m365-entra-attack

Identify and exploit Microsoft 365/Entra ID authentication and access control vulnerabilities.

5|Updated May 27, 2026

Search Tags:#red team #m365 #password spray #conditional access #entra #active attacker detection

Ready to run

npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill m365-entra-attack-cybersecwoman

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: m365-entra-attack
Source: https://github.com/cybersecwoman/Kiro-BugHunter/tree/main/skills/m365-entra-attack
Command: npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill m365-entra-attack-cybersecwoman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires msftrecon, o365spray, playwright, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill enables red teamers to launch sophisticated attacks on Microsoft 365/Entra ID, bypassing Conditional Access policies and identifying valid credentials.

Core Features & Use Cases

Tenant Discovery: Identifies M365/Entra tenants and their associated domains.
User Enumeration: Enumerates users with various techniques and checks for hardening status.
Smart Lockout Analysis: Analyzes and bypasses Smart Lockout policies.
Conditional Access Bypass: Provides options to bypass Conditional Access controls.
Password Spraying: Performs password spraying to identify valid credentials.
Active-Attacker Detection: Detects signs of active attacker activity.
Engagement Journaling: Logs all attempts and findings for reporting purposes.
Real-World Findings Template: Offers a template for documenting findings in reports.

Quick Start

Use the m365-entra-attack skill to perform a password spray against the target tenant 'client.example.com'.

Frequently Asked Questions about m365-entra-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a password spray attack against a Microsoft 365 tenant?▼

To perform a password spray attack against a Microsoft 365 tenant, you need tools that enumerate valid users and test credentials while avoiding smart lockout policies. This Skill automates that process using o365spray to identify valid logins.

Can I bypass Conditional Access policies during an Entra ID red team engagement?▼

Yes, you can bypass Conditional Access policies during an Entra ID red team engagement by analyzing access control mechanisms and targeting authentication endpoints. This Skill provides options to identify and circumvent these security controls.

How does Smart Lockout analysis work when spraying M365 credentials?▼

Smart Lockout analysis works by identifying the tenant's lockout thresholds and timing constraints before testing credentials. This Skill analyzes these policies to avoid triggering account lockouts during password spraying operations.

Do I need msftrecon and playwright to enumerate Entra ID users?▼

Yes, you need msftrecon for tenant discovery and user enumeration, while playwright is used for verifying various attack vectors. These dependencies are required to execute the automated reconnaissance and exploitation tasks.

What is the best way to document findings from a Microsoft 365 red team attack?▼

The best way to document findings from a Microsoft 365 red team attack is using engagement journaling and a real-world findings template. This Skill logs all attempts and provides a structured template for reporting.

How do I detect active attacker activity in an Entra ID environment?▼

To detect active attacker activity in an Entra ID environment, you analyze authentication logs and access control anomalies. This Skill includes active-attacker detection features to identify signs of ongoing password spray attempts.