# cloud-architekt/azuread-attack-defense architecture

> Architecture diagram of the GitHub repository cloud-architekt/azuread-attack-defense, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cloud-architekt/azuread-attack-defense
- Repository: https://github.com/cloud-architekt/azuread-attack-defense

## Overview

This repository is a static Microsoft Entra ID attack-and-defense playbook, not an executable service. Security practitioners use its scenario chapters to understand attacks, review detection and mitigation guidance, and map scenarios and detections to MITRE ATT&CK. Supporting assets include KQL detections, analyzer configuration and deployment templates, and ATT&CK mapping data. The README documents these relationships; no source excerpts were provided, so the graph does not infer runtime calls or execution order.

Main entry points: [`README.md`](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/README.md) (Playbook overview), [`AADSecurityConfigAnalyzer.md`](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/AADSecurityConfigAnalyzer.md) (Config analyzer), [`PasswordSpray.md`](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/PasswordSpray.md) (Password spray), [`ConsentGrant.md`](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/ConsentGrant.md) (Consent grants)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_chapters["Scenario chapters"]
  node_spray["Password spray<br/>[PasswordSpray.md]"]
  node_consent["Consent grants<br/>[ConsentGrant.md]"]
  node_ado["ADO service principals"]
  node_sync["Sync service account"]
  node_prt["Token replay"]
  node_aitm["AiTM attacks"]
  node_syncaba["Sync app auth<br/>[EntraSyncAba.md]"]
  node_monitoring["Identity monitoring"]
  node_lateral["Lateral movement"]
end

subgraph group_detections["Detection content"]
  node_queryset["Detection queries"]
  node_ruletemplates["Rule templates"]
end

subgraph group_analyzer["Analyzer configuration"]
  node_analyzerchapter["Config analyzer"]
  node_analyzerconfig["Analyzer settings"]
  node_deployment["Analyzer deployment"]
end

subgraph group_mapping["ATT&amp;CK mapping"]
  node_attackmaps["Attack scenario maps"]
  node_rulemaps["Detection rule maps"]
end

node_practitioner(("Security practitioner"))
node_readme["Playbook overview<br/>[README.md]"]

node_practitioner -->|"uses"| node_readme
node_readme -->|"links chapter"| node_spray
node_readme -->|"links chapter"| node_consent
node_readme -->|"links chapter"| node_ado
node_readme -->|"links chapter"| node_sync
node_readme -->|"links chapter"| node_prt
node_readme -->|"links chapter"| node_aitm
node_readme -->|"links chapter"| node_syncaba
node_readme -->|"links appendix"| node_monitoring
node_readme -->|"links appendix"| node_lateral
node_readme -->|"links chapter"| node_analyzerchapter
node_readme -->|"provides detections"| node_queryset
node_readme -->|"describes templates"| node_ruletemplates
node_readme -->|"maps scenarios"| node_attackmaps
node_readme -->|"maps detections"| node_rulemaps
node_analyzerchapter -.->|"documents settings"| node_analyzerconfig
node_analyzerchapter -.->|"documents deployment"| node_deployment

