Rebuilding ROADRecon for the Modern Entra Environment

Rebuilding ROADRecon for the Modern Entra Environment

Speakers: Thomas Byrne

Conference: fwd:cloudsec North America 2025

YouTube: https://www.youtube.com/watch?v=dTUeAhzmIu8

Overview

Thomas Byrne, a security consultant at Reverse, presents the work required to rebuild ROADRecon -- a widely used Python tool for enumerating Microsoft Entra ID (formerly Azure AD) tenants -- in response to the deprecation and imminent retirement of the Azure AD Graph API that ROADRecon has relied on since its creation. Byrne walks through the migration to the Microsoft Graph API, the challenge of finding first-party applications with sufficient preconented permissions to enumerate tenant objects, and the discovery of the undocumented Ibiza API used by the Azure portal that provides equivalent enumeration capabilities with zero telemetry logging. The talk serves as both a practical guide for offensive security practitioners performing Azure assessments and a defensive briefing on detection opportunities.

Background

▶ Watch: Azure security assessment challenges and why ROADRecon matters (2:00)

ROADRecon (developed by Dirk-jan Mollema, known as "Dirkjan") is a Python-based reconnaissance tool that enumerates all objects within a Microsoft Entra tenant -- users, groups, service principals, applications, devices, conditional access policies, and authorization policies -- storing the results in an SQLite database with a functional web frontend. It has been a staple tool for penetration testers and red teamers performing Azure security assessments, particularly for attack path mapping (APM) and assumed compromise scenarios.

ROADRecon has exclusively used the Azure AD Graph API for data collection. This API is now deprecated, with Microsoft announcing full retirement -- originally scheduled for the day of the presentation, though Microsoft extended support for certain applications until September 2025 that very morning. The replacement is the Microsoft Graph API, which provides broader capabilities (extending to OneNote, Outlook, Exchange, Dynamics 365, and other services) but introduces significant complexity around authentication and permission models.

The core challenge for migrating ROADRecon is that Microsoft's implementation of OAuth 2.0 for the Graph API requires applications to have specific delegated permissions for each endpoint they access. For third-party applications, these permissions require user consent. However, first-party applications (those created by Microsoft, like Azure Portal, Microsoft Teams, and Outlook) come with preconented permissions -- permissions that Microsoft has pre-approved, requiring no user consent.

Key Findings

▶ Watch: OAuth in Entra: authentication flow and preconented permissions explained (6:00)

1. Microsoft Office client provides the broadest preconented permissions. After creating a script that authenticated to Entra using all known first-party application client IDs against the Microsoft Graph resource, filtering for those that support password grant flows and don't require knowledge of specific redirect URIs, Byrne found that the Microsoft Office client provides the best coverage of needed Graph API permissions. Alternative clients include Microsoft Outlook, OneDrive, Azure AD Connect, and the SharePoint Online Client Extensibility module, though each has limitations (e.g., Outlook and OneDrive cannot enumerate conditional access policies).

1. Two independent tools emerged simultaneously. During Byrne's research, the Graph Preconent Explorer was released -- a YAML-based reference of all first-party applications and their preconented permissions, with an HTML viewer. Additionally, EntraScopes.com launched based on related research by Dirkjan himself. Both tools allow practitioners to look up which first-party client to use for accessing specific Graph API endpoints.

1. The Ibiza API provides equivalent enumeration with zero logging. The Ibiza API is an undocumented REST API used internally by the Azure portal for reading Entra objects. It provides access to users, groups, service principals, applications, and other tenant data. Critically, there is no telemetry available within Azure that will allow you to know if someone has retrieved an access token for this API or is using it to enumerate the tenant. It does not require the preconented permission dance needed for Microsoft Graph. Documentation has been compiled by researcher Alid Meta at nodo.cloud.

1. All ROADRecon data is preservable in the migration. Byrne confirmed that all information previously available through the Azure AD Graph API can be retrieved through the Microsoft Graph API, with no capability loss.

Technical Deep Dive

▶ Watch: Live demo: rebuilt ROADRecon gathering data via Microsoft Graph (12:00)

Microsoft Entra's OAuth implementation centers on the relationship between four components: the user, the client (application like Teams or Azure Portal), the identity provider (Entra), and the resource (like Microsoft Graph API). When a user accesses a client, the client requests an access token from Entra for the target resource. The access token contains scopes (permissions) that define what the client can do on behalf of the user.

Application registrations and enterprise applications (service principals) are distinct objects. An app registration is the developer's definition of an application (redirect URIs, secrets, required claims). An enterprise application is an instance of that registration within a specific tenant, serving as the security principal that can be granted directory rights.

