Identity, SSO & Entra ID

OAuth 2.0 answers: may this application call that API on someone's behalf? It is an authorization framework, not a login protocol by itself. The resource owner is the person or tenant who controls the data. The client is the application asking for access. The authorization server decides and issues tokens. The resource server is the API that accepts a valid token and still has to enforce its own permissions.

OpenID Connect sits on OAuth and answers a different question: who is the user? The extra artifact is an ID token, meant for the client so it can establish a session. An access token is meant for the API. Mixing those jobs — treating an access token as proof of identity, or letting the API trust the client to say who the user is — is a design flaw you should be able to name in a report.

You do not need to mint, replay, or modify tokens to understand this. A professional reads the app's registration, the redirect URIs, the scopes requested, and whether the API checks the audience and the caller's rights. Token contents are inspected only for structure and claims, the same way the in-browser JWT lab decodes a sample without touching the signature.

Authorization code, especially with PKCE, is the normal interactive grant for web and mobile apps. The user authenticates at the identity provider, the app receives a short-lived code at a registered redirect, and the app exchanges that code for tokens on a back channel. Your review questions are: is the redirect URI exact, is PKCE used for public clients, and are refresh tokens stored somewhere appropriate?

Client credentials are for a service calling an API as itself, not as a user. The secret or certificate is the client's identity. Findings here are usually about where that secret lives, how broadly the app's permissions were granted, and whether a human login would have been the honest model.

The implicit grant put tokens in the browser URL. Modern guidance retires it. If you still see it, the professional note is 'legacy grant, tokens exposed to the front end,' plus a recommendation to move to authorization code with PKCE. Device code and on-behalf-of appear in enterprise flows; know their names so a scope document can allow or forbid them. This lesson does not walk through obtaining a token.

A sound integration validates tokens on the resource server: signature using the provider's published keys, issuer, audience, and expiry. The API then authorizes the action. A login screen is not authorization. A scope string is a request, not a guarantee that the API enforced it.

Consent screens, admin consent, and which directory the app is registered in are scope questions. An app in one tenant calling another tenant's data is a different engagement. Write that boundary down before anyone opens a tool.

Common report themes, stated as weaknesses rather than procedures: overly broad scopes, redirect URIs that accept unexpected hosts, long-lived secrets in source control, refresh tokens in local storage, and APIs that accept a token meant for a different audience. Pair each one with the fix: least privilege, exact redirects, a secret manager, and server-side validation.

On-premises Active Directory is the Module 7 world: domain controllers, organizational units, Group Policy, Kerberos, and computers joined to a domain. Microsoft Entra ID is the cloud identity service behind Microsoft 365 and Azure. A company often has both, synchronized in one direction, and they are still different systems with different logs, consoles, and rules of engagement.

A tenant is the cloud boundary. Users, groups, devices, and applications live in that tenant. Administrative power is a directory role or a narrower app permission, not 'Domain Admin' copied into the cloud. Conditional Access is policy on sign-in: who, from where, on what device, with what authentication strength. None of that is a GPO.

If a statement of work says 'Active Directory,' ask which one. Testing the on-prem forest does not authorize the tenant, and reviewing the tenant does not authorize domain controllers. Hybrid identity is a design topic (how accounts are synced and where passwords are mastered). It is not permission to cross the boundary.

An app registration is the application's identity: its client id, its credentials, and the permissions it asks for. An enterprise application (service principal) is that app as installed in a specific tenant, where an admin may have consented. Delegated permissions act as a signed-in user. Application permissions act as the app itself and are the ones that surprise people when they are broader than the integration needs.

Microsoft Graph is the API surface for users, groups, mail, files, and directory objects. A professional review asks which Graph permissions are granted, whether admin consent was required, and whether the integration could have used a narrower permission. You are reading configuration and contracts, not collecting mailboxes.

Sign-in logs, audit logs, and the list of consent grants are the evidence. Screenshot or export only what the rules of engagement allow, store it with the engagement, and do not copy it into a personal notes app.

ROADtools is a framework for collecting Microsoft Entra directory data you are allowed to read and exploring it locally so relationships between users, groups, roles, and apps are easier to see. It belongs in an authorized assessment of a tenant you administer or are contracted to review. This academy lists it so you know the name and the job. It does not ship collection steps.

AADInternals is a PowerShell module aimed at inspecting Entra ID and related Microsoft cloud configuration. In professional hands it is a way to understand settings the client has authorized you to read, then write findings. It is not a substitute for the admin center, and it is not for tenants outside the written scope.

GraphRunner is a PowerShell toolkit for exploring what a Microsoft Graph identity can see during an authorized review. Use the name when a report needs to say which class of tool would inventory Graph permissions. Do not treat a blog's command list as permission. If the engagement is read-only, the tool's job stops at reading what was in scope.