# Azure-AccessPermissions | Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory

**URL:** <https://onehack.st/t/azure-accesspermissions-easy-to-use-powershell-script-to-enumerate-access-permissions-in-an-azure-active-directory/242713>\
**Category:** Tools & Scripts\
**Tags:** tools, technology\
**Created:** [June 4, 2023, 12:48pm UTC](https://onehack.st/t/azure-accesspermissions-easy-to-use-powershell-script-to-enumerate-access-permissions-in-an-azure-active-directory/242713 "2023-06-04T12:48:39Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [June 4, 2023, 12:48pm UTC](https://onehack.st/t/azure-accesspermissions-easy-to-use-powershell-script-to-enumerate-access-permissions-in-an-azure-active-directory/242713/1 "2023-06-04T12:48:40Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/6/1/61ed3ee60893cb237c6236f4ad22b24513ca20c4.jpeg)

# Azure-AccessPermissions

Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory environment.

Background details can be found in the accompanied blog posts:

- [Untangling Azure Active Directory Principals & Access Permissions](https://csandker.io/2022/10/19/Untangling-Azure-Permissions.html)
- [Untangling Azure Active Directory Permissions II: Privileged Access](https://csandker.io/2022/11/10/Untangling-Azure-II-Privileged-Access.html)

## Requirements

To run this script you’ll need these two PowerShell modules:

- [Microsoft.Graph](https://github.com/microsoftgraph/msgraph-sdk-powershell)
- [AADInternals](https://github.com/Gerenios/AADInternals)
- [AzureADPreview](https://learn.microsoft.com/en-us/powershell/azure/active-directory/install-adv2?view=azureadps-2.0)

All of these can be installed directly within PowerShell:

PS:\> Install-Module Microsoft.Graph PS:\> Install-Module AADInternals PS:\> Install-Module AzureADPreview

## Usage

### First time use

The script uses a browser-based Login UI to connect to Azure. If you run the tool for the first time you might experience the following error

[\*] Connecting to Microsoft Graph… WARNING: WebBrowser control emulation not set for PowerShell or PowerShell ISE! Would you like set the emulation to IE 11? Otherwise the login form may not work! (Y/N): Y Emulation set. Restart PowerShell/ISE!

[![Error on first run](https://github.com/csandker/Azure-AccessPermissions/raw/master/img/first-run-error.png)](https://github.com/csandker/Azure-AccessPermissions/blob/master/img/first-run-error.png)

To solve this simply allow PowerShell to emulate the browser and rerun your command.

### Example use

Import and run, no argumentes needed.

_Note: On your first run you will likely have to authenticate twice (once Microsoft Graph and once against Azure AD Graph). I might wrap this into a single login in the future…_

PS:\> Import-Module .\Azure-AccessPermissions.ps1

[![SampleOutput](https://github.com/csandker/Azure-AccessPermissions/raw/master/img/sample_output1.png)](https://github.com/csandker/Azure-AccessPermissions/blob/master/img/sample_output1.png)

[![SampleOutput](https://github.com/csandker/Azure-AccessPermissions/raw/master/img/sample_output2.png)](https://github.com/csandker/Azure-AccessPermissions/blob/master/img/sample_output2.png)

## GitHub:

> **[GitHub - csandker/Azure-AccessPermissions](https://github.com/csandker/Azure-AccessPermissions)**
>
> Contribute to csandker/Azure-AccessPermissions development by creating an account on GitHub.