✅ Requirements

Furthermore, you must be able to authenticate to the Microsoft Graph API and optionally the Azure ARM API from the device where you run the tool. Ensure that Conditional Access Policies do not block your authentication.

▶️ Usage

Download EntraFalcon

To get started, clone the repository and navigate into the project directory:

Note: You may need to temporarily change the PowerShell execution policy to run the script. Only do this for trusted scripts!

Run EntraFalcon

EntraFalcon includes built-in support for Entra ID authentication. Use -AuthFlow to select the authentication flow.

For normal assessments, use one of the full-coverage flows:

BroCi uses one interactive login. BroCiToken and ServicePrincipal use none. Fallback user flows may require multiple interactive logins because separate resource tokens are requested.

Recommended: BroCi Flow (default / Windows only)

BroCi uses alternate first-party applications and requires only one interactive sign-in.
It is useful when the Azure Active Directory PowerShell client requires assignment and must be avoided.

Explicit BroCi selection:

Recommended: BroCi + Manual Code Flow

1. The script copies the authentication URL to the clipboard.
2. Paste the URL into a browser (optionally on another device for SSO support).
3. Open the browser developer tools and, in the Network tab, enable Preserve log.
4. Complete authentication.
5. Search the network log for code=1. and copy the request URL containing the code to the clipboard.
6. Press Enter to continue; the script reads the code from the clipboard and completes token acquisition.

Recommended: BroCi with Token

If a valid Azure Portal refresh token is already available (client c44b4083-3bb0-49c1-b47d-974e53cbdf3c), it can be used directly. Example: Obtaining the refresh token from the browser

1. Open the browser developer tools and, in the Network tab, enable Preserve log.
2. Authenticate at https://entra.microsoft.com.
3. Search the network log for brk_client_id=c44b4083-3bb0-49c1-b47d-974e53cbdf3c and extract the refresh token from the response.

Recommended: Service Principal

Authenticates as a registered application using the OAuth2 client credentials grant — no user interaction required. Useful for repeated automated executions.
Requires a custom Entra app registration with Application-type Graph API permissions (see below).

With client secret:

With PFX certificate:

For a password-protected PFX, add -SPCertificatePassword (Read-Host -Prompt "Certificate password" -AsSecureString).

With PEM certificate + private key (PowerShell 7+ only):

For an encrypted private key, add -SPPrivateKeyPemPassword (Read-Host -Prompt "Private key password" -AsSecureString).

Required App Registration Permissions

Grant the following Application permissions (not Delegated) on the app registration and admin-consent them:

In addition, assign the Azure Reader role on the root management group (or every relevant subscription) and optionally the Global Reader role to the service principal in Entra ID (required for per-user MFA status).

Fallback: Auth Code Flow (Windows only)

Fallback: Device Code Flow

It is often restricted by Conditional Access in hardened environments.
With DeviceCode, two Security Findings checks run with reduced depth (CAP-004 and CAP-005).

Fallback: Auth Code + Manual Code Flow

1. The script copies the authentication URL to the clipboard.
2. Paste the URL into a browser (optionally on another device for SSO support).
3. Complete authentication.
4. Copy the final redirect URL from the browser address bar (containing the authorization code) to the clipboard.
5. Press Enter to continue; the script reads the code from the clipboard and completes token acquisition.

Other Parameters

Include Microsoft-Owned Enterprise Apps

By default, official Microsoft enterprise applications are excluded from the assessment to reduce noise. To include them in the enumeration and analysis, use the -IncludeMsApps switch:

Skip PIM for Groups Assessment

Use the -SkipPimForGroups switch to skip PIM for Groups precollection and enrichment.
This also skips the standalone PIM for Groups settings report.

Other Optional Parameters

📊 Some Example Reports

Security Finding Report

Users

Users (Details Section)

Entra ID Roles

Azure Roles

Enterprise Application (Details Section)

Conditional Access Policies

Conditional Access Policies (Details Section)

PIM Role Settings (Entra)

Agent Identities

Enumeration Summary

📑 HTML Report

General

• Click the ⚙️ Columns button to show or hide specific columns.
• Click 💾 Export to download CSV/JSON or copy CSV/TSV/JSON of the currently visible data.
• Click 👁 Share View to copy filters, sorting, and column selection as a shareable link.
• Click 🧰 Preset Views to apply preconfigured filters and column selections.
• Click 🔄 Reset View to reset the view to the default.
• Click on object names to jump to detailed information, even in other reports.
• When using internal navigation, press the browser’s back button to return.
• Some table header fields display helper text on mouse hover.
• Sort data by clicking a table header.
• Alt+click a main table column header to quickly hide that column.
• Alt+click a main table content row to hide it temporarily. Use the hidden-rows chip or Reset View to show hidden rows again.

Filtering

• If no operator is specified, filtering defaults to contains.
• Use = for an exact match.
• Use ^ for starts with (e.g., ^Mallory).
• Use $ for ends with (e.g., $domain.ch).
• Comparison operators like >, <, >=, <= are supported (numeric values only).
• Filters can be negated by starting with ! (except for numeric comparisons). Examples: !Mallory, !=Mallory,!^Mallory or !$domain.ch.
• Use =empty to match empty cells, or !=empty to match non-empty cells.
• Use || to match any of multiple values in the same column (e.g., Admin || Guest).
• Use && to require multiple matches in the same column (e.g., !adm && !svc && !sql).
• To apply OR logic across columns, use or_, group1_, group2_... directly in a filter field. Examples: in column 1: or_>1, in column 2: or_!Mallory
• Note: The DisplayName column also includes the object's ID (invisible), so filtering by ID is also possible.

