# compasssecurity/entrafalcon architecture

> Architecture diagram of the GitHub repository compasssecurity/entrafalcon, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/compasssecurity/entrafalcon
- Repository: https://github.com/compasssecurity/entrafalcon

## Overview

EntraFalcon is a PowerShell security assessment tool for Microsoft Entra ID. The documented workflow is to run the script, authenticate to Microsoft Graph, enumerate tenant objects and configuration, assess security risks, and explore findings in navigable HTML reports. The graph preserves the README’s major enumeration areas and reporting capabilities. No source excerpts were provided, so internal call ownership and module-to-module relationships cannot be verified; edges show only documented product-level relationships.

Main entry points: [`run_EntraFalcon.ps1`](https://github.com/compasssecurity/entrafalcon/blob/main/run_EntraFalcon.ps1) (Assessment Runner), [`modules/EntraTokenAid.psm1`](https://github.com/compasssecurity/entrafalcon/blob/main/modules/EntraTokenAid.psm1) (Authentication Flows), [`modules/check_AgentsFinalize.psm1`](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AgentsFinalize.psm1) (Security Findings), [`modules/export_Summary.psm1`](https://github.com/compasssecurity/entrafalcon/blob/main/modules/export_Summary.psm1) (Summary Export)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_authentication["Authentication"]
  node_auth["Authentication Flows<br/>[EntraTokenAid.psm1]"]
end

subgraph group_assessment["Tenant Assessment"]
  node_users["Users<br/>[check_Users.psm1]"]
  node_groups["Groups<br/>[check_Groups.psm1]"]
  node_apps["Applications"]
  node_enterprise["Enterprise Apps"]
  node_managed["Managed Identities"]
  node_agents["Agent Identities"]
  node_blueprints["Agent Blueprints"]
  node_principals["Blueprint Principals"]
  node_roles["Role Assignments<br/>[check_Roles.psm1]"]
  node_pim["PIM Assignments<br/>[check_PIM.psm1]"]
  node_pimgroups["PIM Groups"]
  node_access["Access Packages"]
  node_catalogs["Entitlement Catalogs"]
  node_conditional["Conditional Access<br/>[check_CAPs.psm1]"]
  node_tenant["Tenant Configuration<br/>[check_Tenant.psm1]"]
end

subgraph group_reporting["Findings &amp; Reports"]
  node_findings["Security Findings"]
  node_summary["Summary Export"]
  node_reports["Interactive HTML Reports"]
end

node_operator(("Analyst"))
node_runner["Assessment Runner"]
node_graphapi["Microsoft Graph API"]
node_armapi["Azure ARM API"]

node_operator -->|"runs"| node_runner
node_runner -->|"authenticates with"| node_auth
node_auth -->|"obtains access to"| node_graphapi
node_runner -->|"assesses"| node_users
node_runner -->|"assesses"| node_groups
node_runner -->|"assesses"| node_apps
node_runner -->|"assesses"| node_enterprise
node_runner -->|"enumerates"| node_managed
node_runner -->|"enumerates"| node_agents
node_runner -->|"enumerates"| node_blueprints
node_runner -->|"enumerates"| node_principals
node_runner -->|"assesses"| node_roles
node_runner -->|"enumerates"| node_pim
node_runner -->|"enumerates"| node_pimgroups
node_runner -->|"enumerates"| node_access
node_runner -->|"enumerates"| node_catalogs
node_runner -->|"assesses"| node_conditional
node_runner -->|"assesses"| node_tenant
node_runner -->|"produces"| node_findings
node_findings -->|"summarizes"| node_summary
node_summary -->|"generates"| node_reports
node_runner -.->|"optionally accesses"| node_armapi

