Microsoft Azure AD Assessment

Install the module from the PowerShell Gallery using Install-Module. If you already have it installed, use Update-Module to ensure you are on the latest version.

To install for the current user:

Install-Module AzureADAssessment -Force -Scope CurrentUser

To update an existing installation:

Update-Module AzureADAssessment -Force -Scope CurrentUser

To collect data from hybrid components like AAD Connect, AD FS, or Azure AD App Proxy, run the collection locally on those servers.

1. Install the AzureADAssessment module on the server.
2. Run Invoke-AADAssessmentHybridDataCollection.

Output Format: The package is named AzureADAssessmentData-<Svc>-<ServerName>.zip.

To specify a custom output directory, use the -OutputDirectory parameter.

Invoke-AADAssessmentHybridDataCollection "C:\Temp"

If you need to collect data from servers without internet access (e.g., AAD Connect, AD FS, App Proxy), you can export a portable version of the module.

1. On an internet-connected machine, export the module:

   Export-AADAssessmentPortableModule "C:\AzureADAssessment"

2. Copy the AzureADAssessmentPortable.psm1 file to the target server.
3. On the target server, import and run the hybrid collection:

   Import-Module "C:\AzureADAssessment\AzureADAssessmentPortable.psm1"
   Invoke-AADAssessmentHybridDataCollection

## Export portable module
Export-AADAssessmentPortableModule "C:\AzureADAssessment"

## On the target server
Import-Module "C:\AzureADAssessment\AzureADAssessmentPortable.psm1"
Invoke-AADAssessmentHybridDataCollection

The assessment requires a custom application registration in your Entra ID tenant to facilitate authentication.

1. Open Entra admin center > Identity > Applications > App registrations.
2. Select New registration.
3. Name: Enter a name (e.g., Entra Assessment Account).
4. Redirect URI:
   • Select Mobile and desktop applications from the dropdown.
   • Set the URI to https://login.microsoftonline.com/common/oauth2/nativeclient.
5. Select Register.
6. In the app's left navigation, select the Authentication blade.
7. Set Allow public client flows to Yes.
8. Click Save.

If you see an error regarding an Authenticode issuer mismatch for the MSAL.PS module (due to changes in Microsoft's code signing process), you can bypass the check using the -SkipPublisherCheck parameter.

Install-Module MSAL.PS -SkipPublisherCheck -Force

If you encounter an error stating that running scripts is disabled on your system, you must change the execution policy.

Set globally for the device:

Set-ExecutionPolicy RemoteSigned

Set only for the current PowerShell session:

Set-ExecutionPolicy RemoteSigned -Scope Process

When loading assessment data into PowerBI templates, you may encounter errors regarding data combination/privacy settings.

To resolve this, configure PowerBI to ignore privacy settings:

1. Go to File > Options and settings > Options.
2. Under CURRENT FILE, select Privacy.
3. Select Ignore the Privacy Levels and potentially improve performance.

For automation, you can connect using a service principal instead of a user identity. Your app registration must have the following Microsoft Graph application permissions (and have received admin consent):

• Directory.Read.All
• Policy.Read.All
• AuditLog.Read.All

Use the -ClientCertificate parameter to authenticate.

Connect-AADAssessment -ClientId <ClientId> -ClientCertificate (Get-Item 'Cert:\CurrentUser\My\<Thumbprint>') -TenantId <TenantId>

To run the assessment in a sovereign cloud, provide the -CloudEnvironment parameter. You must also provide the ClientId of an app registration created within that specific cloud tenant. Ensure the Redirect URI matches the cloud environment (e.g., https://login.microsoftonline.us/common/oauth2/nativeclient for USGov).

User Delegated Permissions:

Connect-AADAssessment -ClientId <ClientId> -CloudEnvironment USGov -TenantId <TenantId>

App Permissions (Service Principal):

Connect-AADAssessment -ClientId <ClientId> -ClientCertificate (Get-Item 'Cert:\CurrentUser\My\<Thumbprint>') -CloudEnvironment USGov -TenantId <TenantId>