Azure Pentesting — References, Tools & Cheatsheet

A living reference for Azure and Entra ID offensive security tools, blogs, official docs, and useful API endpoints.

If you are completely new to Azure it is recommended to go through Microsoft training material for Azure to get familiar with it. It helped me understand Azure a lot better than I might have if I hadn’t gone through it. I especially want to emphasize “Manage security controls for identity and access” module from AZ-500 Training.

Open Interactive Cheatsheet

---

Tools

Tool	Link
AADInternals	https://o365blog.com/aadinternals/
MicroBurst	https://github.com/NetSPI/MicroBurst
BlobHunter	https://github.com/cyberark/blobhunter
Cloud Enum	https://github.com/initstring/cloud_enum
MFASweep	https://github.com/dafthack/MFASweep
O365Recon	https://github.com/nyxgeek/o365recon
AzureHound	https://github.com/BloodHoundAD/AzureHound
MSOLSpray	https://github.com/dafthack/MSOLSpray
PynAuth	https://github.com/Synzack/PynAuth
ROADtoken	https://github.com/dirkjanm/ROADtoken
RequestAADRefreshToken	https://github.com/leechristensen/RequestAADRefreshToken
Mandiant ADFSDump	https://github.com/mandiant/ADFSDump
Custom BloodHound Queries	https://github.com/hausec/Bloodhound-Custom-Queries
Awesome Azure Pentest	https://github.com/Kyuu-Ji/Awesome-Azure-Pentest
PayloadsAllTheThings Azure	https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md

---

Deployable Environments

Note: You have to activate Azure and Entra ID P2 free trials to be able to deploy these.

Name	URL
BadZure	https://github.com/mvelazc0/BadZure
EntraGoat	https://github.com/Semperis/EntraGoat

Blogs & Research

Resource	Link
dirkjanm.io - PRT abuse	https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/
DrAzureAD - Device Code Phishing	https://aadinternals.com/post/phishing/
DrAzureAD - ADFS	https://aadinternals.com/post/adfs/
DebugPrivilege - Managed Identity lateral movement	https://m365internals.com/2021/11/30/lateral-movement-with-managed-identities-of-azure-virtual-machines/
Tripla.dk - Managed Identities lab	https://tripla.dk/2022/03/13/create-an-azure-vulnerable-lab-part-4-managed-identities/
Datadog Security Labs - AU abuse	https://web.archive.org/web/20260422094633/https://securitylabs.datadoghq.com/articles/abusing-entra-id-administrative-units/
Just Looking - Public API enumeration	https://o365blog.com/post/just-looking/
cloud.hacktricks.wiki	https://cloud.hacktricks.wiki/en/pentesting-cloud/azure-security/index.html

---

Official Microsoft Docs

Resource	Link
Graph Permissions Reference	https://learn.microsoft.com/en-us/graph/permissions-reference
Entra ID Role Permissions	https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference
Azure Built-in Roles	https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
Azure Domains List	https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-domains
Managed Identities Overview	https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
Primary Refresh Token	https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token
Graph Explorer	https://developer.microsoft.com/en-us/graph/graph-explorer
Graph API Overview	https://learn.microsoft.com/en-us/graph/api/overview
Default User Permissions	https://docs.azure.cn/en-us/entra/fundamentals/users-default-permissions
AZ-500 Training	https://learn.microsoft.com/en-us/training/courses/az-500t00
Publisher Verification	https://learn.microsoft.com/en-us/azure/active-directory/develop/publisher-verification-overview

---

Useful API Endpoints

Purpose	URL
Check if tenant uses Entra ID	https://login.microsoftonline.com/getuserrealm.srf?login=user@COMPANY.com&xml=1
Get Tenant ID	https://login.microsoftonline.com/<domain>/.well-known/openid-configuration
Device login	https://microsoft.com/devicelogin
OAuth token endpoint	https://login.microsoftonline.com/Common/oauth2/token?api-version=1.0

---

Key GUIDs

Role / Permission	GUID
Global Administrator	62e90394-69f5-4237-9190-012177145e10
Privileged Role Administrator	e8611ab8-c189-46e8-94e1-60213ab1f814
Privileged Authentication Administrator	7be44c8a-adaf-4e2a-84d6-ab2649e08a13
Application Administrator	9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3
Cloud Application Administrator	158c047a-c907-4556-b7ef-446551a6b5f7
User Administrator	fe930be7-5e62-47db-91af-98c3a49a38b1
AppRoleAssignment.ReadWrite.All	06b708a9-e830-4db3-a914-8e69da51d44f
Application.ReadWrite.All	1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9
Application.ReadWrite.OwnedBy	18a4783c-866b-4cc7-a460-3d5e5662c884
Directory.ReadWrite.All	19dbc75e-c2e2-444c-a770-ec69d8559fc7
Directory.Read.All	7ab1d382-f21e-4acd-a863-ba3e13f7da61
Organization.ReadWrite.All	292d869f-3427-49a8-9dab-8c70152b74e9
RoleManagement.ReadWrite.Directory	9e3f62cf-ca93-4e0f-b9a4-8c7d4e3b4f8a
Microsoft Graph SP (all tenants)	216e59bf-6c38-42b9-9211-734fe4d2f3bb