Attack path & identity exposure management
WHO CAN ULTIMATELY CONTROL WHAT
EntraHound turns a Microsoft Entra ID tenant into a directed security graph: every identity, group, role, application, workload, device and AI agent is a node; every membership, ownership, role, credential, permission and trust is an edge. Then it asks the only question that matters — which combinations create a path to your critical assets? Read-only, browser-only, nothing leaves your machine.
Delegated sign-in through a single-page-application registration in the tenant you want to assess. What EntraHound can see is the intersection of the app's consented permissions and your own directory role — a Global Reader or Security Reader is enough; Global Administrator is never required.
https://blue16.nl/entra-hound.htmlDirectory.Read.All — the whole core graph is built from it.Policy.Read.All, RoleManagement.Read.Directory, AuditLog.Read.All, UserAuthenticationMethod.Read.All, AgentIdentityBlueprint.Read.All, AgentIdentity.Read.All, AgentIdentityBlueprintPrincipal.Read.All. The full matrix is under Collection.file://; serve the page over http(s).A generated Contoso-style tenant with deliberately planted exposure: a guest who owns a group that holds Global Administrator, a developer who owns an app whose service principal can assign roles, a GitHub repository federated into an app with Application.ReadWrite.All, an AI agent blueprint reaching Microsoft Graph, PIM eligibility, Conditional Access exclusions and the rest. No sign-in, nothing real.
Inventory & exposure
Most exposed critical assets
Identities with the widest reach
Non-critical nodes that the most attack paths pass through. Fix these first — one change cuts many paths.