skills.rest
jellaharshith
jellaharshithCOMMUNITY
Explore all skills by this author →
GitHub

m365-entra-attack

Parse ROPC AADSTS codes to validate Entra credentials under Conditional Access.

1|Updated Apr 18, 2026
Search Tags:#m365#entra id#password spray#conditional access#credential validation#aadsts#saml sso
One-click install
npx skills add https://github.com/jellaharshith/SWIFT --skill m365-entra-attack-jellaharshith
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: m365-entra-attack
Source: https://github.com/jellaharshith/SWIFT/tree/main/swift/skills/cbh/skills/m365-entra-attack
Command: npx skills add https://github.com/jellaharshith/SWIFT --skill m365-entra-attack-jellaharshith

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps you plan and execute an M365 / Entra ID red-team credential-attack workflow that discovers tenant context, differentiates likely user classes, and validates credential correctness even when Conditional Access blocks token issuance.

Core Features & Use Cases

  • Tenant and attack-surface discovery (msftrecon): identifies tenant IDs, federation mode, SharePoint/OneDrive presence, and key endpoints that shape the credential attack path.
  • Credential validation via ROPC AADSTS interpretation: maps specific AADSTS error codes to outcomes (including confirmed-valid password cases) and enforces a smart lockout attempt cap.
  • User enumeration with hardening-aware methods: uses differential signals (notably OneDrive personal-site behavior) and tracks enumeration reliability and shelf life.
  • CA and evidence capture workflow: documents Conditional Access block evidence and uses browser-based SAML SSO validation (Playwright) to classify outcomes (CA blocked vs MFA required vs success).
  • Operational guardrails and journaling: prescribes atomic per-user caps, JSONL logging artifacts, and lockout-differential detection for possible concurrent attacker activity.

Quick Start

Use the m365-entra-attack skill to generate a credential-attack plan and run a one-attempt-per-user validator against a target tenant, producing engagement-ready evidence for CA-blocked versus MFA-required outcomes.

Frequently Asked Questions about m365-entra-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate M365 credentials when Conditional Access blocks token issuance?▼

Parse ROPC AADSTS error codes to validate M365 credentials even when Conditional Access blocks token issuance, mapping specific codes to confirmed-valid password outcomes and using Playwright SAML SSO flows to classify CA-blocked versus MFA-required results.

How can I prevent user lockouts during an Entra ID password spray?▼

Prevent user lockouts during an Entra ID password spray by enforcing atomic per-user attempt caps via YAML operational guardrails, mathematically controlling attempt limits, and detecting lockout differentials for concurrent attacker activity.

What AADSTS error codes indicate a valid password in a red-team engagement?▼

Specific AADSTS error codes parsed from ROPC token requests indicate a valid password in a red-team engagement by differentiating confirmed credential correctness from invalid logins or Conditional Access blocks.

Can I enumerate Entra ID users without triggering hardening alerts?▼

Enumerate Entra ID users without triggering hardening alerts by leveraging differential signals like OneDrive personal-site behavior, tracking enumeration reliability and shelf life through hardening-aware methods within the credential validation workflow.

Does this approach require browser automation for SAML SSO validation?▼

Definitive SAML SSO classification requires optional Playwright browser automation to capture Conditional Access block evidence and accurately distinguish between CA-blocked, MFA-required, and successful authentication outcomes.

What tenant discovery is needed before running an M365 credential attack?▼

Before an M365 credential attack, msftrecon discovery identifies tenant IDs, federation mode, SharePoint and OneDrive presence, and key endpoints to determine the attack surface and shape the credential validation path.

Related Skills

Explore More Legal & Compliance Skills→
cmndcntrlcybercmndcntrlcyber
3

m365-entra-attack

Execute Microsoft 365/Entra ID credential attacks and Conditional Access bypass.

Community
Advanced
n4igmen4igme

m365-entra-attack

Identify valid M365/Entra credentials and test defense mechanisms against credential spraying.

Community
Advanced
elementalsoulselementalsouls
3.3k

m365-entra-attack

Test M365/Entra credentials and map CA policy outcomes via ROPC and SAML SSO flows.

Community
Advanced
uphiagouphiago
1.1k

m365-entra-attack

Validate credentials and enumerate users in Microsoft 365 and Entra ID environments.

Community
Advanced