First-party applications are enterprise applications created by Microsoft that exist by default in every Entra tenant. Examples include the Azure Portal, Microsoft Teams, Microsoft Office, and Outlook. These have preconented permissions -- delegated permissions for specific resources that Microsoft has pre-approved, eliminating the consent prompt for users.

Byrne's migration involved mapping each ROADRecon data collection endpoint to its Microsoft Graph API equivalent and identifying the required permissions:

| Endpoint | Required Permission |

|----------|-------------------|

| Users | User.Read.All or Directory.Read.All |

| Groups | GroupMember.Read.All or Directory.Read.All |

| Service Principals | Application.Read.All or Directory.Read.All |

| Applications | Application.Read.All or Directory.Read.All |

| Devices | Device.Read.All or Directory.Read.All |

| Conditional Access Policies | Policy.Read.All |

| Authorization Policies | Policy.Read.All |

The rebuilt ROADRecon authenticates via a password grant flow to a specified first-party client, gathers data from Microsoft Graph endpoints, stores results in SQLite, and presents them through the existing web GUI with full raw JSON available for each object.

The Ibiza API operates similarly but is structurally closer to the old Azure AD Graph API. Response objects are similarly structured, suggesting a shared lineage. Authentication uses the Azure Portal's client ID, and no special permissions configuration is required. The API is undocumented by Microsoft and is only intended for internal use by Azure portal services. Byrne has published a semi-working proof of concept for ROADRecon using the Ibiza APIs, with ongoing work to discover additional endpoints and hidden parameters.

For conditional access policy bypass: if a target environment blocks the client you're trying to use (e.g., Microsoft Office) via conditional access, you may need to try alternative first-party clients that aren't blocked, or use multiple clients to gather different subsets of data.

Demo / Proof of Concept

▶ Watch: Ibiza API: undocumented Azure portal API with zero logging (14:00)

Byrne demonstrated the rebuilt ROADRecon tool, showing:

• Authentication using username/password with the Microsoft Office client against the Microsoft Graph resource.
• The gather module collecting tenant data using the new --graph flag.
• The web GUI displaying tenant information, users, groups, and devices with full raw JSON output for each object.

The Microsoft Graph version is available as a branch in Dirkjan's original ROADRecon repository. The Ibiza API version is on Byrne's personal GitHub repository.

Defensive Implications

▶ Watch: Q&A: Ibiza API has absolutely no logging -- confirmed (20:00)

Detecting ROADRecon and similar enumeration tools requires a layered approach:

• Monitor Microsoft Graph Activity Logs for the default Python AIOHTTP user agent, which is a quick win for detecting unmodified ROADRecon usage.
• Build behavioral analytics for anomalous volumes of Graph API requests. ROADRecon generates a burst of read requests that scales with tenant size, creating a detectable pattern even in large environments.
• Watch for unusual first-party client usage. Attackers trying different client-resource pairs to find one that works within conditional access constraints will generate failed authentication attempts for uncommon client IDs.
• Monitor for anomalous network locations in sign-in logs. Credentials compromised via phishing used from an attacker's infrastructure will originate from untrusted networks.
• Accept the cost-value tradeoff. ROADRecon only performs read operations. Organizations may derive more defensive value from detecting state-changing actions (permission modifications, credential additions, role assignments) than from trying to detect read-only enumeration.
• The Ibiza API has no detection surface. There is currently no telemetry, logging, or audit trail for Ibiza API usage. This is a significant blind spot that Microsoft has not addressed. Defenders should assume that sophisticated attackers will prefer this channel for enumeration.
• Strong conditional access policies remain the most effective preventive control, potentially blocking the first-party clients that tools like ROADRecon rely on.

Key Takeaways

• ROADRecon has been rebuilt to use the Microsoft Graph API in response to Azure AD Graph's deprecation, with no loss of enumeration capability.
• First-party applications with preconented permissions (especially Microsoft Office) provide the authentication mechanism for Graph API enumeration without user consent prompts.
• The undocumented Ibiza API used by the Azure portal provides equivalent enumeration capabilities with zero logging or telemetry, representing a significant detection blind spot.
• Graph Preconent Explorer and EntraScopes.com are new community resources for identifying first-party applications and their preconented permissions.
• Detecting ROADRecon-style enumeration is difficult because it only performs read operations; defenders may get more value from detecting state-changing actions.
• Conditional access policies and anomalous request volume detection are the most practical defensive measures.

About the Speaker(s)

Thomas Byrne is a security consultant at Reverse, based in the Manchester/London area. He has been with Reverse for over three years and focuses on Azure and Microsoft Entra security assessments, including attack path mapping and red team engagements. He contributed the Microsoft Graph migration for ROADRecon in collaboration with the original tool's creator, Dirkjan (Dirk-jan Mollema), and independently developed the Ibiza API integration.