click node_readme "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/README.md"
click node_spray "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/PasswordSpray.md"
click node_consent "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/ConsentGrant.md"
click node_ado "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/ServicePrincipals-ADO.md"
click node_sync "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/AADCSyncServiceAccount.md"
click node_prt "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/ReplayOfPrimaryRefreshToken.md"
click node_aitm "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/Adversary-in-the-Middle.md"
click node_syncaba "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/EntraSyncAba.md"
click node_monitoring "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/IdentitySecurityMonitoring.md"
click node_lateral "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/LateralMovementADEID.md"
click node_queryset "https://github.com/cloud-architekt/azuread-attack-defense/tree/main/queries"
click node_ruletemplates "https://github.com/cloud-architekt/azuread-attack-defense/tree/main/config/ruletemplates"
click node_analyzerchapter "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/AADSecurityConfigAnalyzer.md"
click node_analyzerconfig "https://github.com/cloud-architekt/azuread-attack-defense/tree/main/config"
click node_deployment "https://github.com/cloud-architekt/azuread-attack-defense/tree/main/config/deploy"
click node_attackmaps "https://github.com/cloud-architekt/azuread-attack-defense/blob/main/media/mitre/Update-Jan-2025/Attacks-combined-2025.json"
click node_rulemaps "https://github.com/cloud-architekt/azuread-attack-defense/tree/main/media/mitre/Rules"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_spray,node_consent,node_ado,node_sync,node_prt,node_aitm,node_syncaba,node_monitoring,node_lateral,node_readme toneBlue
class node_queryset,node_ruletemplates toneAmber
class node_analyzerchapter,node_analyzerconfig,node_deployment toneMint
class node_attackmaps,node_rulemaps toneRose
class node_practitioner toneIndigo
```

## Components

### Scenario chapters

- [Password spray](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/PasswordSpray.md): `PasswordSpray.md`
- [Consent grants](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/ConsentGrant.md): `ConsentGrant.md`
- [ADO service principals](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/ServicePrincipals-ADO.md): `ServicePrincipals-ADO.md`
- [Sync service account](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/AADCSyncServiceAccount.md): `AADCSyncServiceAccount.md`
- [Token replay](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/ReplayOfPrimaryRefreshToken.md): `ReplayOfPrimaryRefreshToken.md`
- [AiTM attacks](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/Adversary-in-the-Middle.md): `Adversary-in-the-Middle.md`
- [Sync app auth](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/EntraSyncAba.md): `EntraSyncAba.md`
- [Identity monitoring](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/IdentitySecurityMonitoring.md): `IdentitySecurityMonitoring.md`
- [Lateral movement](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/LateralMovementADEID.md): `LateralMovementADEID.md`

### Detection content

- [Detection queries](https://github.com/cloud-architekt/azuread-attack-defense/tree/main/queries): `queries`
- [Rule templates](https://github.com/cloud-architekt/azuread-attack-defense/tree/main/config/ruletemplates): `config/ruletemplates`

### Analyzer configuration

- [Config analyzer](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/AADSecurityConfigAnalyzer.md): `AADSecurityConfigAnalyzer.md`
- [Analyzer settings](https://github.com/cloud-architekt/azuread-attack-defense/tree/main/config): `config`
- [Analyzer deployment](https://github.com/cloud-architekt/azuread-attack-defense/tree/main/config/deploy): `config/deploy`

### ATT&CK mapping

- [Attack scenario maps](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/media/mitre/Update-Jan-2025/Attacks-combined-2025.json): `media/mitre/Update-Jan-2025/Attacks-combined-2025.json`
- [Detection rule maps](https://github.com/cloud-architekt/azuread-attack-defense/tree/main/media/mitre/Rules): `media/mitre/Rules`

### Other components

- **Security practitioner**
- [Playbook overview](https://github.com/cloud-architekt/azuread-attack-defense/blob/main/README.md): `README.md`

## Connections

- Security practitioner → Playbook overview: uses (evidence: `README.md`)
- Playbook overview → Password spray: links chapter (evidence: `README.md`)
- Playbook overview → Consent grants: links chapter (evidence: `README.md`)
- Playbook overview → ADO service principals: links chapter (evidence: `README.md`)
- Playbook overview → Sync service account: links chapter (evidence: `README.md`)
- Playbook overview → Token replay: links chapter (evidence: `README.md`)
- Playbook overview → AiTM attacks: links chapter (evidence: `README.md`)
- Playbook overview → Sync app auth: links chapter (evidence: `README.md`)
- Playbook overview → Identity monitoring: links appendix (evidence: `README.md`)
- Playbook overview → Lateral movement: links appendix (evidence: `README.md`)
- Playbook overview → Config analyzer: links chapter (evidence: `README.md`)
- Playbook overview → Detection queries: provides detections (evidence: `README.md`)
- Playbook overview → Rule templates: describes templates (evidence: `README.md`)
- Playbook overview → Attack scenario maps: maps scenarios (evidence: `README.md`)
- Playbook overview → Detection rule maps: maps detections (evidence: `README.md`)
- Config analyzer → Analyzer settings: documents settings
- Config analyzer → Analyzer deployment: documents deployment