AADInternals is a PowerShell module for inspecting and managing Microsoft Entra ID and related cloud identity services. Security teams use it for auditing, but attackers can abuse it for tenant reconnaissance and identity manipulation, so defenders should monitor privileged cloud identity actions and unusual PowerShell use.
What AADInternals Is Used For
AADInternals is a PowerShell module for exploring and administering Microsoft Entra ID and related cloud identity services. It is often used by defenders for tenant inspection and auditing, but the same administrative reach also makes it useful for reconnaissance and identity manipulation when abused.
Because the module operates directly against cloud identity administration surfaces, it sits close to the control plane rather than the application layer. That means its value depends on who can run it, what permissions are present, and whether those actions are normal for the environment or suspicious enough to investigate.
Why It Matters in Cloud Identity Operations
Tools like this become important because cloud identity is often the gateway to everything else in a tenant. If an operator can enumerate directories, inspect synchronization settings, or alter identity-related objects, they may be able to find paths to privilege escalation, persistence, or lateral movement.
For defenders, the term is less about a single feature set and more about the fact that a legitimate administration tool can blend in with normal PowerShell activity. In a Microsoft identity environment, that makes command context, execution origin, and privileged action patterns far more important than the tool name alone.
How Defenders Should Think About Exposure
Exposure is usually determined by the combination of permissions, host trust, and monitoring coverage. If administrative endpoints, jump hosts, or automation accounts can run the module broadly, then the organisation should assume it can be used to inspect tenant structure and identity relationships from a trusted context.
That is why defenders should correlate PowerShell usage with privileged cloud identity operations and review whether the activity lines up with approved administration workflows. The broader tenant risk is not the module itself, but the identity changes it can make easier to discover or perform.
What Compromise Looks Like
When abused, the module can support reconnaissance before follow-on identity abuse. Attackers may use it to map privileged accounts, review directory sync relationships, or identify paths to service account abuse and token-based access. For context on how cloud identity abuse can unfold in practice, see Storm-0501 hybrid cloud attacks 2024.
That makes compromise review especially important after any suspicious use. Defenders should look for unusual PowerShell execution, unexpected directory read activity, identity changes outside change windows, and signs that privileged cloud actions were chained into broader tenant takeover behaviour.
Risk and Threat Considerations
AADInternals is risky because it can be used as a legitimate-looking interface for tenant reconnaissance and identity manipulation. The danger is highest when powerful identity permissions already exist, because the module can turn those permissions into fast discovery and abuse.
Failure mechanism: A trusted PowerShell workflow is used to enumerate or alter cloud identity objects, then the attacker leverages that visibility to find higher-value accounts, sync paths, or persistence options.
Impact: The result can be privilege escalation, tenant control, token or trust abuse, and delayed detection because the activity may resemble administrative work.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | AADInternals use should be reviewed through privileged identity action logging. |
| IA-5 — Authenticator Management | The tool's abuse paths often involve secret, token, and credential handling in cloud identity. | |
| Recommendation — Correlate PowerShell activity with privileged identity changes and investigate anomalies promptly. Protect and rotate identity credentials and tokens used in privileged cloud administration. | ||
| MITRE ATT&CK | T1087 — Account Discovery | AADInternals can support directory and account enumeration during tenant recon. |
| T1550 — Use Alternate Authentication Material | Cloud identity abuse often relies on tokens, sync trust, or other non-password access paths. | |
| Recommendation — Hunt for account discovery activity tied to suspicious PowerShell execution. Monitor for token and trust abuse that bypasses normal interactive authentication. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and systems are monitored to find potential cybersecurity events | Suspicious PowerShell and cloud identity actions require continuous monitoring coverage. |
| Recommendation — Extend monitoring to privileged PowerShell and cloud identity administration activity. | ||
Practitioner Guidance
What to watch for: Treat this module as a high-signal administration tool, not as malware by default. The important question is whether the execution context, user, and target actions match approved identity operations.
Governance implication: Restrict who can run advanced cloud identity tooling, review where it is allowed to execute, and ensure investigative uses are documented so legitimate administration does not mask malicious tenant probing.
Practitioner takeaway: The safest assumption is that any unusual AADInternals activity deserves correlation with privileged identity actions, because the same capability that helps auditors can also help an attacker move quickly through a tenant.
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org