aadinternals.com

One-line introduction

aadinternals.com is an open-source toolkit focused on security assessment for Azure AD, now renamed Microsoft Entra ID. It is developed and maintained by independent security researcher Dr. Nestori Syynimaa. The tool is primarily aimed at penetration testers, red teamers, and security researchers, offering a collection of command-line scripts and modules for analyzing, testing, and assessing the security of Azure AD/Office 365 environments. It has become popular in the security community because it fills gaps left by Microsoft’s official tools in attack-surface simulation and deep security auditing, helping professionals uncover potential weaknesses in authentication, conditional access policies, and directory synchronization during authorized testing.

Business details

aadinternals.com is not a commercial company in the usual sense, but an open-source security project led by an individual developer. Its core product is the AADInternals PowerShell module, distributed through PowerShell Gallery and capable of being loaded and run in memory without installation. The project’s history dates back to 2018, when Dr. Nestori Syynimaa publicly presented Azure AD attack techniques at security conferences such as Black Hat, later turning that research into reusable tooling. In the industry, AADInternals is widely regarded as the “Swiss Army knife” of Azure AD security testing, alongside tools such as BloodHound and ROADtools. Its main users are enterprise red teams, penetration testers at security consulting firms, and internal security teams responsible for assessing Office 365 and Azure environments. Because it is open source, it has no traditional sales team or customer support; community support is mainly handled through GitHub Issues and Twitter.

Who it is for

This tool is best suited to three types of users. The first is professional penetration testers and red teamers who need to simulate how attackers could exploit Azure AD misconfigurations during authorized engagements, such as password hash synchronization issues, conditional access bypasses, or abuse of application permissions. The second is enterprise cloud security administrators, who can use it to proactively audit their own Azure AD tenants for high-risk configurations, such as unused global administrator accounts, weak password policies, or expired authentication tokens. The third is security research enthusiasts, especially those interested in the implementation details of OAuth 2.0, OpenID Connect, and SAML protocols in Azure. It is not suitable for general IT operations staff or users without PowerShell experience, as all operations depend on the command line, and some functions require a deep understanding of Azure AD architecture to interpret the output correctly.

Key features and highlights

• Token manipulation and replay: Supports extracting, decoding, modifying, and replaying Azure AD access tokens and refresh tokens, useful for testing token lifecycle management and the strength of conditional access policies.
• Password hash synchronization attacks: Can extract synchronized password hashes from an Azure AD Connect server where sufficient access has already been obtained, simulating internal lateral movement scenarios.
• Device registration and join: Allows simulation of Azure AD registration and join processes on non-domain-joined devices, helping test whether device compliance policies are actually enforced.
• Conditional access policy assessment: Provides PowerShell commands to enumerate and test conditional access policy triggers and check for possible bypass paths.
• Directory enumeration and permission discovery: Can enumerate users, groups, applications, and service principals in a tenant without administrator privileges, helping quickly map the attack surface.
• Fileless execution: The entire module can be loaded in memory without writing to disk, reducing the chance of detection by traditional antivirus software and making it suitable for on-site penetration testing.

Pricing analysis

In terms of pricing, aadinternals.com is completely free and open source, with no hidden fees. Users can install it directly via PowerShell Gallery or clone the source code from GitHub. The only real cost is the time spent learning and troubleshooting it. Since documentation mainly relies on the GitHub README and community discussions, beginners may need several hours to become comfortable with the basics. Compared with similar commercial tools, such as Azure AD security assessment SaaS services that typically charge 500-2000 USD per month, AADInternals offers excellent value. However, it is important to note that it does not provide paid technical support or an SLA. If you run into bugs or compatibility issues, you will need to rely on community fixes or modify the code yourself.

How Chinese users can use it

From a connectivity perspective, the aadinternals.com website and GitHub repository are directly accessible from mainland China without requiring a proxy. However, the PowerShell Gallery installation command, Install-Module -Name AADInternals, may fail in domestic network environments due to unstable connections to Microsoft servers. It is recommended to download the ZIP package from GitHub and import the module manually. Payment methods are not relevant because the tool is free. As for invoicing, because this is an individual open-source project, it cannot provide a valid VAT invoice for mainland China, which may create obstacles for enterprise users that need to follow internal procurement procedures. There are few comparable domestic alternatives; the closest options are Azure AD audit scripts developed internally by security companies. Among publicly available free tools, however, AADInternals still offers the most complete feature set. During use, all operations against Microsoft cloud services will generate API calls, so make sure all testing is performed within the scope of authorization.

Pros and cons

Pros:

• ✅ Completely free and open source, with no feature restrictions, suitable for teams with limited budgets
• ✅ Broad coverage of the Azure AD attack surface, from token theft to directory enumeration
• ✅ Runs in memory with strong stealth characteristics, suitable for red team operations
• ✅ Continuously updated to keep pace with the latest changes in Microsoft cloud services
• ✅ Active community, with relatively quick responses to Issues on GitHub

Cons:

• ❌ Steep learning curve, requiring solid PowerShell and Azure AD knowledge
• ❌ No graphical interface; all operations depend on the command line, and output often needs to be parsed manually
• ❌ Documentation is scattered, and some command examples are insufficient, making it easy for beginners to get stuck on parameter configuration
• ❌ Cannot provide invoices, making it unfriendly to enterprise procurement processes
• ❌ Some advanced features, such as attack simulation, may trigger Microsoft anomaly detection and should be used with caution

Comparison with similar products

ROADtools (open source): Also focused on Azure AD security auditing, but with more emphasis on token analysis and OAuth flow debugging. AADInternals is stronger in password hash synchronization attacks and device registration, while ROADtools’ GUI tool RoadRecon is better suited to visual analysis.

BloodHound (open source): Although primarily designed for on-premises Active Directory, its Azure AD extension, AzureHound, can map permission relationships in hybrid environments. AADInternals is better at executing specific attack actions, such as token theft, while BloodHound excels at visualizing privilege paths.

Azure AD Security Defaults (Microsoft official): This is Microsoft’s built-in security baseline and requires no additional tools. However, it is a defensive configuration and cannot simulate an attacker’s perspective. AADInternals is used to verify whether these defaults are actually effective.

Summary and recommendation

Best-fit scenarios: If you are conducting an authorized penetration test and need to quickly verify whether Azure AD is exposed to risks such as password synchronization leakage, token theft, or conditional access bypass, or if you are a security researcher looking to understand the vulnerability mechanisms behind Microsoft cloud identity authentication, AADInternals is a top-choice tool. It is recommended to download the source code from GitHub and first run it in a non-production test tenant, becoming familiar with common commands such as Get-AADIntUser and Get-AADIntTokens.

Not suitable for: If you are an IT operations user who only wants one-click security reports, or if you need vendor-issued invoices and after-sales support, a commercial Azure AD security assessment service such as Varonis or ManageEngine may be a better fit. In addition, some features of this tool, such as password hash extraction, could be misused for malicious attacks, so it must only be used within a legally authorized scope. Since there is no refund policy, you should first validate whether the free open-source version meets your needs before relying on it heavily.