Az PowerShell
Need credentials or some kind or token from here on out.
Az PowerShell
Az PowerShell is a module from Microsoft for managing Azure resources. Please note that if the module is not present on your machine, you can use Install-Module Az command (needs internet).
"The Azure Az PowerShell module is a rollup module. Installing it downloads the generally available Az PowerShell modules, and makes their cmdlets available for use."
Using credentials from command line (PSCredential object and access tokens can be used too)
Az PowerShell can enumerate both Entra ID and Azure Resources. All the Entra ID cmdlets have the format -AzAD.
Cmdlets for other Azure resources have the format Az
Find cmdlets for a particular resource. For example, VMs
Az PowerShell — Enumeration
Get the information about the current context (Account, Tenant, Subscription etc.)
List all available contexts
Enumerate subscriptions accessible by the current user
Enumerate all resources visible to the current user
Enumerate all Azure RBAC role assignments
Az PowerShell — AAD Users
Enumerate all users
Enumerate a specific user
Search for a user based on string in first characters of DisplayName (wildcard not supported)
Search for users who contain the word “admin” in their Display name:
Az PowerShell — AAD Groups
List all groups
Enumerate a specific group
Search for a group based on string in first characters of DisplayName (wildcard not supported)
To search for groups which contain the word "admin" in their name
Get members of a group
Az PowerShell — AAD Apps
Get all the application objects registered with the current tenant (visible in App Registrations in Azure portal). An application object is the global representation of an app.
Get all details about an application
Get an application based on the display name
The Get-AzADAppCredential will show the applications with an application password, but password value is not shown. List all the apps with an application password.
Az PowerShell — AAD Service Principals
Enumerate Service Principals (visible as Enterprise Applications in Azure Portal). Service principal is local representation for an app in a specific tenant, and it is the security object that has privileges. This is the 'service account'! Service Principals can be assigned Azure roles.
Get all service principals
Get all details about a service principal
Get a service principal based on the display name
Az PowerShell — Using Tokens with CLI
Both Az PowerShell and AzureAD modules allow the use of Access tokens for authentication. Usually, tokens contain all the claims (including that for MFA and Conditional Access etc.) so they are useful in bypassing such security controls.
If you are already connected to a tenant, request an access token for resource manager (ARM)
Request an access token for Microsoft Graph to access Entra ID. Supported tokens - AadGraph, AnalysisServices, Arm, Attestation, Batch, DataLake, KeyVault, MSGraph, OperationalInsights, ResourceManager, Storage, Synapse
From older versions of Az PowerShell, get a token for Microsoft Graph
Use the access token
Get all details about a service principal
Use other access tokens. In the below command, use the one for MSGraph (access token is still required) for accessing Entra ID
Az PowerShell — Stealing Tokens
Az PowerShell (older versions) stores access tokens in clear text in TokenCache.dat in the directory C:\Users[username].Azure. It also stores ServicePrincipalSecret in clear-text in AzureRmContext.json if a service principal secret is used to authenticate. Another interesting method is to take a process dump of PowerShell and looking for tokens in it! Users can save tokens using Save-AzContext, look out for them! Search for Save-AzContext in PowerShell console history!
Always use Disconnect-AzAccount!!
If you are already connected to a tenant, request an access token for resource manager (ARM)
Request an access token for Microsoft Graph to access Entra ID. Supported tokens - AadGraph, AnalysisServices, Arm, Attestation, Batch, DataLake, KeyVault, MSGraph, OperationalInsights, ResourceManager, Storage, Synapse
From older versions of Az PowerShell, get a token for Microsoft Graph
Use the access token
Get all details about a service principal
Use other access tokens. In the below command, use the one for MSGraph (access token is still required) for accessing Entra ID
Last updated