[Authenticated][Information Gathering] Manual Azure enumeration using Azure Az Powershell Module


The Az PowerShell module is a set of cmdlets for managing Azure resources directly from PowerShell. PowerShell provides powerful features for automation that can be leveraged for managing your Azure resources, for example in the context of a CI/CD pipeline.

The Az PowerShell module is the replacement for AzureRM and is the recommended module to use for interacting with Azure.


  • Account credentials

How to Use

1. Install the Powershell module

  • Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force

2. List the help menu

  • Get-Help Az

3. Connect to Azure Cloud

  • Connect-AzAccount

Note: You can also authenticate using credentials

  • $credentials = Get-Credential
  • Connect-AzAccount -Credential $credentials

4. Once logged in, you are displayed Account, SubscriptionName, TenantId, Environment

Enumerate current Context


1. This cmdlet gets the Active Directory account, Active Directory tenant, Azure subscription, and the targeted Azure environment. Azure Resource Manager cmdlets use these settings by default when making Azure Resource Manager requests.

  • Get-AzContext -ListAvailable


The Get-AzSubscription cmdlet gets the subscription ID, subscription name, and home tenant for subscriptions that the current account can access.

  • Get-AzSubscription


Use the Get-AzRoleAssignment command to list all role assignments that are effective on a scope. Without any parameters, this command returns all the role assignments made under the subscription. This list can be filtered using filtering parameters for principal, role and scope.

  • Get-AzRoleAssignment


The Get-AzResource cmdlet gets Azure resources.

  • Get-AzResource


The Get-AzResourceGroup cmdlet gets Azure resource groups in the current subscription. You can get all resource groups, or specify a resource group by name or by other properties. By default, this cmdlet gets all resource groups in the current subscription. For more information about Azure resources and Azure resource groups, see the New-AzResourceGroup cmdlet.

  • Get-AzResourceGroup


The Get-AzStorageAccount cmdlet gets a specified Storage account or all of the Storage accounts in a resource group or the subscription.

  • Get-AzStorageAccount


The Get-AzWebApp cmdlet gets information about an Azure Web App.

  • Get-AzWebApp


The Get-AzAutomationAccount cmdlet gets Azure Automation accounts in a resource group.

  • Get-AzAutomationAccount


The Get-AzVirtualNetwork cmdlet gets one or more virtual networks in a resource group.

  • Get-AzVirtualNetwork


The Get-AzPublicIPAddress cmdlet gets one or more public IP addresses in a resource group.

  • Get-AzPublicIPAddress


Gets a vpn connection by name or lists all vpn connections connected to a VpnGateway.

  • Get-AzVpnConnection



[Authenticated][Information Gathering] Manual Azure Active Directory enumeration using AzureAD Powershell Module


Azure Active Directory PowerShell for Graph (Azure AD PowerShell) is a module IT Pros commonly use to manage their Azure Active Directory. The cmdlets in the Azure AD PowerShell module enable you to retrieve data from the directory, create new objects in the directory, update existing objects, remove objects, as well as configure the directory and its features.


Authenticated account


1. In order to install AzureAD run this command

  • Install-Module -Name AzureAD -Scope CurrentUser -Repository PSGallery -Force

2. List the module’s cmdlets

  • Get-Command -Module AzureAD

3. Display cmdlet help

  • Get-Help Connect-AzureAD -Detailed
  • Get-Help <cmdlet name> -Examples
  • Get-Help <cmdlet name> -Full


1. Connect to the Cloud

  • Connect-AzureAD


The Get-AzureADDomain cmdlet gets a domain in Azure Active Directory (AD).

  • Get-AzureADDomain


The Get-AzureADUser cmdlet gets a user from Azure Active Directory (AD).

  • Get-AzureADUser
  • Get-AzureADUser -Filter <String>


The Get-AzureADGroup cmdlet gets a group in Azure Active Directory (AD).

  • Get-AzureADGroup


The Get-AzureADDirectoryRole cmdlet gets a directory role from Azure Active Directory (AD).

  • Get-AzureADDirectoryRole


The Get-AzureADDirectoryRoleMember cmdlet gets the members of a directory role in Azure Active Directory (AD).

