Read-only assessment tool that scans a Microsoft Entra ID tenant for the identity misconfigurations attackers actually use — and produces a prioritized, framework-mapped report an executive can act on.
Why this exists: free tools tell you what failed; they rarely tell you what to fix first. This tool ranks findings by exploitability and business impact, maps each to MCSB / CIS M365 / Essential Eight, and ships an executive summary — the deliverable format of a consulting engagement, not a compliance printout.
| # | Check | Why it matters |
|---|---|---|
| 1 | Stale guest accounts | Forgotten B2B guests are unmonitored footholds |
| 2 | Dormant privileged accounts | Unused admin = pure attack surface, zero business value |
| 3 | Legacy authentication exposure | Legacy protocols bypass MFA entirely |
| 4 | MFA gaps on privileged users | The single highest-impact identity control |
| 5 | Risky app consents | Over-privileged service principals are the modern backdoor |
📄 View the sample report — generated from fixture (demo) data and clearly banner-marked as such. Download and open it locally to see the deliverable format: executive summary, ranked findings, framework mappings, remediation, and a methodology section that states every scope limit.
📚 FAQ — the questions a client or interviewer will actually ask about each check, with the answers that survived architect review.
git clone https://github.com/KulbirJ/Entra-Attack-Surface-Reporter
cd Entra-Attack-Surface-Reporter
pip install -e ".[dev]"
cp .env.example .env # fill in tenant ID + app registration details
entra-asr report --output report.html| Scope | Used for |
|---|---|
User.Read.All |
Guest + user enumeration |
AuditLog.Read.All |
Sign-in activity + MFA registration report |
RoleManagement.Read.Directory |
Privileged role holders (least privilege over Directory.Read.All) |
Policy.Read.All |
Conditional Access policies + Security Defaults |
Application.Read.All |
Service principals & Graph app-role assignments |
The tool is read-only by design — it never writes to the tenant, and MFA
registration state is read via the reports endpoint under AuditLog.Read.All
rather than requesting the more sensitive UserAuthenticationMethod.Read.All.
Sign-in activity requires an Entra ID P1/P2 license; the tool fails
loudly with remediation guidance if a permission or license is missing.
Credential note: client-secret auth is for dev/lab use. For client engagements, use certificate auth with the private key in Key Vault/HSM — see the FAQ for the risk difference.
collect (Graph API) ──► score (severity + framework map) ──► report (HTML)
ruff check . # lint
pytest # tests (no live API calls — fixture-based)Built with Claude Code
under a teaching-mode working agreement — see CLAUDE.md.
MIT