Before an attacker ever attempts to authenticate against an organization's Azure Active Directory (now Microsoft Entra ID) tenant, a surprising amount of useful reconnaissance can be gathered entirely from the outside, without valid credentials, without triggering meaningful logging in most default configurations, and often without the target organization ever realizing it happened. Understanding exactly what this external enumeration reveals is essential both for red teams simulating a realistic attack chain and for defenders trying to understand their actual exposed surface. This guide walks through the techniques and tools used for unauthenticated Azure AD enumeration. External attack surface reviews conducted by Sagefox Cybersecurity routinely begin with this exact reconnaissance phase before any authenticated testing takes place.
Why External Azure AD Enumeration Matters
The Value of Reconnaissance Before Authentication Attempts
Azure AD tenants expose a surprising number of endpoints that respond differently depending on whether a given username, domain, or configuration exists, all without requiring any authentication. An attacker who thoroughly enumerates this information before attempting any password spray or phishing campaign arrives with a validated list of real usernames, a clear picture of authentication methods in use, and often specific details about federation configuration that shape the most effective attack path.
What Defenders Often Miss About This Exposure
Many organizations focus their Azure AD security review entirely on authenticated access controls, conditional access policies, and privileged role assignments, while overlooking that a substantial amount of tenant information is discoverable by anyone on the internet with no account at all. Closing this gap requires understanding exactly what is exposed before it can be addressed.
Discovering Tenant Information from a Domain Name
Identifying the Azure AD Tenant ID
Given only a company's domain name, the tenant's unique identifier can be retrieved through a public, unauthenticated endpoint that Microsoft exposes as part of the OpenID Connect discovery process.
curl -s "https://login.microsoftonline.com/target.com/.well-known/openid-configuration" | jq .The response includes the tenant ID directly within the returned issuer field, confirming the organization uses Azure AD and providing the identifier needed for further enumeration.
Checking Whether a Domain Is Federated or Managed
Microsoft's GetUserRealm endpoint reveals whether a given domain uses Azure AD-managed authentication or is federated to an on-premises identity provider like ADFS, which meaningfully changes the most effective attack approach.
curl -s "https://login.microsoftonline.com/getuserrealm.srf?login=user@target.com&xml=1"A federated configuration pointing to an on-premises ADFS server suggests testing that ADFS endpoint directly may be more productive than attacking Azure AD's own authentication flow, while a managed configuration confirms Azure AD itself handles authentication decisions.
Enumerating Valid Usernames Without Authentication
Using the Autologon Endpoint for Username Validation
A commonly abused endpoint intended for legitimate autologon functionality can be used to confirm whether a specific email address corresponds to a valid account within the tenant, without needing a correct password.
curl -s -X POST "https://login.microsoftonline.com/common/GetCredentialType" \
-H "Content-Type: application/json" \
-d '{"Username":"jdoe@target.com"}'The response's IfExistsResult field reliably distinguishes between a valid and invalid account, allowing an attacker to validate an entire list of guessed usernames, derived from common naming conventions and information gathered through OSINT, before any actual authentication attempt.
Automating Username Enumeration at Scale
Rather than manually checking each candidate username, tools purpose-built for Azure AD reconnaissance automate this process across a full candidate list.
python3 o365spray.py --enum -U usernames.txt --domain target.comThis produces a validated list of confirmed real accounts within the tenant, which becomes the foundation for a subsequent password spraying campaign, since spraying against confirmed valid usernames is significantly more efficient and less noisy than spraying against a mix of real and non-existent accounts.
Enumerating Authentication Methods and MFA Configuration
Identifying Which Authentication Methods Are Available
The same GetCredentialType endpoint used for username validation also returns information about which authentication methods are configured for a given account, including whether multi-factor authentication challenges are likely to be presented.
curl -s -X POST "https://login.microsoftonline.com/common/GetCredentialType" \
-H "Content-Type: application/json" \
-d '{"Username":"jdoe@target.com","isOtherIdpSupported":true}'Reviewing the response for indicators of federation, managed authentication, or desktop SSO configuration provides a clearer picture of what authentication challenges an attacker should expect to encounter during a subsequent attack attempt.
Identifying Legacy Authentication Exposure
Tenants that still permit legacy authentication protocols, which do not support modern MFA challenges, remain a significant and commonly overlooked attack surface. Testing whether legacy protocols like IMAP or POP3 remain accessible against the tenant reveals a path that may bypass MFA entirely.
python3 msolspray.py --username jdoe@target.com --password 'Winter2026!' --legacy-authDiscovering Domain and Subdomain Information
Enumerating Registered Domains Within the Tenant
Organizations frequently register multiple domains within a single Azure AD tenant, and discovering the full list expands the attack surface beyond the primary domain initially identified.
curl -s "https://autodiscover-s.outlook.com/autodiscover/autodiscover.svc" \
-H "Content-Type: text/xml" \
--data-binary @autodiscover_request.xmlReviewing autodiscover responses across suspected related domains can confirm which ones share the same underlying tenant, revealing a broader footprint than the organization's primary public-facing domain suggests.
