent them:

In addition, assign the Azure Reader role on the root management group (or every relevant subscription) and optionally the Global Reader role to the service principal in Entra ID (required for per-user MFA status).

Other Parameters

Include Microsoft-Owned Enterprise Apps

By default, official Microsoft enterprise applications are excluded from the assessment to reduce noise. To include them in the enumeration and analysis, use the -IncludeMsApps switch:

.\run_EntraFalcon.ps1 -IncludeMsApps

Skip PIM for Groups Assessment

Use the -SkipPimForGroups switch to skip PIM-for-Groups precollection and enrichment.
This also skips the standalone PIM (Groups) settings report.

.\run_EntraFalcon.ps1 -SkipPimForGroups

Other Optional Parameters

📊 Some Example Reports

Security Finding Report

Users

Users (Details Section)

Entra ID Roles

Azure Roles

Enterprise Application (Details Section)

Conditional Access Policies

Conditional Access Policies (Details Section)

PIM Role Settings (Entra)

Agent Identities

Enumeration Summary

📑 HTML Report

General

• Click the ⚙️ Columns button to show or hide specific columns.
• Click 💾 Export CSV to download the currently visible data as a CSV file.
• Click 👁 Share View to copy filters, sorting, and column selection as a shareable link.
• Click 🧰 Preset Views to apply preconfigured filters and column selections.
• Click 🔄 Reset View to reset the view to the default.
• Click on object names to jump to detailed information, even in other reports.
• When using internal navigation, press the browser’s back button to return.
• Some table header fields display helper text on mouse hover.
• Sort data by clicking a table header.

Filtering

• If no operator is specified, filtering defaults to contains.
• Use = for an exact match.
• Use ^ for starts with (e.g., ^Mallory).
• Use $ for ends with (e.g., $domain.ch).
• Comparison operators like >, <, >=, <= are supported (numeric values only).
• Filters can be negated by starting with ! (except for numeric comparisons). Examples: !Mallory, !=Mallory,!^Mallory or !$domain.ch.

Controls using GET Parameters

• Filtering: Apply filters using field names as HTTP GET parameters, e.g., ?EntraRoles=>1&Enabled=true.
  To apply OR logic across columns, use or_ or group1_ prefix in (e.g., ?or_EntraRoles=>0&or_GrpMem=>0).
• Column Selection: Choose which columns to display using the columns parameter. Example: ?columns=DisplayName,Owner.
• Sorting: Sort the data using sort and sortDir parameters. Example: ?sort=Impact&sortDir=desc or ?sort=OwnerCount&sortDir=asc.
• Object Details: Jump directly to a specific object in the report using an anchor (#) and the object id, e.g. #%ObjectID%.

Rating

• Impact: Represents the amount or severity of permission the object has.
• Likelihood: Represents how easily the object can be influenced or how well it is protected.
• Risk: Calculated score: Impact × Likelihood = Risk.
• Important:
  • This scoring is meant as a basic evaluation to help sort and prioritize entries in the table.
  • Risk scores are not directly comparable across different object types or reports.
  • It is not intended to replace a full risk assessment.

🔧Under the Hood

Role Categorization

Entra ID and Azure roles are roughly categorized into different tier levels. This categorization influences the impact scores of objects assigned to those roles. The goal is to assign a higher impact score to users with more powerful roles (e.g., Global Administrator) compared to users with less critical roles (e.g., Global Reader), even if both are considered privileged roles by Microsoft.

Note: For Azure roles, this categorization is less precise, as the actual impact depends heavily on the scope of the role assignment. For example, an Owner role on a single virtual machine has significantly less impact than when the same role is applied to an entire subscription. It might also be a test subscription with no resources at all.

API Permission Categorization

Certain API permissions allow an application to directly escalate to Global Administrator privileges. Therefore, several API permissions are categorized into different severity levels. This categorization influences the impact score of applications that have these permissions assigned — either as application permissions or delegated permissions for users.

Microsoft First-Party Enterprise Applications

By default, Microsoft applications are filtered out to simplify the review of Enterprise Applications. Use the -IncludeMsApps switch to include them. Applications from the following tenants are treated as Microsoft-owned:

• f8cdef31-a31e-4b4a-93e4-5f571e91255a
• 72f988bf-86f1-41af-91ab-2d7cd011db47
• 33e01921-4d64-4f8c-a055-5bdaffd5e33d
• cdc5aeea-15c5-4db6-b079-fcadd2505dc2

Checks Performed

The following table roughly summarizes the checks performed, along with their impact on scoring and whether a warning is displayed.

🛡️ Detection

EntraFalcon is not stealthy and can be detected in environments where Microsoft Graph API and Azure sign-in activity are logged and monitored.

Default Authentication Used

When a full enumeration is performed with non-BroCi flows, the tool typically initiates four interactive logins and one non-interactive login. Depending on flow and endpoint support, one additional interactive sign-in may occur for Security Findings policy endpoints.

BroCi Authentication Used

When BroCi authentication is used, only one interactive login occurs.

When BroCi is enabled, EntraFalcon also queries api.azrbac.mspim.azure.com for PIM for Groups.

Details

For data collection, the tool sends multiple requests to the Microsoft Graph API and, optionally, the Azure ARM API—one or more per object. Where possible, it leverages the Graph Batch endpoint to reduce the number of individual requests and improve efficiency.

Interactive sign-ins use the browser's User-Agent. All non-interactive sign-ins and API requests (Graph and ARM) use EntraFalcon as the User-Agent, unless changed with the -UserAgent parameter.

To detect usage of EntraFalcon, blue teams can monitor for the listed application IDs in sign-in logs, look for unusual volumes of Graph API traffic, or analyze token refresh and batch request behavior.

🕳️ Known Limitations

• M365 RBAC: Not assessed
• Defender for Endpoint RBAC: Not assessed
• Intune RBAC: Not assessed
• Conditional Access user coverage: Effective user coverage and -ExportCapUncoveredUsers are best-effort calculations based on enumerated users, group members, role assignments, and resolvable external-user categories. External-user selectors are only resolved for tenant guest users matching b2bCollaborationGuest. Other external-user types or external users with specified external tenants can make coverage values approximate. Eligible PIM paths are reported as potential coverage and are not counted as currently covered. CSV export is limited to enabled policies and enabled users.
• Cloud Environment: Cloud platforms evolve rapidly. As a result, some assessments or detections may become outdated or inaccurate over time. Moreover, tenants are becoming increasingly complex, and specific configurations or combinations of settings may lead to inaccurate results. While we strive to keep EntraFalcon up to date, it is always recommended to validate findings independently and not rely solely on the tool for critical decisions.
• HTML Reports: The generated HTML reports do not implement protection mechanisms against cross-site scripting (XSS).

📦 Integrated External Tools

The following submodules have been forked and integrated into EntraFalcon to support authentication, Microsoft Graph interaction and report charts:

• EntraTokenAid
• GraphRequest
• Send-ApiRequest
• GraphBatchRequest
• Chart.js