CloudGuru

Open-source tool · EntraGuard

EntraGuard

Identity security posture management for Microsoft Entra ID.

EntraGuard assesses a Microsoft Entra ID tenant through the Microsoft Graph API and shows the result as a posture score, findings and a remediation plan. Every finding explains why it matters, lists the affected users, apps or policies, and gives numbered steps to fix it, with links to Microsoft documentation.

View on GitHub ↗Quick start
Checks
115
Domains
12
Images
v2.1, amd64 + arm64
Stack
FastAPI, React, Celery, PostgreSQL, Redis

Why it exists

Questions it answers

Are Conditional Access policies complete?

22 checks, including break-glass exclusion, MFA for all users, legacy auth blocking and risk-based policies.

Is MFA strong enough?

11 checks, including admin MFA, number matching and phishing-resistant methods.

Is privileged access under control?

PIM and privileged-account checks: no permanent assignments, JIT activation, cloud-only admins, Global Admin count.

Are apps and guests a risk?

14 application checks (credential expiry, consent, redirect URIs) and 6 guest checks.

Do break-glass accounts work?

Checks that they exist, are excluded from Conditional Access and have their passwords rotated.

How does it map to frameworks?

Findings are mapped to NIST CSF 2.0, CIS Azure v2 and ISO 27001:2022.

Features

What it does

Assessment engine

  • 115 automated checks across 12 security domains
  • Runs against the live tenant through Microsoft Graph
  • Scans complete in under 5 minutes
  • Daily scheduled scan at 06:00 UTC, configurable with cron

Dashboard

  • Security posture score with trend charts
  • Severity breakdown: Critical, High, Medium, Low
  • Domain heat map and top-5 highest-risk findings
  • Compliance coverage per category

Findings and exceptions

  • Filter by severity, status and text
  • Why it matters, how to fix it, affected resources and raw evidence
  • Mark as Fixed, Risk Accepted, False Positive or In Progress, with notes
  • CSV export

Remediation and alerts

  • Grouped by effort: quick wins, short term, project
  • Email alerts on new Critical findings
  • Microsoft Teams and Slack scan summaries
  • Runs several tenants side by side as separate stacks

How it fits together

Architecture

  1. 01React dashboard (Nginx)
  2. 02FastAPI REST API
  3. 03Celery worker and scheduler
  4. 04PostgreSQL and Redis
  5. 05Microsoft Graph API, read-only

Quick start

Try it

Run from Docker Hub
mkdir entra-guard && cd entra-guard
# create docker-compose.yml and .env from the README
docker compose pull
docker compose up -d
# dashboard at http://localhost:3000
Create the app registration automatically
# PowerShell 7+, Microsoft Graph PowerShell SDK
.\Setup-EntraGuardSPN.ps1

The full setup guide is in the README on GitHub.

Before you start

Permissions needed

Directory, users, groups, appsDirectory.Read.All, User.Read.All, Group.Read.All, Application.Read.All
Policies and rolesPolicy.Read.All, RoleManagement.Read.Directory, PrivilegedAccess.Read.AzureAD
Sign-ins, risk and reportsAuditLog.Read.All, IdentityRiskyUser.Read.All, Reports.Read.All, SecurityEvents.Read.All
Authentication and reviewsUserAuthenticationMethod.Read.All, AccessReview.Read.All

Good to know

EntraGuard is read-only: it makes only GET requests to Microsoft Graph and never changes your tenant. It runs on your own infrastructure, and findings stay in your own PostgreSQL database. PIM, Identity Protection and access review checks need Entra ID P2 or Entra ID Governance.