click node_runner "https://github.com/compasssecurity/entrafalcon/blob/main/run_EntraFalcon.ps1"
click node_auth "https://github.com/compasssecurity/entrafalcon/blob/main/modules/EntraTokenAid.psm1"
click node_users "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_Users.psm1"
click node_groups "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_Groups.psm1"
click node_apps "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AppRegistrations.psm1"
click node_enterprise "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_EnterpriseApps.psm1"
click node_managed "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_ManagedIdentities.psm1"
click node_agents "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AgentIdentities.psm1"
click node_blueprints "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AgentIdentityBlueprints.psm1"
click node_principals "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AgentIdentityBlueprintsPrincipals.psm1"
click node_roles "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_Roles.psm1"
click node_pim "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_PIM.psm1"
click node_pimgroups "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_PIMGroups.psm1"
click node_access "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AccessPackages.psm1"
click node_catalogs "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_Catalogs.psm1"
click node_conditional "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_CAPs.psm1"
click node_tenant "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_Tenant.psm1"
click node_findings "https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AgentsFinalize.psm1"
click node_summary "https://github.com/compasssecurity/entrafalcon/blob/main/modules/export_Summary.psm1"
click node_reports "https://github.com/compasssecurity/entrafalcon/blob/main/modules/export_Summary.psm1"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_auth toneBlue
class node_users,node_groups,node_apps,node_enterprise,node_managed,node_agents,node_blueprints,node_principals,node_roles,node_pim,node_pimgroups,node_access,node_catalogs,node_conditional,node_tenant toneAmber
class node_findings,node_summary,node_reports,node_graphapi,node_armapi toneMint
class node_operator toneIndigo
class node_runner toneTeal
```

## Components

### Authentication

- [Authentication Flows](https://github.com/compasssecurity/entrafalcon/blob/main/modules/EntraTokenAid.psm1): `modules/EntraTokenAid.psm1`

### Tenant Assessment

- [Users](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_Users.psm1): `modules/check_Users.psm1`
- [Groups](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_Groups.psm1): `modules/check_Groups.psm1`
- [Applications](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AppRegistrations.psm1): `modules/check_AppRegistrations.psm1`
- [Enterprise Apps](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_EnterpriseApps.psm1): `modules/check_EnterpriseApps.psm1`
- [Managed Identities](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_ManagedIdentities.psm1): `modules/check_ManagedIdentities.psm1`
- [Agent Identities](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AgentIdentities.psm1): `modules/check_AgentIdentities.psm1`
- [Agent Blueprints](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AgentIdentityBlueprints.psm1): `modules/check_AgentIdentityBlueprints.psm1`
- [Blueprint Principals](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AgentIdentityBlueprintsPrincipals.psm1): `modules/check_AgentIdentityBlueprintsPrincipals.psm1`
- [Role Assignments](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_Roles.psm1): `modules/check_Roles.psm1`
- [PIM Assignments](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_PIM.psm1): `modules/check_PIM.psm1`
- [PIM Groups](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_PIMGroups.psm1): `modules/check_PIMGroups.psm1`
- [Access Packages](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AccessPackages.psm1): `modules/check_AccessPackages.psm1`
- [Entitlement Catalogs](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_Catalogs.psm1): `modules/check_Catalogs.psm1`
- [Conditional Access](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_CAPs.psm1): `modules/check_CAPs.psm1`
- [Tenant Configuration](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_Tenant.psm1): `modules/check_Tenant.psm1`

### Findings & Reports

- [Security Findings](https://github.com/compasssecurity/entrafalcon/blob/main/modules/check_AgentsFinalize.psm1): `modules/check_AgentsFinalize.psm1`
- [Summary Export](https://github.com/compasssecurity/entrafalcon/blob/main/modules/export_Summary.psm1): `modules/export_Summary.psm1`
- [Interactive HTML Reports](https://github.com/compasssecurity/entrafalcon/blob/main/modules/export_Summary.psm1): `modules/export_Summary.psm1`

### Other components

- **Analyst**
- [Assessment Runner](https://github.com/compasssecurity/entrafalcon/blob/main/run_EntraFalcon.ps1): `run_EntraFalcon.ps1`
- **Microsoft Graph API**
- **Azure ARM API**

## Connections

- Analyst → Assessment Runner: runs (evidence: `README.md`)
- Assessment Runner → Authentication Flows: authenticates with (evidence: `README.md`)
- Authentication Flows → Microsoft Graph API: obtains access to (evidence: `README.md`)
- Assessment Runner → Users: assesses (evidence: `README.md`)
- Assessment Runner → Groups: assesses (evidence: `README.md`)
- Assessment Runner → Applications: assesses (evidence: `README.md`)
- Assessment Runner → Enterprise Apps: assesses (evidence: `README.md`)
- Assessment Runner → Managed Identities: enumerates (evidence: `README.md`)
- Assessment Runner → Agent Identities: enumerates (evidence: `README.md`)
- Assessment Runner → Agent Blueprints: enumerates (evidence: `README.md`)
- Assessment Runner → Blueprint Principals: enumerates (evidence: `README.md`)
- Assessment Runner → Role Assignments: assesses (evidence: `README.md`)
- Assessment Runner → PIM Assignments: enumerates (evidence: `README.md`)
- Assessment Runner → PIM Groups: enumerates (evidence: `README.md`)
- Assessment Runner → Access Packages: enumerates (evidence: `README.md`)
- Assessment Runner → Entitlement Catalogs: enumerates (evidence: `README.md`)
- Assessment Runner → Conditional Access: assesses (evidence: `README.md`)
- Assessment Runner → Tenant Configuration: assesses (evidence: `README.md`)
- Assessment Runner → Security Findings: produces (evidence: `README.md`)
- Security Findings → Summary Export: summarizes (evidence: `README.md`)
- Summary Export → Interactive HTML Reports: generates (evidence: `README.md`)
- Assessment Runner → Azure ARM API: optionally accesses (evidence: `README.md`)