  • Get-AzureADDirectoryRoleMember -ObjectId "<object-id>"


The Get-AzureADApplication cmdlet gets an Azure Active Directory application.

  • Get-AzureADApplication


The Get-AzureADApplicationOwner cmdlet get an owner of an Azure Active Directory application. Using the object-id of the application (Get-AzureADApplication)

  • Get-AzureADApplicationOwner -ObjectId "<object-id>"


The Get-AzureADApplicationPasswordCredential cmdlet gets the password credentials for an Azure Active Directory application. Using the object-id of the application (Get-AzureADApplication)

  • Get-AzureADApplicationPasswordCredential -ObjectId "<object-id>"




[Authenticated][Information Gathering] Automated Microsoft 365 Office enumeration using o365recon



Script to retrieve information via O365 and AzureAD with a valid credential. You can run it either in Windows Powershell or Linux Powershell.


Authenticated Account


1. Install these two modules

  • Install-Module -Name MSOnline -Scope CurrentUser -Repository PSGallery -Force
  • Install-Module -Name AzureAD -Scope CurrentUser -Repository PSGallery -Force

2. Download the script into you machine

  • git clone https://github.com/nyxgeek/o365recon.git
  • cd o365recon
  • ls

How to use

Connect to the cloud

  • o365recon.ps1 -azure
  • .\o365recon.ps1 -all -outputfile result.txt


It provides us with detailed information about the azure environment



[Authenticated][Information Gathering] Automated Azure Active Directory enumeration using ROADtools


ROADtools (Rogue Office 365 and Azure (active) Directory tools)

ROADtools is a framework to interact with Azure AD. It consists of a library (roadlib) with common components, the ROADrecon Azure AD exploration tool and the ROADtools Token eXchange (roadtx) tool.


ROADlib is a library that can be used to authenticate with Azure AD or to build tools that integrate with a database containing ROADrecon data. The database model in ROADlib is automatically generated based on the metadata definition of the Azure AD internal API. ROADlib lives in the ROADtools namespace, so to import it in your scripts use

  • from roadtools.roadlib import X


ROADrecon is a tool for exploring information in Azure AD from both a Red Team and Blue Team perspective. In short, this is what it does:

  • Uses an automatically generated metadata model to create an SQLAlchemy backed database on disk.
  • Use asynchronous HTTP calls in Python to dump all available information in the Azure AD graph to this database.
  • Provide plugins to query this database and output it to a useful format.
  • Provide an extensive interface built in Angular that queries the offline database directly for its analysis.
  • ROADrecon uses async Python features and is only compatible with Python 3.7 and newer (development is done with Python 3.8, tests are run with versions up to Python 3.11).


Authenticated Account


There are multiple ways to install ROADrecon:

Using a published version on PyPi

Stable versions can be installed with pip install roadrecon. This will automatically add the roadrecon command to your PATH.

Using a version from GitHub

Every commit to master is automatically built into a release version with Azure Pipelines. This ensures that you can install the latest version of the GUI without having to install npm and all it's dependencies. You can download the roadlib and roadrecon build files from the Azure Pipelines artifacts (click on the button "1 Published". The build output files are stored in ROADtools.zip. You can either install the .whl or .tar.gz files directly using pip or unzip both and install the folders in the correct order (roadlib first):

  • pip install roadlib/
  • pip install roadrecon/

You can also install them in development mode with pip install -e roadlib/.

Developing the front-end

If you want to make changes to the Angular front-end, you will need to have node and npm installed. Then install the components from git:

  • git clone https://github.com/dirkjanm/roadtools.git
  • pip install -e roadlib/
  • pip install -e roadrecon/
  • cd roadrecon/frontend/
  • npm install

You can run the Angular frontend with npm start or ng serve using the Angular CLI from the roadrecon/frontend/ directory. To build the JavaScript files into ROADrecon's dist_gui directory, run npm build

How to use

1. You can also run the main script to run reoad recon

  • cd /roadtools/roadrecon/roadtools/roadrecon
  • python3 main.py -h

2. Display the argument options

  • python3 main.py auth -h

Start enumeration


To authenticate use the auth module, this command will authenticate a create a token

  • roadrecon auth -u <azure_username> -p <password>

Gather information

Once authenticated we can proceed to gather information about Azure, it will save the results in a database