Controls using GET Parameters

• Filtering: Apply filters using field names as HTTP GET parameters, e.g., ?EntraRoles=>1&Enabled=true.
  To apply OR logic across columns, use the or_ or group1_ prefix (e.g., ?or_EntraRoles=>0&or_GrpMem=>0).
• Column Selection: Choose which columns to display using the columns parameter. Example: ?columns=DisplayName,Owner.
• Sorting: Sort the data using sort and sortDir parameters. Example: ?sort=Impact&sortDir=desc or ?sort=OwnerCount&sortDir=asc.
• Object Details: Jump directly to a specific object in the report using an anchor (#) and the object id, e.g. #%ObjectID%.

Rating

• Impact: Represents the amount or severity of permissions the object has.
• Likelihood: Represents how easily the object can be influenced or how well it is protected.
• Risk: Calculated score: Impact × Likelihood = Risk.
• Important:
  • This scoring is meant as a basic evaluation to help sort and prioritize entries in the table.
  • Risk scores are not directly comparable across different object types or reports.
  • It is not intended to replace a full risk assessment.

🔧Under the Hood

Role Categorization

Entra ID and Azure roles are roughly categorized into different tier levels. This categorization influences the impact scores of objects assigned to those roles. The goal is to assign a higher impact score to users with more powerful roles (e.g., Global Administrator) compared to users with less critical roles (e.g., Global Reader), even if both are considered privileged roles by Microsoft.

Note: For Azure roles, this categorization is less precise, as the actual impact depends heavily on the scope of the role assignment. For example, an Owner role on a single virtual machine has significantly less impact than when the same role is applied to an entire subscription. It might also be a test subscription with no resources at all.

API Permission Categorization

Certain API permissions allow an application to directly escalate to Global Administrator privileges. Therefore, several API permissions are categorized into different severity levels. This categorization influences the impact score of applications that have these permissions assigned — either as application permissions or delegated permissions for users.

Microsoft First-Party Enterprise Applications

By default, Microsoft applications are filtered out to simplify the review of Enterprise Applications. Use the -IncludeMsApps switch to include them. Applications from the following tenants are treated as Microsoft-owned:

• f8cdef31-a31e-4b4a-93e4-5f571e91255a
• 72f988bf-86f1-41af-91ab-2d7cd011db47
• 33e01921-4d64-4f8c-a055-5bdaffd5e33d
• cdc5aeea-15c5-4db6-b079-fcadd2505dc2

Checks Performed

The following table roughly summarizes the checks performed, along with their impact on scoring and whether a warning is displayed.

🛡️ Detection

EntraFalcon is not stealthy and can be detected in environments where Microsoft Graph API and Azure sign-in activity are logged and monitored.

Default Authentication Used

When a full enumeration is performed with non-BroCi flows, the tool typically initiates four interactive logins and one non-interactive login. Depending on flow and endpoint support, one additional interactive sign-in may occur for Security Findings policy endpoints.

BroCi Authentication Used

When BroCi authentication is used, only one interactive login occurs.

When BroCi is enabled, EntraFalcon also queries api.azrbac.mspim.azure.com for PIM for Groups.

Details

For data collection, the tool sends multiple requests to the Microsoft Graph API and, optionally, the Azure ARM API—one or more per object. Where possible, it leverages the Graph Batch endpoint to reduce the number of individual requests and improve efficiency.

Interactive sign-ins use the browser's User-Agent. All non-interactive sign-ins and API requests (Graph and ARM) use EntraFalcon as the User-Agent, unless changed with the -UserAgent parameter.

To detect usage of EntraFalcon, blue teams can monitor for the listed application IDs in sign-in logs, look for unusual volumes of Graph API traffic, or analyze token refresh and batch request behavior.

🕳️ Known Limitations

• M365 RBAC: Not assessed
• Defender for Endpoint RBAC: Not assessed
• Conditional Access user coverage: Effective user coverage and -ExportCapUncoveredUsers are best-effort calculations based on enumerated users, group members, role assignments, and resolvable external-user categories. External-user selectors are only resolved for tenant guest users matching b2bCollaborationGuest. Other external-user types or external users with specified external tenants can make coverage values approximate. Eligible PIM paths are reported as potential coverage and are not counted as currently covered. CSV export is limited to enabled policies and enabled users.
• Cloud Environment: Cloud platforms evolve rapidly. As a result, some assessments or detections may become outdated or inaccurate over time. Moreover, tenants are becoming increasingly complex, and specific configurations or combinations of settings may lead to inaccurate results. While we strive to keep EntraFalcon up to date, it is always recommended to validate findings independently and not rely solely on the tool for critical decisions.
• HTML Reports: The generated HTML reports do not implement protection mechanisms against cross-site scripting (XSS).

📦 Integrated External Tools

The following submodules have been forked and integrated into EntraFalcon to support authentication, Microsoft Graph interaction and report charts:

• EntraTokenAid
• GraphRequest
• Send-ApiRequest
• GraphBatchRequest
• Chart.js