EntraOps

1.1.0-rc1

EntraOps classifies and reports privileged access in Microsoft Entra ID, Azure RBAC, Identity Governance, Intune, Defender and Microsoft Graph app roles against the Enterprise Access Model (EAM). It exports privileged assets as JSON, Microsoft Sentinel watchlists and BloodHound data, provides Tenant Governance snapshots and offline reports, and provisions service-scop
EntraOps classifies and reports privileged access in Microsoft Entra ID, Azure RBAC, Identity Governance, Intune, Defender and Microsoft Graph app roles against the Enterprise Access Model (EAM). It exports privileged assets as JSON, Microsoft Sentinel watchlists and BloodHound data, provides Tenant Governance snapshots and offline reports, and provisions service-scoped landing zones (Service EM). Requires PowerShell 7.4+.
Show more

Minimum PowerShell version

7.4

This is a prerelease version of EntraOps.

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name EntraOps -AllowPrerelease

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name EntraOps -Prerelease

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2024-2026 Thomas Naunheim. All rights reserved.

Package Details

Author(s)

  • Thomas Naunheim

Tags

AzureAD Entra EntraID Azure Security PrivilegedAccess EnterpriseAccessModel PIM RBAC IdentityGovernance Intune Defender EntraOps

Functions

Clear-EntraOpsCache Connect-EntraOps Disconnect-EntraOps Expand-EntraOpsPrivilegedEamJsonFile Export-EntraOpsClassificationApiPermissions Export-EntraOpsClassificationAppRoles Export-EntraOpsClassificationAzureRoles Export-EntraOpsClassificationDeviceManagementRoles Export-EntraOpsClassificationDirectoryRoles Export-EntraOpsClassificationDirectoryRolesFromMsftDocs Export-EntraOpsClassificationIdentityGovernanceRoles Export-EntraOpsClassificationScopes Export-EntraOpsPrivilegedEAMBloodHound Get-EntraOpsAgentObject Get-EntraOpsCacheStatistics Get-EntraOpsClassificationControlPlaneObjects Get-EntraOpsClassificationDirectoryRolesMismatchFromMsftDocs Get-EntraOpsEntraObject Get-EntraOpsManagedIdentityAssignments Get-EntraOpsUpdateCandidate Get-EntraOpsUpdatePlan Get-EntraOpsPrivilegedAppRoles Get-EntraOpsPrivilegedAzureRoles Get-EntraOpsPrivilegedEAMAzure Get-EntraOpsPrivilegedDefenderRoles Get-EntraOpsPrivilegedDeviceRoles Get-EntraOpsPrivilegedEAM Get-EntraOpsPrivilegedEAMDefender Get-EntraOpsPrivilegedEAMEntraId Get-EntraOpsPrivilegedEAMIdGov Get-EntraOpsPrivilegedEAMIntune Get-EntraOpsPrivilegedEAMResourceApps Get-EntraOpsPrivilegedEAMResourceAppsFirstParty Get-EntraOpsPrivilegedEntraIdRoles Get-EntraOpsPrivilegedEntraObject Get-EntraOpsPrivilegedIdGovRoles Get-EntraOpsPrivilegedTransitiveGroupMember Get-EntraOpsTenantGovernanceSnapshot Get-EntraOpsTenantGovernanceSnapshotReport Get-EntraOpsWorkloadIdentityAttackPaths Get-EntraOpsWorkloadIdentityInfo Get-EntraOpsWorkloadIdentityRecommendations Initialize-EntraOpsWorkspace Install-EntraOpsAllRequiredModules Install-EntraOpsReportingFolder Install-EntraOpsRequiredModule Invoke-EntraOpsAzGraphQuery Invoke-EntraOpsAzQuery Invoke-EntraOpsGraphSecurityQuery Invoke-EntraOpsMsGraphQuery Invoke-EntraOpsPrivilegedEAM Invoke-EntraOpsReportingGeneration Invoke-EntraOpsTenantGovernanceSnapshot Install-EntraOpsUpdateCandidate New-EntraOpsAccessPackageFlowData New-EntraOpsAccessPathMapData New-EntraOpsClassificationExplorerData New-EntraOpsConfigFile New-EntraOpsPrivilegedAdministrativeUnit New-EntraOpsPrivilegedAssetsData New-EntraOpsPrivilegedConditionalAccessGroup New-EntraOpsPrivilegedEamDashboardData New-EntraOpsPrivilegedEamPrivilegeHistoryData New-EntraOpsPrivilegedUnprotectedAdministrativeUnit New-EntraOpsReportingData New-EntraOpsTenantGovernanceConfigurationAnalyzerData New-EntraOpsTierBreachAnalyzerData New-EntraOpsWorkloadIdentity Convert-EntraOpsExportToSampleData Push-EntraOpsLogsIngestionAPI Register-EntraOpsTenantGovernanceServicePrincipal Resolve-EntraOpsUpdateSource Remove-EntraOpsData Remove-EntraOpsReportingData Save-EntraOpsPrivilegedEAMEnrichmentToWatchLists Save-EntraOpsPrivilegedEAMInsightsCustomTable Save-EntraOpsPrivilegedEAMJson Save-EntraOpsPrivilegedEAMWatchLists Save-EntraOpsTenantGovernanceSnapshotJson Save-EntraOpsWorkloadIdentityEnrichmentWatchLists Save-EntraOpsWorkloadIdentityInfo Test-EntraOpsTenantGovernancePrerequisite Test-EntraOpsGeneratedArtifacts Test-EntraOpsUpdateContract Update-EntraOps Update-EntraOpsClassificationControlPlaneScope Update-EntraOpsClassificationExplorerData Update-EntraOpsClassificationFiles Update-EntraOpsClassificationModels Update-EntraOpsPrivilegedAdministrativeUnit Update-EntraOpsPrivilegedConditionalAccessGroup Update-EntraOpsPrivilegedUnprotectedAdministrativeUnit Update-EntraOpsPrivilegedUnprotectedElmCatalog Update-EntraOpsAzureDevOpsSchedules Update-EntraOpsRequiredWorkflowParameters Get-EntraOpsServiceEMReport New-EntraOpsServiceAZContainer New-EntraOpsServiceBootstrap New-EntraOpsServiceEMAccessPackage New-EntraOpsServiceEMAccessPackageResourceAssignment New-EntraOpsServiceEMAssignment New-EntraOpsServiceEMAssignmentPolicy New-EntraOpsServiceEMCatalog New-EntraOpsServiceEMCatalogResource New-EntraOpsServiceEMCatalogResourceRole New-EntraOpsServiceEntraGroup New-EntraOpsServicePIMAssignment New-EntraOpsServicePIMPolicy New-EntraOpsSubscriptionLandingZone Remove-EntraOpsServiceCatalog

PSEditions

Core

Dependencies

This module has no dependencies.

Release Notes

Adds Service EM: service-scoped landing zones aligned with the Enterprise Access Model (Azure resource group, Entra groups, Identity Governance access packages, PIM and Azure RBAC with ABAC constrained delegation), Azure DevOps pipelines, module-only use from the PowerShell Gallery (Initialize-EntraOpsWorkspace, Remove-EntraOpsData), the Object Classification File, agent identity collection and the Privileged Assets report with Maester findings. Full changelog: https://github.com/Cloud-Architekt/EntraOps/blob/main/CHANGELOG.md

FileList

Version History

Version Downloads Last updated
1.1.0-rc1 (current version) 12 10/22/2026
1.0.0 35 10/13/2026