// tools/attack-paths

Attack Path Explorer

Attackers rarely go straight for a Global Administrator. They take over something smaller that leads there: an app owner without MFA, a guest who owns a role-assignable group, an app with one dangerous Graph permission. This tool maps every route like that in your tenant, shows you how an attacker would walk each one, and lets you cut links to see which fix closes the most paths.

The script only reads. Its output is read in your browser and never uploaded.

Download the script. Get-AzureBlogAttackPaths.ps1 It reads Entra role assignments (active and PIM-eligible), the groups that hold roles with their owners and members, every app with Microsoft Graph application permissions with its owners and secrets, and MFA registration. It changes nothing.

Run it in PowerShell 7. A Global Reader can run it:

powershell3 lines

1
2
3Install-Module Microsoft.Graph.Authentication -Scope CurrentUser   # first time only
.\Get-AzureBlogAttackPaths.ps1
# options: -TenantId <guid>  -OutputFolder C:\Reports  -SkipMfa

Load the result here. It saves azureblog-attack-paths-<date>.json. It holds names, sign-in names and app names, so treat it as sensitive and delete it when you're done.

Drop your azureblog-attack-paths-….json file here

choose file

How it decides what leads where

Each link means "whoever controls this can take control of that". The tool works backwards from Global Administrator and keeps the shortest route from each way in.

Link	Why it counts
Holds or is eligible for a role	Active assignments count straight away. PIM-eligible ones count too, because the holder can activate them. Assignments scoped to an administrative unit are left out.
Member or owner of a group that holds a role	Members get the group's roles. Owners can add anyone, including themselves.
Owner of an app	Owners of an app registration or service principal can add a secret and sign in as the app.
Application Administrator, Cloud Application Administrator	Can add credentials to any app and use its permissions, as Microsoft's role reference describes.
Privileged Role Administrator	Can assign any role, including Global Administrator.
Privileged Authentication Administrator	Can reset passwords and MFA methods for any user, including Global Administrators.
Hybrid Identity Administrator, Domain Name Administrator	Can change federation, sync or domain settings that an attacker can use to sign in as other users.
Authentication, Helpdesk, User and Password Administrators	Can reset passwords for users without admin roles, so they reach anything those users own.
Graph permissions	`RoleManagement.ReadWrite.Directory`, `AppRoleAssignment.ReadWrite.All`, `UserAuthenticationMethod.ReadWrite.All` and `Domain.ReadWrite.All` lead to Global Administrator. `Application.ReadWrite.All` leads to every other app.

Ways in

Accounts with no MFA registered are the likeliest, then guests, apps with secrets or certificates, third-party apps and accounts synced from on-premises AD. Every other account is scored as phishable. Accounts named as break-glass or emergency access are left out.

This is a model, not a penetration test. It doesn't know about Conditional Access, PIM approval settings or custom roles, so treat each path as "worth checking", and use it to decide what to fix first. Check each role in Microsoft Entra built-in roles and each permission in the Microsoft Graph permissions reference, or with the app permission risk check and Access Map. The sample tenant is made up: contoso.com and every name in it are fictional.