<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Auditing Azure Active Directory — API Reference

## Azure CLI Commands

### Role Assignments

```bash
# List Global Admins
az role assignment list --role "Global Administrator" --all --output table

# List all directory role assignments via Graph
az rest --method GET --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments"

# List role definitions
az rest --method GET --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions"
```

### Conditional Access

```bash
# List policies
az rest --method GET --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies"

# Get named locations
az rest --method GET --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations"
```

### User Management

```bash
# List all users
az ad user list --query "[].{UPN:userPrincipalName,DisplayName:displayName}" --output table

# List guest users
az ad user list --filter "userType eq 'Guest'" --output table

# User registration details (MFA status)
az rest --method GET --url "https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails"

# Risky users
az rest --method GET --url "https://graph.microsoft.com/v1.0/identityProtection/riskyUsers"
```

### App Registrations

```bash
# List apps with credentials
az ad app list --all --query "[].{AppId:appId,Name:displayName}" --output table

# Get app permissions
az ad app list --all --query "[].{AppId:appId,Name:displayName,RequiredResourceAccess:requiredResourceAccess}"
```

## Microsoft Graph API Endpoints

| Endpoint | Description |
|----------|-------------|
| `/roleManagement/directory/roleAssignments` | Directory role assignments |
| `/roleManagement/directory/roleDefinitions` | Available role definitions |
| `/identity/conditionalAccess/policies` | Conditional access policies |
| `/identityProtection/riskyUsers` | Users flagged as risky |
| `/applications` | App registrations |
| `/reports/authenticationMethods/userRegistrationDetails` | MFA registration status |

## CIS Azure Benchmark Controls

| Control | Description |
|---------|-------------|
| 1.1 | Ensure MFA is enabled for all privileged users |
| 1.2 | Ensure conditional access policies require MFA for admin roles |
| 1.3 | Ensure guest users are reviewed monthly |
| 1.5 | Ensure no subscription-level custom owner roles exist |
| 1.21 | Ensure Security Defaults are enabled (or equivalent CA policies) |