Checking for Exposed SharePoint and Teams Tenant Information
Public-facing SharePoint Online and Teams tenant URLs often follow predictable naming conventions derived from the organization's name, and checking their accessibility can reveal additional exposed surface, including externally shared documents or misconfigured guest access.
curl -s -I "https://targetcompanyname.sharepoint.com"Gathering Employee and Organizational Intelligence
Using OSINT to Build a Username Candidate List
Before any technical enumeration against Azure AD endpoints, gathering employee names through LinkedIn, company website staff pages, and press releases provides the raw material needed to construct a realistic username candidate list matching the organization's actual naming convention.
python3 theHarvester.py -d target.com -b linkedin,google -l 200Combining this OSINT-derived name list with common naming convention patterns, such as first initial plus last name or first name dot last name, produces a strong candidate list for the username validation step described earlier.
Correlating Enumeration Results with Job Postings
Job postings frequently reveal internal technology stack details, including specific mention of Azure AD, Microsoft 365, or particular security tooling in use, which helps an attacker calibrate expectations about the target's defensive maturity before attempting any active testing.
Detecting External Azure AD Enumeration Attempts
Reviewing Sign-In Logs for Enumeration Patterns
While much of this reconnaissance occurs against endpoints that generate limited or no logging by default, a sustained password spraying campaign that follows successful username enumeration does produce sign-in logs worth monitoring closely.
az monitor log-analytics query --workspace <workspace-id> \
--analytics-query "SigninLogs | where ResultType == '50126' | summarize count() by IPAddress, bin(TimeGenerated, 1h)"Reviewing failed sign-in attempts grouped by source IP address over short time windows reveals spray-style patterns, particularly a high volume of distinct usernames each tried with a low number of attempts from the same source.
Monitoring for GetCredentialType Endpoint Abuse
Some organizations have implemented monitoring specifically for high-volume requests to the username validation endpoints described above, since a legitimate user would never generate the volume of requests a systematic enumeration script produces.
Defending Against External Azure AD Enumeration
Enabling Azure AD Smart Lockout
Smart lockout functionality helps distinguish between legitimate user mistakes and systematic attack patterns, temporarily locking accounts that show clear signs of being targeted by an automated attempt rather than a genuine user who mistyped a password.
az ad policy update --id <policy-id> --set lockoutThreshold=5 lockoutDurationInSeconds=60
Disabling Legacy Authentication Protocols
Given how effectively legacy authentication bypasses modern MFA enforcement, disabling legacy protocols entirely through conditional access policy closes one of the most impactful gaps this reconnaissance phase can reveal.
az ad conditional-access policy create --display-name "Block Legacy Auth" \
--conditions client-app-types="exchangeActiveSync,other" --grant-controls blockEnforcing Conditional Access Based on Realistic Risk Signals
Conditional access policies that factor in sign-in risk, device compliance, and location can meaningfully reduce the practical impact of a successful password spray, even if enumeration and initial credential guessing succeed, by requiring additional verification before granting access.
Reducing Publicly Discoverable Organizational Information
While OSINT-derived employee names cannot be entirely eliminated as a resource for attackers, organizations can be more deliberate about what naming conventions and organizational structure details get exposed through public job postings and social media, reducing the precision of username guessing efforts. This kind of layered defense, combining authentication hardening with reduced information exposure, reflects the guidance clients typically receive following an external attack surface assessment through Sagefox Cybersecurity.
Common Mistakes Organizations Make Around This Exposure
Assuming Azure AD Security Starts at the Login Page
Treating the login page itself as the starting point of the attack surface overlooks the substantial amount of tenant, domain, and username information exposed through unauthenticated discovery endpoints well before any login attempt occurs.
Underestimating the Value of Confirmed Username Lists
Some organizations dismiss username enumeration as a low-severity finding since it does not directly grant access, without accounting for how significantly a confirmed valid username list improves the efficiency and stealth of a subsequent password spraying or phishing campaign.
Overlooking Legacy Authentication as a Legacy Problem
Legacy authentication protocols are often assumed to be a solved problem in modern Microsoft 365 environments, but tenants that have not explicitly disabled them through conditional access policy frequently still permit this bypass path, regardless of how modern the rest of the authentication configuration appears.
Key Takeaways
External Azure AD enumeration gives an attacker a meaningful head start before any authentication attempt occurs, revealing tenant configuration, federation status, valid usernames, and authentication method details entirely through unauthenticated, publicly accessible endpoints. Understanding exactly what this reconnaissance phase reveals is necessary for building a realistic picture of an organization's true external attack surface, since the login page itself is far from the actual starting point an attacker works from.
If your organization wants a thorough external assessment that includes this kind of unauthenticated Azure AD reconnaissance alongside broader attack surface review, the team at Sagefox Cybersecurity can help identify what your tenant reveals before an attacker finds it first.
