How compasssecurity/entrafalcon works
EntraFalcon is a PowerShell security assessment tool for Microsoft Entra ID. The documented workflow is to run the script, authenticate to Microsoft Graph, enumerate tenant objects and configuration, assess security risks, and explore findings in navigable HTML reports. The graph preserves the README’s major enumeration areas and reporting capabilities. No source excerpts were provided, so internal call ownership and module-to-module relationships cannot be verified; edges show only documented product-level relationships.
Main entry points: run_EntraFalcon.ps1 Assessment Runner · EntraTokenAid.psm1 Authentication Flows · check_AgentsFinalize.psm1 Security Findings · export_Summary.psm1 Summary Export
Components 23
Authentication
- Authentication Flows
modules/EntraTokenAid.psm1
Tenant Assessment
- Users
modules/check_Users.psm1 - Groups
modules/check_Groups.psm1 - Applications
modules/check_AppRegistrations.psm1 - Enterprise Apps
modules/check_EnterpriseApps.psm1 - Managed Identities
modules/check_ManagedIdentities.psm1 - Agent Identities
modules/check_AgentIdentities.psm1 - Agent Blueprints
modules/check_AgentIdentityBlueprints.psm1 - Blueprint Principals
modules/check_AgentIdentityBlueprintsPrincipals.psm1 - Role Assignments
modules/check_Roles.psm1 - PIM Assignments
modules/check_PIM.psm1 - PIM Groups
modules/check_PIMGroups.psm1 - Access Packages
modules/check_AccessPackages.psm1 - Entitlement Catalogs
modules/check_Catalogs.psm1 - Conditional Access
modules/check_CAPs.psm1 - Tenant Configuration
modules/check_Tenant.psm1
Findings & Reports
- Security Findings
modules/check_AgentsFinalize.psm1 - Summary Export
modules/export_Summary.psm1 - Interactive HTML Reports
modules/export_Summary.psm1
Other components
- Analyst
- Assessment Runner
run_EntraFalcon.ps1 - Microsoft Graph API
- Azure ARM API
Connections 22
- Analyst → Assessment Runner: runs
README.md - Assessment Runner → Authentication Flows: authenticates with
README.md - Authentication Flows → Microsoft Graph API: obtains access to
README.md - Assessment Runner → Users: assesses
README.md - Assessment Runner → Groups: assesses
README.md - Assessment Runner → Applications: assesses
README.md - Assessment Runner → Enterprise Apps: assesses
README.md - Assessment Runner → Managed Identities: enumerates
README.md - Assessment Runner → Agent Identities: enumerates
README.md - Assessment Runner → Agent Blueprints: enumerates
README.md - Assessment Runner → Blueprint Principals: enumerates
README.md - Assessment Runner → Role Assignments: assesses
README.md - Assessment Runner → PIM Assignments: enumerates
README.md - Assessment Runner → PIM Groups: enumerates
README.md - Assessment Runner → Access Packages: enumerates
README.md - Assessment Runner → Entitlement Catalogs: enumerates
README.md - Assessment Runner → Conditional Access: assesses
README.md - Assessment Runner → Tenant Configuration: assesses
README.md - Assessment Runner → Security Findings: produces
README.md - Security Findings → Summary Export: summarizes
README.md - Summary Export → Interactive HTML Reports: generates
README.md - Assessment Runner → Azure ARM API: optionally accesses
README.md