Entra ID Enumeration

Get current user Object ID

USER_ID=$(az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/users/$EMAIL" --query "id" -o tsv)

Get all Entra ID role assignments

ROLE_ASSIGNMENTS=$(az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments")

az rest --method get --query "value[].{RoleID:roleDefinitionId, Scope:directoryScopeId}" -o table --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?\$filter=principalId eq '$MY_OID'"

List only custom roles

az rest --method GET \
  --uri "https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions" | jq '.value[] | select(.isBuiltIn == false)'

Filter assignments for current user

echo "$ROLE_ASSIGNMENTS" | jq -r --arg uid "$USER_ID" \
  '.value[] | select(.principalId==$uid)'

Users Enumeration

Get users

az ad user list --output table
az ad user list --query "[].userPrincipalName"

Get info of 1 user

az ad user show --id "test@corp.onmicrosoft.com"

Search “admin” users

az ad user list --query "[].displayName" | findstr /i "admin"
az ad user list --query "[?contains(displayName,'admin')].displayName"

Search attributes containing the word “password”

az ad user list | findstr /i "password" | findstr /v "null,"

All users from Entra ID

az ad user list --query "[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi==null]"
az ad user list --query "[?onPremisesSecurityIdentifier==null].displayName"

All users synced from on-prem

az ad user list --query "[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi!=null]"
az ad user list --query "[?onPremisesSecurityIdentifier!=null].displayName"

Get groups where the user is a member

az ad user get-member-groups --id <email>

Get roles assigned to the user in Azure (NOT in Entra ID)

az role assignment list --include-inherited --include-groups --include-classic-administrators true --assignee <email>

Get ALL roles assigned in Azure in the current subscription (NOT in Entra ID)

az role assignment list --include-inherited --include-groups --include-classic-administrators true --all

Get EntraID roles assigned to a user

Get Token

export TOKEN=$(az account get-access-token --resource https://graph.microsoft.com/ --query accessToken -o tsv)

Get users

curl -X GET "https://graph.microsoft.com/v1.0/users" \
    -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" | jq

Get EntraID roles assigned to an user

curl -X GET "https://graph.microsoft.com/beta/rolemanagement/directory/transitiveRoleAssignments?\$count=true&\$filter=principalId%20eq%20'86b10631-ff01-4e73-a031-29e505565caa'" \
-H "Authorization: Bearer $TOKEN" \
-H "ConsistencyLevel: eventual" \
-H "Content-Type: application/json" | jq

Get role details

curl -X GET "https://graph.microsoft.com/beta/roleManagement/directory/roleDefinitions/cf1c38e5-3621-4004-a7cb-879624dced7c" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" | jq

Groups

Enumerate groups

az ad group list
az ad group list --query "[].[displayName]" -o table

Get info of 1 group

az ad group show --group <group>

Get “admin” groups

az ad group list --query "[].displayName" | findstr /i "admin"
az ad group list --query "[?contains(displayName,'admin')].displayName"

All groups from Entra ID

az ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi==null]"
az ad group list --query "[?onPremisesSecurityIdentifier==null].displayName"

All groups synced from on-prem

az ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi!=null]"
az ad group list --query "[?onPremisesSecurityIdentifier!=null].displayName"

Get members of group

az ad group member list --group <group> --query "[].userPrincipalName" -o table

Check if member of group

az ad group member check --group "VM Admins" --member-id <id>

Get which groups a group is member of

az ad group get-member-groups -g "VM Admins"

Get roles assigned to the group in Azure (NOT in Entra ID)

az role assignment list --include-groups --include-classic-administrators true --assignee <group-id>

Service Principals

Get Service Principals

az ad sp list --all
az ad sp list --all --query "[].[displayName,appId]" -o table

Get details of one SP

az ad sp show --id 00000000-0000-0000-0000-000000000000

Search SP by string

az ad sp list --all --query "[?contains(displayName,'app')].displayName"

Get owner of service principal

az ad sp owner list --id <id> --query "[].[displayName]" -o table

Get service principals owned by the current user

az ad sp list --show-mine

Get SPs with generated secret or certificate

az ad sp list --query '[?length(keyCredentials) > `0` || length(passwordCredentials) > `0`].[displayName, appId, keyCredentials, passwordCredentials]' -o json

Applications

List Apps

az ad app list
az ad app list --query "[].[displayName,appId]" -o table

Get info of 1 App

az ad app show --id 00000000-0000-0000-0000-000000000000

Search App by string

az ad app list --query "[?contains(displayName,'app')].displayName"

Get the owner of an application

az ad app owner list --id <id> --query "[].[displayName]" -o table

Get SPs owned by current user

az ad app list --show-mine

Get apps with generated secret or certificate

az ad app list --query '[?length(keyCredentials) > `0` || length(passwordCredentials) > `0`].[displayName, appId, keyCredentials, passwordCredentials]' -o json

Get Global Administrators (full access over apps)

az rest --method GET --url "https://graph.microsoft.com/v1.0/directoryRoles/1b2256f9-46c1-4fc2-a125-5b2f51bb43b7/members"

Get Application Administrators (full access over apps)

az rest --method GET --url "https://graph.microsoft.com/v1.0/directoryRoles/1e92c3b7-2363-4826-93a6-7f7a5b53e7f9/members"

Get Cloud Applications Administrators (full access over apps)

az rest --method GET --url "https://graph.microsoft.com/v1.0/directoryRoles/0d601d27-7b9c-476f-8134-8e7cd6744f02/members"

Get “API Permissions” of an App

Get the ResourceAppId

az ad app show --id "<app-id>" --query "requiredResourceAccess" --output json

[
  {
    "resourceAccess": [
      {
        "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
        "type": "Scope"
      },
      {
        "id": "d07a8cc0-3d51-4b77-b3b0-32704d1f69fa",
        "type": "Role"
      }
    ],
    "resourceAppId": "00000003-0000-0000-c000-000000000000"
  }
]

For the perms of type “Scope”

az ad sp show --id <ResourceAppId> --query "oauth2PermissionScopes[?id=='<id>'].value" -o tsv
az ad sp show --id "00000003-0000-0000-c000-000000000000" --query "oauth2PermissionScopes[?id=='e1fe6dd8-ba31-4d61-89e7-88639da4683d'].value" -o tsv

For the perms of type “Role”

az ad sp show --id <ResourceAppId> --query "appRoles[?id=='<id>'].value" -o tsv
az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "appRoles[?id=='d07a8cc0-3d51-4b77-b3b0-32704d1f69fa'].value" -o tsv

Managed Identities

List all manged identities

az identity list --output table