EntraFalcon: a PowerShell audit of a Microsoft Entra ID tenant

A single-script audit of an Entra ID tenant

EntraFalcon is a PowerShell-based assessment tool for pentesters, security analysts and system administrators to evaluate the security posture of a Microsoft Entra ID environment. The design goal is stated in the README's second paragraph: ease of use, running on PowerShell 5.1 and 7, supporting both Windows and Linux, and requiring no additional PowerShell modules, extra installations or Microsoft Graph API consent. That last point is the one that makes the tool interesting rather than merely convenient. Almost every tool in this space needs a registered application, an admin consent prompt and a service principal with a directory role, and the requirement of Global Reader is a permission you have to request from someone who can grant it. EntraFalcon instead uses first-party Microsoft applications with pre-consented scopes, so the consent step disappears.

What it looks for, and the six classes of finding

The README lists the classes of problem the tool is meant to uncover, and they are the ones that get missed in a busy tenant. Users with control over high-privilege groups or applications. External or internal enterprise applications with excessive permissions, for example Microsoft Graph API scopes or Azure roles. Users with Azure IAM role assignments directly on resources. Privileged accounts synced from on-premises. Inactive users or users without MFA capability. And unprotected groups used in sensitive assignments, such as Conditional Access exclusions, Subscription Owner, or eligible membership of a privileged group. Each of those is a plausible route to privilege that a human reviewer reading a role list would not necessarily connect, which is the case for automating the enumeration at all.

Over ninety checks with severity, impact and remediation

The tool performs more than 90 automated checks and summarises the results in a Security Findings Report. The report carries severity ratings, descriptions of the issue, potential threats and remediation guidance, and it lists affected objects with links directly to their detailed reports for further investigation. There is also basic impact, likelihood and risk scoring to highlight weakly protected high-privilege objects and to sort the data. The distinction between the two report layers is worth noting. The findings report is the answer to the question, with a severity and a fix, while the detailed per-object reports are where you go when you want to understand why an object was flagged.

The enumeration list shows what a full tenant pull looks like

The feature list enumerates the object types the tool collects, and the list is long enough to show the shape of a full tenant assessment. Users, including Agent Users. Groups. Enterprise Applications and App Registrations. Managed Identities. Agent identities, agent identity blueprint principals and agent identity blueprints. PIM assignments for Entra Roles, for Groups and for Azure Roles. Entra Role Assignments, Azure Role Assignments and Intune RBAC Assignments. Access Packages and Entitlement Management Catalogs. Catalog RBAC. Conditional Access Policies. Administrative Units. And PIM settings for Entra Roles and for Groups, the latter noted as BroCi auth only. The Agent-related object types are a sign of how recently this has been updated, and the presence of Intune RBAC assignments and Administrative Units shows it goes beyond the directory into the wider estate.

Cloning and running it takes two commands and one policy change

Downloading the tool is a clone and a directory change:

git clone https://github.com/CompassSecurity/EntraFalcon
cd EntraFalcon

The README then notes that you may need to temporarily change the PowerShell execution policy to run the script, and to only do this for trusted scripts:

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Process

The scope matters. `-Scope Process` means the change applies to the current session only and disappears when it ends, which is why the README's word is *temporarily*. The default flow needs no arguments at all:

.\run_EntraFalcon.ps1

And the flow can also be selected explicitly:

.\run_EntraFalcon.ps1 -AuthFlow BroCi

The README describes BroCi as using alternate first-party applications and requiring only one interactive sign-in, and it is useful when the Azure Active Directory PowerShell client requires assignment and must be avoided.

The requirements table is small and blunt. The Entra ID Role required is Global Reader, and it is mandatory, with the impact if missing given as not possible to run the scripts. The Azure Role is Reader on every Management Group or Subscription, and that one is optional, with the impact if missing being that you cannot assess Azure IAM assignments. Beyond the roles, you must be able to authenticate to the Microsoft Graph API and optionally the Azure ARM API from the device where you run the tool, and the README asks you to ensure that Conditional Access policies do not block your authentication. That last point is a real operational trap, since a tenant with strict CA on unmanaged devices can lock the assessor out of the very tooling meant to find that out.

