auditing-azure-active-directory-configuration

name	auditing-azure-active-directory-configuration
description	Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite. . Use when working with auditing azure active directory configuration.
domain	cybersecurity
tags	["cloud-security","azure","entra-id","active-directory","iam-audit","conditional-access"]
subdomain	cloud-security
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Auditing Azure Active Directory Configuration

Overview

Cybersecurity skill for auditing azure active directory configuration. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "auditing azure active directory configuration"

• "Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify r"

• When performing a security assessment of an Azure tenant's identity configuration

• When compliance audits require review of authentication policies, MFA enforcement, and role assignments

• When onboarding a new Azure tenant after merger or acquisition

• When investigating suspicious sign-in activity or compromised accounts

• When validating conditional access policies adequately protect against identity-based attacks

Do not use for on-premises Active Directory auditing (use PingCastle or BloodHound AD), for Azure resource-level RBAC auditing without identity context, or for real-time threat detection (use Microsoft Defender for Identity).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Global Reader or Security Reader role in the target Microsoft Entra ID tenant
• Microsoft Graph PowerShell SDK installed (Install-Module Microsoft.Graph)
• Az CLI authenticated to the target tenant (az login --tenant TENANT_ID)
• ScoutSuite with Azure provider configured for automated assessment
• Access to Azure AD audit logs and sign-in logs (requires Azure AD Premium P1/P2)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs() -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}