C-AZ-TENANT-RECONReconnaissance

Azure Tenant Reconnaissance

AADInternals / o365recon / GetUserRealm — enumerate tenant ID, federation status, sync state, valid users.

§ Where this technique fits

C-AZ-TENANT-RECON is catalogued under the Reconnaissance tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 1 on average.

§ Dossiers chaining this technique

Entra app consent phishing → Global Admin equivalent
Phish a privileged user to consent to an OAuth app requesting Directory.ReadWrite.All + RoleManagement.ReadWrite.Directory — the app then grants itself Global Administrator.
step 1 / 6

§ What commonly comes next

01
Valid Accounts
T1078 · Initial Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Entra app consent phishing → Global Admin equivalent

§ What commonly comes next