EntraOps

1.0.0

EntraOps classifies and reports privileged access in Microsoft Entra ID, Azure RBAC, Identity Governance, Intune, Defender and Microsoft Graph app roles against the Enterprise Access Model (EAM). It exports privileged assets as JSON, Microsoft Sentinel watchlists and BloodHound data, provides Tenant Governance snapshots and offline reports. Requires PowerShell 7.4+.

Minimum PowerShell version

7.4

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name EntraOps

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name EntraOps

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2024-2026 Thomas Naunheim. All rights reserved.

Package Details

Author(s)

  • Thomas Naunheim

Tags

AzureAD Entra EntraID Azure Security PrivilegedAccess EnterpriseAccessModel PIM RBAC IdentityGovernance Intune Defender EntraOps

Functions

Clear-EntraOpsCache Connect-EntraOps Disconnect-EntraOps Expand-EntraOpsPrivilegedEamJsonFile Export-EntraOpsClassificationApiPermissions Export-EntraOpsClassificationAppRoles Export-EntraOpsClassificationAzureRoles Export-EntraOpsClassificationDeviceManagementRoles Export-EntraOpsClassificationDirectoryRoles Export-EntraOpsClassificationDirectoryRolesFromMsftDocs Export-EntraOpsClassificationIdentityGovernanceRoles Export-EntraOpsClassificationScopes Export-EntraOpsPrivilegedEAMBloodHound Get-EntraOpsCacheStatistics Get-EntraOpsClassificationControlPlaneObjects Get-EntraOpsClassificationDirectoryRolesMismatchFromMsftDocs Get-EntraOpsEntraObject Get-EntraOpsManagedIdentityAssignments Get-EntraOpsUpdateCandidate Get-EntraOpsUpdatePlan Get-EntraOpsPrivilegedAppRoles Get-EntraOpsPrivilegedAzureRoles Get-EntraOpsPrivilegedEAMAzure Get-EntraOpsPrivilegedDefenderRoles Get-EntraOpsPrivilegedDeviceRoles Get-EntraOpsPrivilegedEAM Get-EntraOpsPrivilegedEAMDefender Get-EntraOpsPrivilegedEAMEntraId Get-EntraOpsPrivilegedEAMIdGov Get-EntraOpsPrivilegedEAMIntune Get-EntraOpsPrivilegedEAMResourceApps Get-EntraOpsPrivilegedEAMResourceAppsFirstParty Get-EntraOpsPrivilegedEntraIdRoles Get-EntraOpsPrivilegedEntraObject Get-EntraOpsPrivilegedIdGovRoles Get-EntraOpsPrivilegedTransitiveGroupMember Get-EntraOpsTenantGovernanceSnapshot Get-EntraOpsTenantGovernanceSnapshotReport Get-EntraOpsWorkloadIdentityAttackPaths Get-EntraOpsWorkloadIdentityInfo Get-EntraOpsWorkloadIdentityRecommendations Install-EntraOpsAllRequiredModules Install-EntraOpsRequiredModule Invoke-EntraOpsAzGraphQuery Invoke-EntraOpsAzQuery Invoke-EntraOpsGraphSecurityQuery Invoke-EntraOpsMsGraphQuery Invoke-EntraOpsPrivilegedEAM Invoke-EntraOpsReportingGeneration Invoke-EntraOpsTenantGovernanceSnapshot Install-EntraOpsUpdateCandidate New-EntraOpsAccessPackageFlowData New-EntraOpsAccessPathMapData New-EntraOpsClassificationExplorerData New-EntraOpsConfigFile New-EntraOpsPrivilegedAdministrativeUnit New-EntraOpsPrivilegedConditionalAccessGroup New-EntraOpsPrivilegedEamDashboardData New-EntraOpsPrivilegedEamPrivilegeHistoryData New-EntraOpsPrivilegedUnprotectedAdministrativeUnit New-EntraOpsReportingData New-EntraOpsTenantGovernanceConfigurationAnalyzerData New-EntraOpsTierBreachAnalyzerData New-EntraOpsWorkloadIdentity Convert-EntraOpsExportToSampleData Push-EntraOpsLogsIngestionAPI Register-EntraOpsTenantGovernanceServicePrincipal Resolve-EntraOpsUpdateSource Remove-EntraOpsReportingData Save-EntraOpsPrivilegedEAMEnrichmentToWatchLists Save-EntraOpsPrivilegedEAMInsightsCustomTable Save-EntraOpsPrivilegedEAMJson Save-EntraOpsPrivilegedEAMWatchLists Save-EntraOpsTenantGovernanceSnapshotJson Save-EntraOpsWorkloadIdentityEnrichmentWatchLists Save-EntraOpsWorkloadIdentityInfo Test-EntraOpsTenantGovernancePrerequisite Test-EntraOpsGeneratedArtifacts Test-EntraOpsUpdateContract Update-EntraOps Update-EntraOpsClassificationControlPlaneScope Update-EntraOpsClassificationExplorerData Update-EntraOpsClassificationFiles Update-EntraOpsClassificationModels Update-EntraOpsPrivilegedAdministrativeUnit Update-EntraOpsPrivilegedConditionalAccessGroup Update-EntraOpsPrivilegedUnprotectedAdministrativeUnit Update-EntraOpsPrivilegedUnprotectedElmCatalog Update-EntraOpsRequiredWorkflowParameters

PSEditions

Core

Dependencies

This module has no dependencies.

Release Notes

First stable release. Classifies and exports privileged access across Entra ID, Azure RBAC, Identity Governance, Intune, Defender and Microsoft Graph app roles against the Enterprise Access Model, including Azure ABAC constrained delegation, Tenant Governance snapshots, offline reporting apps and a browser-based configuration wizard. Full changelog: https://github.com/Cloud-Architekt/EntraOps/blob/main/CHANGELOG.md

FileList

Version History

Version Downloads Last updated
1.0.0 (current version) 22 10/13/2026