# Auditing Azure Active Directory Configuration

> Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, and guest user risks.

- Skill: `owasp/auditing-azure-active-directory-configuration` (Agent Skill)
- Install (CLI): `npx skillmds@latest add owasp/auditing-azure-active-directory-configuration`
- Raw SKILL.md: https://api.skillmd.com/api/skills/owasp/auditing-azure-active-directory-configuration/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: Apache-2.0
- Author: OWASP (https://skillmd.com/u/owasp)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/owasp/auditing-azure-active-directory-configuration

---


# Auditing Microsoft Entra ID Configuration

## When to Use
- When performing a security assessment of an Azure tenant's identity configuration.
- When validating if Conditional Access policies adequately protect against identity-based attacks.
- When investigating suspicious sign-in activity or compromised accounts.
- When auditing privileged role assignments (Global Admins, etc.) for least privilege.

## Key Concepts

| Term | Definition |
|------|------------|
| Conditional Access | Policy engine used to enforce MFA and device compliance |
| Security Defaults | Microsoft's baseline security settings for all tenants |
| PIM | Privileged Identity Management, for just-in-time role elevation |
| Legacy Auth | Older protocols (IMAP/POP3) that do not support MFA |

## OpenShield Identity Rules

OpenShield automates these audit steps:
- **MFA**: `AZ-IDN-002` (Admin MFA), `AZ-IDN-007` (User MFA)
- **Roles**: `AZ-IDN-001` (SP Owner), `AZ-IDN-005` (Guest Admin)
- **Management**: `AZ-IDN-004` (Missing PIM), `AZ-IDN-009` (Assignment Alerts)

## Audit Workflow

### Step 1: Baseline Check
Check if Security Defaults are enabled or if Conditional Access is covering all users.

### Step 2: Privileged Roles Audit
List all Global Administrators and ensure they have PIM enabled and MFA enforced.

### Step 3: Guest User Review
Identify guest users with high-privilege directory or subscription roles.

## Remediation Reference
- **Block Legacy Auth**: Ensure Conditional Access policies explicitly block legacy authentication protocols.
- **Enable PIM**: Migrate permanent admin assignments to eligible PIM assignments.
- **Restrict App Consent**: Disable the ability for users to consent to apps requesting sensitive data.