Business info at outsidersecurity.nl . Introducing ROADtools - The Azure AD exploration framework . 15 minute read . Over the past 1.5 years I’ve been doing quite a lot of exploration into Azure AD and how it works under the hood. So I set myself a few goals: - Provide tooling for both Red teams and Blue teams to explore all Azure AD data in an accessible way. Use asynchronous HTTP calls in Python to dump all available information in the Azure AD graph to this database. Where to get the data . Since Azure AD is a cloud service, there isn’t a way to reverse engineer how it works, or a central repository where all the data is stored that you can access. While researching Azure and looking through the requests in the Azure Portal, at some point I noticed that the portal was calling a different version of the Azure AD Graph, the 1.61-internal version. This internal version of the Azure AD graph exposes much more data than any of the official API’s that are offered by Microsoft. To create the object structure, ROADrecon uses the OData metadata definition that the Azure AD graph exposes. ROADrecon will by default pretend to be the Azure AD PowerShell module and will thus inherit its permissions to access the internal version of the Azure AD graph. Gathering all the data . The second step is data gathering, which the roadrecon gather command does. That being said, there is a setting in the deprecated MSOnline PowerShell module which prevents enumeration using the Azure AD graph, which is documented here