AD + Entra Identity Audit

A read-only PowerShell code sample that inventories security-relevant configuration across Active Directory and Microsoft Entra ID and produces a native RTF audit book. Microsoft Word and COM automation are not required.

Current version: 1.2.1

For an example of how the inventory can support stakeholder reporting, see the sanitized identity audit writing sample. All examples in it are explicitly fictional and generic.

What it demonstrates

• Defensive, read-only directory collection with graceful handling of unavailable modules, permissions, licenses, and empty datasets
• Native RTF generation with structured sections and bounded inventory tables
• Active Directory coverage including topology, DCs/FSMO, password policy, trusts, OUs, users, privileged identity, service accounts, delegation, and computers
• Entra coverage including users, groups, devices, directory roles, Conditional Access, named locations, applications, MFA registration, risky users, access reviews, and recommendations
• Mutually exclusive computer classification:
  • 8.1 Domain Controllers
  • 8.2 Domain Servers, excluding domain controllers
  • 8.3 Domain Workstations, excluding servers and domain controllers

Requirements

• Windows PowerShell 5.1 or PowerShell 7+
• RSAT Active Directory module for AD collection
• Microsoft Graph PowerShell authentication module for Entra collection
• Appropriate read permissions in the selected AD domain
• Delegated Graph permissions requested by the script; some sections also require Entra licensing

The script does not install modules, modify directory objects, export credentials, create scheduled tasks, or require Microsoft Word.

Usage

Run both collectors:

.\Invoke-ADEntraIdentityAudit.ps1

Run Active Directory only against a specified DC:

$credential = Get-Credential
.\Invoke-ADEntraIdentityAudit.ps1 -CheckActiveDirectory `
  -ADServer 'dc01.contoso.com' -ADCredential $credential

Run Entra only and select an output location:

.\Invoke-ADEntraIdentityAudit.ps1 -CheckEntra `
  -OutputPath '.\reports\identity-audit.rtf'

Security and privacy

Generated reports may contain sensitive directory, tenant, account, hostname, licensing, and security-configuration data. Store them as audit evidence, apply access controls, and never commit them to source control. This repository contains no generated audit output or environment-specific sample data.

Authentication is interactive for Entra unless an existing Graph context can satisfy the requested scopes. Optional AD credentials remain PowerShell credential objects in memory and are never written to the report or disk.

Validation

Run the static Pester checks:

Invoke-Pester .\tests

Because directory APIs and permissions vary, validate the tool in a non-production or authorized test environment before relying on its output.

Scope

This is a professional code sample and audit-assistance tool, not a compliance certification, vulnerability scanner, or substitute for expert review. Collection notes are retained in the report when an API, permission, module, license, or dataset is unavailable.

License

MIT. See LICENSE.