EntraOps Privileged EAM
Open-source tooling to classify, identify, and protect privileged access across Microsoft cloud services using the Enterprise Access Model.
A clearer control plane
EntraOps makes privileged access legible across your Microsoft cloud estate. It turns roles, scope, identity context and history into an operational model your team can inspect and act on.
Map Microsoft Entra ID, Azure RBAC, Intune, Defender and Identity Governance permissions to the Enterprise Access Model.
Store findings as code, compare changes in Git, and surface the movement of privileged identities over time.
Turn classified assets into stronger Conditional Access targeting and Restricted Management Administrative Unit coverage.
Tier Breach Analyzer
Compare intended object tiers with granted service tiers, filter every assignment path and move from an anomalous flow to the role, scope and PIM context behind it.
Tier Breach Analyzer
Inspect the live Sankey, filters and assignment detail behind each cross-tier access path.
Git-backed reporting
Every committed export and Tenant Governance snapshot becomes inspectable evidence. Compare points in time, trace a change, then see how Conditional Access controls apply across the tenant.
Privilege History
Trend privileged assets, role assignments and tier breaches from the Git history of your Privileged EAM export. Filter by RBAC system, tier and role, inspect any snapshot, or compare two points in time.
Configuration Analyzer
Analyze Tenant Governance configuration snapshots for drift, property-level changes and policy coverage gaps. Follow every active policy from assignment to its effective grant control.
Features
Collect and classify privileged access, apply protection scope, and generate evidence for review and investigation.
Analyze Entra ID directory roles, Identity Governance, Intune, Defender XDR, Microsoft Graph app roles and Azure RBAC using customizable JSON classification templates.
Use high-privilege roles, Azure Resource Graph and Microsoft Security Exposure Management assets to keep Control Plane scope current.
Resolve active, eligible, time-bounded and nested assignments, including PIM for Groups and Azure constrained delegation context.
Export deterministic JSON, track changes in Git and generate Privilege History from the repository itself without a separate data store.
Target classified assets with Conditional Access groups, Restricted Management Administrative Units and privileged Identity Governance catalog protection.
Generate six self-contained reporting apps for classification, EAM inventory, access paths, tier breaches, history and configuration analysis.
What changed
Release 1.0, September 2026. A broader control plane, offline analysis, and tenant configuration history.
A practical EAM adoption path
EntraOps provides the evidence and automation for each stage, so adopting the Enterprise Access Model becomes an iterative operational practice.
Adapt the classification template to your critical scopes, services and tenant-specific roles.
Resolve role assignments, nested paths and privileged identities across every supported RBAC system.
Apply Restricted Management Administrative Units and Conditional Access coverage to classified assets.
Send tier context to your security tools and investigate exceptions, drift and breach paths.
Track posture, privilege history and attack-path evidence to steer the next improvement cycle.
Example outputs
Inspect administrative boundaries, Conditional Access groups, access paths and the classification evidence available to investigation tools.
Protection automation
Create tier-aware administrative units that give privileged assets the management boundary they need.
Integrations
EntraOps turns classifications into a shared security signal: query it in Microsoft Security, enrich it through Sentinel, or join it to attack paths in BloodHound.
Microsoft Security
Ingest complete Privileged EAM records through a Log Analytics custom table or Microsoft Sentinel WatchLists. The shared parser normalizes both paths, so KQL queries and workbooks work regardless of ingestion choice. Optional WatchLists enrich High Value Assets, VIP Users, identity correlation, managed-identity resources, recommendations and CSPM attack paths.
BloodHound OpenGraph
Export Privileged EAM data as OpenGraph JSON and enrich AzureHound with EntraOps role assignments, scope reasoning, tier evidence, nested groups, PAW ownership and identity relationships. The Access Path Map carries the same context into an offline, interactive graph.
Learn
Adopt EntraOps with practical guidance, explore its classification model, or watch the Enterprise Access Model in action.
Set up the module, configure your tenant, and connect each capability to an operating workflow.
Get familiar with the tiering model, role actions and classification decisions behind EntraOps.
Learn more about EntraOps, its use cases and core concepts through hands-on demos from community conferences.
Choose your setup
Use the guided defaults for a fast first run, or shape the EntraOps configuration around your tenant, scope and operating model before deployment.
Deploy
Start from the EntraOps repository template, run it locally or in GitHub, and keep privileged-access evidence in a workflow your team owns.
Use the repository templateDesigned for PowerShell Core.
Run EntraOps locally,
in a CI/CD pipeline, or in your automation environment. The included reporting apps are static
and self-contained.
Contributions
EntraOps is maintained as a community project. Contributions, issue reports and feature requests are welcome on GitHub.
Creator & main contributor
Contributor · BloodHound integration
Contributor · Code improvements
Contributor · LZ Bootstrap
Contributor · Testing & feedback