  • roadrecon gather

Start GUI

1. After the information has been gather, we can start the GUI

  • roadrecon gui

2. Connect to the GUI visiting


1. Enumerate users’ information such as username, account type, email, last password change, etc

2. If you click on a user you can verify the Groups, Roles, Owned Objects, Raw data


You can also enumerate groups and their details such as members and general information


Enumerate the devices name, status, OS, trust type


Enumerate rols Principal Name, type, userPrincipalName, status


Enumerate applications name, multitenant status, home page, authentication, owners

Service Principals

Enumerate Service principals name, type, publisher, status

Applications Roles

Enumerate application roles name, type, application, role, description


Enumerate OAuth2 Approval type, principal name, Source & target application, scope




[Password Spray] Office Microsoft Online accounts (Azure/O365)


A password spraying tool for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.


This tool not only is looking for valid passwords, but also the extremely verbose information Azure AD error codes give you. These error codes provide information relating to if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, if the account is disabled, if the password is expired and much more.

So this doubles, as not only a password spraying tool but also a Microsoft Online recon tool that will provide account/domain enumeration. In limited testing it appears that on valid login to the Microsoft Online OAuth2 endpoint it isn't auto-triggering MFA texts/push notifications making this really useful for finding valid creds without alerting the target.


  • Existing user account
  • List of password samples to spray

How to Use

1. Download the tool

  • git clone https://github.com/dafthack/MSOLSpray.git

2. Import the module into powershell

  • Import-Module .\MSOLSpray.ps1

3. Display help menu

  • Get-Help Invoke-MSOLSpray

This module will perform password spraying against Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.

Note: Invoke-MSOLSpray [[-OutFile] <String>] [[-UserList] <String>] [[-Password] <String>] [[-URL] <String>] [[-Force]] [<CommonParameters>]

4. Get full help description

  • Get-Help Invoke-MSOLSpray –Detailed

5. Invoke-MSOLSpray Options

  • UserList - UserList file filled with usernames one-per-line in the format "user@domain.com"
  • Password - A single password that will be used to perform the password spray.
  • OutFile - A file to output valid results to.
  • Force - Forces the spray to continue and not stop when multiple account lockouts are detected.
  • URL - The URL to spray against. Potentially useful if pointing at an API Gateway URL generated with something like FireProx to randomize the IP address you are authenticating from.


1. Spray a known password

  • Invoke-MSOLSpray -UserList <userlist.txt> -Password <password>

2. The URL to spray against. Potentially useful if pointing at an API Gateway URL generated with something like FireProx to randomize the IP address you are authenticating from.

  • Invoke-MSOLSpray -UserList <userlist.txt> -Password <password> -URL <url>



[Unauthenticated][Information Gathering] OneDrive user enumeration


OneDrive users have a file share URL with a known location:


In this instance, the username is 'lightmand' and the domain is 'acmecomputercompany.com'. If a user has logged into OneDrive, this path will exist and return a 403 status code. If they have not, or the user is invalid, it will return a 404.

The results may vary depending on how widely used OneDrive is within an org. Currently it is the most reliable user-enumeration method that I'm aware of (office365userenum no longer works, and the others like UhOh365 are unreliable). Further, it does not attempt a login and is much more passive, and should be undetectable to the target org. Microsoft will see the hits, but the target org won't.


  • Tenant name
  • Username or user list <found usernames>
  • Domain name

How to Use

1. Download the tool

  • git clone https://github.com/nyxgeek/onedrive_user_enum.git

2. Install requirements

  • pip3 install -r requirements.txt

3. Display menu

  • python3 ./onedrive_enum.py -h


1. Run basic OneDrive user enumeration

  • python3 onedrive_enum.py -U <user_list> -d <domain.onmicrosoft.com> -v

2. example - basic usage

  • ./onedrive_enum.py -t microsoft -d microsoft.com -U USERNAMES/statistically-likely/jsmith.txt

3. example - mysql db logging

  • ./onedrive_enum.py -t microsoft -d microsoft.com -U USERNAMES/statistically-likely/jsmith.txt -m db.conf

4. Set Threads

  • python3 onedrive_enum.py -U <user_list> -d <domain.onmicrosoft.com> -v -T100