You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Monkey365 supports direct authentication using **access tokens**, enabling fully non‑interactive execution for automation, CI/CD pipelines or service‑principal–based workflows.
8
+
This feature allows users to pass one or more access tokens to Monkey365, which will automatically route each token to the correct API based on its **audience** (`aud`) claim.
9
+
10
+
## Overview
11
+
12
+
You can provide access tokens to Monkey365 by using the `-AccessToken` parameter. The parameter accepts a single token (string) or multiple tokens (array of strings).
13
+
14
+
Each token is inspected to determine which Microsoft 365 or Azure service it applies to. Monkey365 then uses the appropriate token when making API calls.
Monkey365 supports multiple authentication methods when connecting to Microsoft Entra ID. By default, Monkey365 uses the **Azure PowerShell client ID**`1950a258-227b-4e31-a9cf-717495945fc2`.
8
+
9
+
This <ahref='https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-microsoft-tenant-owned-applications'target='_blank'>client ID</a> is **pre‑authorized by Microsoft** for a **limited set of Microsoft Graph scopes**. Using the default clientId is enough for basic configuration review, but the application do **not** include many of the advanced or privileged scopes required for deeper Entra ID assessments, so there will be collectors that won't be allowed to fetch results due to lack of granted scopes.
10
+
11
+
To support more advanced scenarios, Monkey365 also allows authentication using Microsoft's tenant‑owned Microsoft Graph Client ID `14d82eec-204b-4c2f-b7e8-296a70dab67e`
12
+
13
+
Using this client ID enables Monkey365 to request additional Microsoft Graph scopes that are **not available** through the **Azure PowerShell client ID**, such as `RoleManagement.Read.Directory` or `PrivilegedAccess.Read.AzureADGroup`. Using this clientId provides Monkey365 with broader visibility into privileged roles, access policies or directory‑wide configuration.
14
+
15
+
## Enabling Microsoft Graph Authentication
16
+
17
+
To switch from the default Azure PowerShell client ID to the Microsoft‑owned Graph Client ID, set the `useMgGraph` property to `true` in your [monkey365.config](../configuration/configuration-file.md) configuration file:
18
+
19
+
```json
20
+
"mgGraph": {
21
+
"useMgGraph": "true"
22
+
...
23
+
}
24
+
```
25
+
When enabled, Monkey365 will automatically use the Microsoft Graph Client ID during authentication and request the required permissions.
26
+
27
+
## Microsoft Graph Permissions
28
+
29
+
When the Microsoft Graph Client ID is selected, Monkey365 will request the following Microsoft Graph scopes:
30
+
31
+
- User.Read.All
32
+
- Application.Read.All
33
+
- Policy.Read.All
34
+
- Organization.Read.All
35
+
- OrgSettings-AppsAndServices.Read.All
36
+
- RoleManagement.Read.Directory
37
+
- GroupMember.Read.All
38
+
- Directory.Read.All
39
+
- PrivilegedEligibilitySchedule.Read.AzureADGroup
40
+
- PrivilegedAccess.Read.AzureADGroup
41
+
- RoleManagementPolicy.Read.AzureADGroup
42
+
- Group.Read.All
43
+
- SecurityEvents.Read.All
44
+
- IdentityRiskEvent.Read.All
45
+
- UserAuthenticationMethod.Read.All
46
+
- AuditLog.Read.All
47
+
- AccessReview.Read.All
48
+
49
+
These permissions allow Monkey365 to perform a comprehensive security and configuration assessment across Entra ID, including privileged access, audit logs, identity protection, and directory‑wide configuration.
50
+
51
+
The above scopes are configurable and can be set in [monkey365.config](../configuration/configuration-file.md) configuration file under the scopes section, as shown below:
If you are authenticating with the Microsoft Graph Client ID for the first time, you will be prompted to grant the necessary permissions, as shown below:
Copy file name to clipboardExpand all lines: docs/configuration/general-options.md
+5Lines changed: 5 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -83,6 +83,11 @@ Use this flag to list available frameworks:
83
83
Invoke-Monkey365 -ListFramework
84
84
```
85
85
86
+
```-AccessToken```
87
+
88
+
Use this flag to provide external access tokens. More information can be seen [here](../authentication/access_token.md)
89
+
90
+
86
91
## Listing collectors
87
92
88
93
The `-ListCollector` flag is used to display a list of available collectors within Monkey365. Collectors are modular components that gather specific sets of data from cloud environments such as Azure, Microsoft 365, or Entra ID.
Monkey365 is an Open Source security tool that can be used to easily conduct not only Microsoft 365, but also Azure subscriptions and Microsoft Entra ID security configuration reviews without the significant overhead of learning tool APIs or complex admin panels from the start.
13
23
14
-
Monkey365 has been designed to tackle these difficulties and get results fast and without any requirements. The results will be visualised in a simplified HTML report to quickly identify potential issues. As such, security consultants will be able to effectively address issues from a single vulnerability report.
24
+
Monkey365 has been designed to tackle these difficulties and get results fast and without any requirements. The results can be visualised in a simplified HTML report to quickly identify potential issues. As such, security consultants will be able to effectively address issues from a single vulnerability report. Click through findings, and evidence in a report format suitable for reviews.
15
25
16
26
17
27
@@ -25,10 +35,56 @@ To help with this effort, Monkey365 also provides several ways to identify secur
25
35
26
36
Monkey365 works in three phases. In the first phase, collectors will issue queries against the multiple data sources to retrieve the desired metadata about targeted tenant or subscription, and then will collect information. Once all the necessary metadata is collected, the result is passed to an internal module in order to start the verifying phase, in which the tool uses the data collected in first phase to perform query search with a default set of rules, as a mechanism to evaluate the configuration and to search for potential misconfigurations and security issues. The third phase starts to generate reports, such as an HTML report containing structured data for quick checking and verification of the results.
0 commit comments