Skip to content
Get packs

Auditing Entra ID with AADInternals

Runs AADInternals to test Microsoft Entra ID tenant exposure and AD FS Golden SAML resilience during authorized assessments.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
4 files

What it does

Once installed, the agent can drive AADInternals, a PowerShell toolkit for Microsoft Entra ID (formerly Azure AD) and AD FS, to run a structured identity security assessment. It walks through unauthenticated reconnaissance of a domain's tenant and federation settings, optional user enumeration, token acquisition for Microsoft APIs, directory enumeration with a valid token, and checks of whether federation signing certificates would allow Golden SAML forgery. It then helps document findings and hardening recommendations. It is built for authorized red-team and defensive validation work, not general use.

Great for

  • Security consultants running an authorized Entra ID or Microsoft 365 red-team engagement
  • Blue teams validating that AD FS token-signing certificates are protected against Golden SAML
  • Detection engineers who need realistic AADInternals telemetry to build alerts

Skip it if

  • Testing any tenant you do not own or lack written authorization for, since the toolkit can forge SAML tokens and install persistent federation backdoors (legal and safety risk)
  • Casual or beginner use, because it assumes familiarity with SAML, OAuth tokens and Azure AD Connect and requires Global Administrator rights for the backdoor tests

Try asking

  • “Run outsider reconnaissance on target.com to list its tenant ID, federation type and SSO status (authorized engagement)”
  • “Check whether a tenant's AD FS token-signing certificate is protected against Golden SAML and write up the evidence”
  • “Enumerate which domains are federated and recommend hardening for the federation configuration”
  • “Map which Microsoft APIs a low-privileged token can reach and document the exposure”
Step-by-step guide: how to use Auditing Entra ID with AADInternalsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.

    auditing-entra-id-with-aadinternals.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip auditing-entra-id-with-aadinternals.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip auditing-entra-id-with-aadinternals.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Confirm written scope and rules of engagement before any command runs; keep federation-backdoor tests inside the approved window
  • Start with the no-credential outsider recon steps, which only query public Microsoft endpoints, before moving to authenticated steps
  • Ask the agent to log every cmdlet and output for the evidence package and to recommend remediation rather than exploit further

What's inside

  • references/api-reference.md
  • references/standards.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.