Skip to content
View Dfrank77's full-sized avatar
2 followers · 2 following

Achievements

Achievement: Pull Shark

Achievements

Achievement: Pull Shark

Block or report Dfrank77

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
Dfrank77/README.md

Darius Frank

I work in IAM and cloud security and build open-source Entra ID security tooling.

Portfolio: dfrank-iam.com

Open Source

Contributor to Maester, the open-source Entra/M365 security testing framework.

PR What it does Status
#2395 MT.1224: Microsoft-managed CA policies left in report-only Merged
#2403 MT.1210: PIM-eligible roles on agent users Merged
#2434 MT.1223: Application.ReadUpdate.All as high-risk agent permission Merged
#2436 MT.1206: server-side filter for agent sign-in activity Merged
#2496 MT.1022/MT.1023: license gap and risk-based CA coverage Merged
#2506 MT.1252: Exchange RBAC for Applications overlap with tenant-wide Graph grants Merged

Entra ID Security Suite

Tool What it does
entra-blast-radius Compute an identity's full reachable privilege set, ranked worst-first
entra-attack-path-visualizer Detect privilege escalation paths through roles, groups, and PIM
entra-zt-policy-engine Audit Conditional Access against CIS benchmarks, deploy fixes via Terraform
entra-workload-identity-scanner Audit app registrations and service principals for overprivilege and stale credentials
entra-orchestrator Correlate findings across all scanners into one report
entra-security-report Shared findings model and HTML renderer used by the suite

All tools run against any Entra ID tenant via Microsoft Graph with delegated permissions. Each tool runs against a test tenant I seeded with Terraform to simulate realistic scale.

Stack

Python, PowerShell, Pester, Microsoft Graph API, Terraform (azuread provider), aiohttp, NetworkX

Links

Pinned Loading

  1. entra-blast-radius entra-blast-radius Public

    Compute an Entra ID identity's blast radius: everything it can reach - roles, nested groups, PIM-eligible, owned apps - ranked worst-first.

    Python

  2. entra-orchestrator entra-orchestrator Public

    Cross-tool correlation engine for the Entra ID security suite — joins findings across three scanners to surface risks no single tool detects.

    Python 2

  3. entra-attack-path-visualizer entra-attack-path-visualizer Public

    Automated detection of privilege escalation paths in Microsoft Entra ID

    Python

  4. entra-zt-policy-engine entra-zt-policy-engine Public

    Zero Trust Conditional Access policy engine for Microsoft Entra ID. Audits existing policies against CIS benchmarks and deploys gap-closing policies via Terraform.

    HTML

  5. entra-workload-identity-scanner entra-workload-identity-scanner Public

    Scans Entra ID app registrations and service principals for overprivileged permissions, expired credentials, ownerless apps, and stale workload identities. Emits a self-contained HTML report.

    Python 1

  6. entra-security-report entra-security-report Public

    Shared findings model, storage, and HTML renderer for the Entra ID security suite"

    Python