Four full coverage flows, and three that are not

The `-AuthFlow` parameter selects the authentication method, and the README separates the flows into two tables. The recommended ones are BroCi, the default, for interactive Windows runs; BroCiManualCode for authentication in another browser; BroCiToken for an existing Azure Portal refresh token; and ServicePrincipal for automation and CI. All four give full coverage on Windows, Linux or macOS as the table shows. The README notes that BroCi uses one interactive login while BroCiToken and ServicePrincipal use none, and that fallback user flows may require multiple interactive logins because separate resource tokens are requested. The fallback flows, AuthCode, DeviceCode and ManualCode, are hidden in a details block and are partial coverage only, because the lack of pre-consented first-party applications means the fallback flows cannot perform the full enumeration of PIM for Groups, Access Packages and Catalogs.

BroCiManualCode is the flow for when the sign-in has to happen in a different browser, and the README describes its six steps. The script copies the authentication URL to the clipboard. You paste that URL into a browser, optionally on another device for SSO support. You open the browser developer tools, go to the Network tab and enable `Preserve log`. You complete the authentication. You search the network log for `code=1.` and copy the request URL containing the code to the clipboard. You press Enter and the script reads the code from the clipboard and completes token acquisition. The BroCiToken flow works the same way for a refresh token, using the client id `c44b4083-3bb0-49c1-b47d-974e53cbdf3c`, which the README tells you to find in the network log after authenticating at the Microsoft Entra portal:

.\run_EntraFalcon.ps1 -AuthFlow BroCiToken -BroCiToken "1.XXXXXXXXXXX"

It is worth reading the security implications of that instruction before running it. A refresh token extracted from a browser session is a bearer credential for the account, so it belongs in the same category as the password itself.

Where EntraFalcon is the wrong tool

Three limits are concrete. The first is that it is read-only in practice. The tool assesses and reports, but the README describes no remediation actions, so a finding about a Conditional Access exclusion or an over-permissioned enterprise application is something your team has to fix by hand, and in a large tenant that is where the effort lands. The second is the credential handling. Several of the flows, BroCiManualCode and BroCiToken in particular, involve extracting tokens from a browser session and moving them through the clipboard, which is convenient and is also a place where tokens end up in shell history and clipboard managers. The third is that a tool that enumerates an entire tenant and can reach Azure IAM, Intune and entitlement management needs to be run by someone you trust with Global Reader, and it produces an HTML report listing every privileged object you have. That is a sensitive artefact in its own right.

The alternative is the Graph API directly, and the difference is the interpretation

The realistic alternative is to script the Microsoft Graph API yourself with PowerShell and the Graph SDK, or to use the built-in Entra ID audit logs and the admin center reports. The difference in approach is interpretation. A direct Graph script gives you the raw objects and you decide what counts as a problem, which is exactly what you want if your threat model is specific and your query is precise. EntraFalcon gives you the objects plus more than 90 checks already written, with severity, impact, likelihood and remediation text attached, which is what you want when the assessment has to be repeated and defended to an auditor. The cost of the automation is the permission breadth, since the tool needs Global Reader to see everything it checks, and the cost of doing it yourself is that you have to keep the check logic current as Microsoft adds object types. The Graph SDK route also avoids the clipboard and refresh-token gymnastics, because the SDK handles interactive auth properly.

Editorial conclusion

EntraFalcon fits a pentester or security analyst who needs a repeatable, reportable Entra ID posture assessment across a tenant, and who would rather work from the built-in checks than write Graph queries. It is the wrong choice if you need remediation rather than findings, if your tenant's Conditional Access policy blocks assessor sign-ins, or if you cannot obtain Global Reader. Before you run it, confirm the Global Reader assignment exists, check that Conditional Access does not block your device, and use BroCiToken only if you treat the extracted refresh token as the account password it effectively is.

Frequently asked questions

Official sources

1. CompassSecurity/EntraFalcon on GitHub
2. Issues
3. License: MIT
4. README
5. Releases