Checklist

Entra / Azure Test

• Pingcastle Entra ID Scan to look for overly-permissive applications
• Identity & policy enumeration (ROADtools) for
  • Synced Admin Accounts & non Admin Accounts with Entra Roles
  • Test for Device Code Flow Authentication Flow Login
• Attack-path data collection (AzureHound) for Entra / Azure Attack Path Enumeration
• Privileged Identity Management (PIM) active?
  • directly assigned Roles
• Conditional Access Policies audit
  • Admin Accounts without phishing resistant MFA
  • Use of Privileged Access Workstations (PAWs)
  • Device Code Flow Login
  • Legacy Authentication
  • MFA for all Users
  • MFA usage Break-Glass-Account?
  • Exclusions from CA Policies
• External / Partner Permissions for Access on Tenant?
  • https://learn.microsoft.com/en-us/partner-center/customers/customers-revoke-admin-privileges
  • https://docs.azure.cn/en-us/entra/identity/users/directory-delegated-administration-primer
  • https://www.manageengine.com/microsoft-365-management-reporting/blogs/gdap-for-m365-msps.html
• Azure Resource / Resource Group Permissions
  • Azure Arc
• Guest User / Invitation Policy
• Self Service Password Reset Config
• Sysleaks
• Entra Portal Access for standard Users
• Dynamic Groups
• Intune Configuration
• Sensitive Files on Sharepoint