DOCSEARCHbyAlgolia
Submit Docs

DCToolbox

repository·main·Indexed 18 days ago

https://github.com/danielchronlund/dctoolbox

A PowerShell module for Microsoft 365 security professionals providing tools for managing Microsoft Graph, Entra ID, and Conditional Access. It includes capabilities for implementing Zero Trust strategies, deploying Conditional Access policy baselines, simulating policy evaluations, exporting/importing policies via JSON, activating Entra ID PIM roles, and executing KQL hunting queries in Microsoft Defender XDR.

Tokens
8.5K
Snippets
35
Records
35
Agent score
14%

What's inside DCToolbox

  1. Enumerate Entra ID users and groups as a Guest

    main

    The Get-DCEntraIDUsersAndGroupsAsGuest script is a proof-of-concept tool that allows a guest user to enumerate users and security groups/teams in a target tenant, even when guest access restrictions are enabled.

    How it works: It uses a 'friend of a friend' approach, starting from known User Principal Names (UPNs) and performing nested queries (up to 5 iterations) to discover the directory structure. It works if the tenant's guest restrictions are set to 'most inclusive' or the default 'limited access' settings, but NOT if set to 'most restrictive'.

    Parameters:

    • -TenantId (Required): The ID of the target tenant.
    • -AccountId (Required): Your UPN in your home tenant.
    • -InterestingUsers (Required): One or more UPNs of users in the target tenant to serve as starting points for the search.
    Get-DCEntraIDUsersAndGroupsAsGuest -TenantId '00000000-0000-0000-0000-000000000000' -AccountId 'user@example.com' -InterestingUsers 'customer1@customer.com', 'customer2@customer.com'

  2. Deploy Conditional Access policy design baseline (PoC)

    main

    Use Deploy-DCConditionalAccessBaselinePoC to automatically deploy a complete set of Conditional Access policies based on the design baseline from https://danielchronlund.com.

    What it does:

    • Creates all necessary dependencies (exclusion groups, named locations, terms of use).
    • Deploys all baseline policies.
    • By default, all policies are set to 'Report-only' mode.

    Requirements:

    • You must be a Global Admin to run this command due to required admin consents.

    Parameters:

    • -AddCustomPrefix: Adds a custom string to the beginning of all created policy names.
    • -CreateDocumentation: Generates Markdown documentation for the deployed baseline.
    • -SkipReportOnlyMode: WARNING: If used, all policies will go live immediately for all users. Use with extreme caution.
    Deploy-DCConditionalAccessBaselinePoC -AddCustomPrefix 'PILOT - '

  3. Install the DCToolbox and Microsoft Graph modules

    main

    Use these commands to ensure the necessary dependencies are installed and up to date.

    • Install-DCMicrosoftGraphPowerShellModule: Checks, installs, and updates the Microsoft Graph PowerShell module.
    • Install-DCToolbox: Checks, installs, and updates the DCToolbox PowerShell module.
    Install-DCMicrosoftGraphPowerShellModule -Verbose
Install-DCToolbox -Verbose

  6. Get started with DCToolbox

    main
    After installation, run Get-DCHelp to view the available documentation and help information within your PowerShell session. You can also use Copy-DCExample to find and copy script examples directly to your clipboard for use in your own scripts.
    Get-DCHelp
Copy-DCExample

  7. List Conditional Access policies

    main

    Use Get-DCConditionalAccessPolicies to retrieve a list of Conditional Access policies in the tenant.

    Parameters:

    • -PrefixFilter: (Optional) Filter policies by a case-sensitive name prefix.
    • -ShowTargetResources: Show included and excluded resources in the output.
    • -Details: Include full policy details in the output.
    • -NamesOnly: Return only the names of the policies.
    Get-DCConditionalAccessPolicies -PrefixFilter 'GLOBAL - '

  8. Connect to Microsoft Graph as a User

    main

    Use Connect-DCMsGraphAsUser to authenticate to Microsoft Graph using delegated permissions (user context). This will trigger a standard interactive login.

    Parameters:

    • -Scopes (Required): A list of required API permission scopes (e.g., Policy.ReadWrite.ConditionalAccess, Directory.Read.All).
    Connect-DCMsGraphAsUser -Scopes 'Policy.ReadWrite.ConditionalAccess', 'Policy.Read.All', 'Directory.Read.All'

  9. Connect to Microsoft Graph as an Application

    main

    Use Connect-DCMsGraphAsApplication to authenticate to Microsoft Graph using application permissions (client credentials) rather than delegated user permissions. This is useful for automated scripts.

    Prerequisite: You must register a new application in Entra ID first.

    Important: This command returns an access token. You should store this token in a variable to use with subsequent Microsoft Graph CMDlets.

    Parameters:

    • -ClientID (Required): The Client ID of your Entra ID application.
    • -ClientSecret (Required): The Client secret of your Entra ID application.
    • -TenantName (Required): Your tenant domain (e.g., example.onmicrosoft.com).
    $AccessToken = Connect-DCMsGraphAsApplication -ClientID '8a85d2cf-17c7-4ecd-a4ef-05b9a81a9bba' -ClientSecret 'j[BQNSi29Wj4od92ritl_DHJvl1sG.Y/' -TenantName 'example.onmicrosoft.com'

  10. Test Entra ID user existence with Test-DCEntraIDUserExistence

    main

    Use Test-DCEntraIDUserExistence to check if specific email addresses correspond to existing accounts in Entra ID. This performs user enumeration via public endpoints without requiring authentication.

    Security Note: This tool is intended for security auditing. Do not use it in an unethical or unlawful way.

    Capabilities:

    • Can use a Tor proxy via -UseTorHttpProxy for anonymity.
    • It cannot see accounts for federated domains, but it will identify the organization the federated domain belongs to.
    # Test a list of users using Tor for anonymity
Test-DCEntraIDUserExistence -UseTorHttpProxy -Users "user1@example.com", "user2@example.com", "user3@example.onmicrosoft.com"

  11. Get current public IP information

    main

    Use Get-DCPublicIp to retrieve your current public IP address and metadata via the ipinfo.io API.

    Parameters:

    • -UseTorHttpProxy: (Optional) Routes the request through a running Tor network HTTP proxy (requires Start-DCTorHttpProxy to be running).
    Write-Host "$((Get-DCPublicIp).city) $((Get-DCPublicIp).country)"

  12. Start a Tor HTTP proxy with Start-DCTorHttpProxy

    main

    Use Start-DCTorHttpProxy to launch a Tor network HTTP proxy in a new PowerShell window for anonymizing HTTP traffic. This is useful for tools that support proxy configurations.

    Requirements:

    • Requires the Tor browser to be installed.
    • Default path: C:\Temp\Tor Browser.
    • You can specify a custom path using -TorBrowserPath.

    Usage for other CMDlets: Once started, use the proxy configuration 127.0.0.1:9150 in compatible PowerShell commands.

    # Start the proxy using default path
Start-DCTorHttpProxy

# Verify your Tor IP address
Get-DCPublicIp -UseTorHttpProxy