Skip to content
Get packs

Attacking Entra ID with ROADtools

Enumerate Microsoft Entra ID tenants and abuse tokens during authorized red-team tests

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
4 files

What it does

This skill teaches an AI agent to use two open-source offensive security tools, ROADrecon and roadtx, against Microsoft Entra ID (formerly Azure AD), the identity system behind many Microsoft cloud accounts. Once installed, the agent can walk a security tester through authenticating to a tenant, pulling the full directory of users, groups, roles, apps and conditional-access policies into a local database, and exploring token exchanges and device-registration steps. It is intended only for authorized penetration tests and red-team exercises, and the skill itself repeatedly warns that unauthorized access is illegal.

Great for

  • Security professionals running an authorized Entra ID or Azure red-team engagement
  • Students learning cloud identity attack techniques in a lab tenant they own
  • Blue-team engineers validating that conditional-access and token controls hold up

Skip it if

  • Anyone testing a tenant without written authorization, since this is illegal unauthorized access to cloud accounts
  • General users wanting to manage Microsoft 365 or Entra ID settings, because this skill covers attack tooling, not administration
  • Use against production tenants without a defined scope and rules of engagement, since device registration and token minting can change real identity state

Try asking

  • “Help me plan an authorized Entra ID assessment and walk through gathering the tenant directory with ROADrecon”
  • “Show me how to run roadrecon plugin policies to review our conditional-access rules in a test tenant”
  • “Explain how a refresh token can be exchanged for a Microsoft Graph token with roadtx, for my red-team report”
  • “Run the agent.py recon wrapper against our authorized lab tenant and summarize the directory”
Step-by-step guide: how to use Attacking Entra ID with ROADtoolsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.

    attacking-entra-id-with-roadtools.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip attacking-entra-id-with-roadtools.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip attacking-entra-id-with-roadtools.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Confirm written scope and authorization before any command, and keep the agent limited to the agreed tenant and accounts.
  • Prefer the device-code flow for accounts with MFA, and use a dedicated test account where possible so you can attribute and clean up activity.
  • Review the agent.py wrapper and its outputs (.roadtools_auth holds live tokens) and delete credential files after the engagement.

What's inside

  • references/api-reference.md
  • references/standards.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.