azure-entra-id-auditor

What This Skill Does

The azure-entra-id-auditor is a specialized security diagnostic tool designed to help administrators identify critical vulnerabilities within their Microsoft Entra ID (formerly Azure AD) tenant. As identity becomes the primary perimeter in modern cloud environments, maintaining a clean and restricted permission model is essential. This skill acts as an intelligent auditor, processing static configuration exports from your Azure environment to detect over-privileged identities, dangerous service principal permissions, and misconfigured Conditional Access policies. It maps your current security posture against industry standards and MITRE ATT&CK techniques, providing clear, actionable remediation steps to reduce your attack surface.

Installation

To integrate this skill into your OpenClaw environment, execute the following command in your terminal: clawhub install openclaw/skills/skills/anmolnagpal/entra-id-auditor

Use Cases

This skill is designed for security engineers, cloud architects, and IT administrators. Key use cases include:

• Conducting quarterly security audits to ensure compliance with the Principle of Least Privilege (PoLP).
• Performing a rapid post-breach analysis or baseline check after tenant setup.
• Validating that Privileged Identity Management (PIM) is correctly enforced for high-impact roles.
• Investigating 'shadow IT' by auditing app registrations for excessive API permissions that could lead to lateral movement.
• Simplifying complex Azure audit logs into human-readable risk reports with prioritized remediation.

Example Prompts

1. "Analyze these exported role assignments and identity lists to identify any accounts with Global Admin rights that lack MFA or haven't used PIM recently."
2. "I have provided my current Conditional Access policy JSON. Can you check for gaps where MFA might be bypassed and suggest an improvement for admin account protection?"
3. "Review the attached app registration export and highlight any service principals that have Directory.ReadWrite.All or other dangerous permissions that should be downgraded."

Tips & Limitations

• Safety First: This skill is instruction-only. It performs no live API calls or write operations. You retain full control over your environment.
• Data Privacy: Ensure sensitive identifiers are obfuscated if your organization policy forbids sharing tenant IDs or UPNs with external LLMs.
• Data Completeness: The accuracy of the analysis is directly proportional to the amount of data provided. Providing both role assignments and Conditional Access policy files yields the most robust security insights.
• Read-Only Access: Ensure you only provide exports generated via 'Global Reader' or 'Security Reader' roles.