{"id":51972425,"url":"https://github.com/9t29zhmwdh-coder/entra-access-graph-engine","last_synced_at":"2026-07-30T00:01:32.421Z","repository":{"id":365834270,"uuid":"1273973103","full_name":"9t29zhmwdh-coder/entra-access-graph-engine","owner":"9t29zhmwdh-coder","description":"Map Entra ID objects to a privilege access graph. Detect escalation paths, hidden admin chains, and risk scores. Rust, Microsoft Graph API.","archived":false,"fork":false,"pushed_at":"2026-07-17T11:56:51.000Z","size":218,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-17T13:18:04.550Z","etag":null,"topics":["access-graph","azure-active-directory","entra-id","microsoft-graph","privilege-escalation","rust","security"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/9t29zhmwdh-coder.png","metadata":{"files":{"readme":"README.de.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":"ROADMAP.md","authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-19T04:09:06.000Z","updated_at":"2026-07-17T11:28:33.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/9t29zhmwdh-coder/entra-access-graph-engine","commit_stats":null,"previous_names":["9t29zhmwdh-coder/entra-access-graph-engine"],"tags_count":9,"template":false,"template_full_name":null,"purl":"pkg:github/9t29zhmwdh-coder/entra-access-graph-engine","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/9t29zhmwdh-coder%2Fentra-access-graph-engine","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/9t29zhmwdh-coder%2Fentra-access-graph-engine/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/9t29zhmwdh-coder%2Fentra-access-graph-engine/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/9t29zhmwdh-coder%2Fentra-access-graph-engine/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/9t29zhmwdh-coder","download_url":"https://codeload.github.com/9t29zhmwdh-coder/entra-access-graph-engine/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/9t29zhmwdh-coder%2Fentra-access-graph-engine/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36053559,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-29T02:00:04.910Z","response_time":95,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["access-graph","azure-active-directory","entra-id","microsoft-graph","privilege-escalation","rust","security"],"created_at":"2026-07-30T00:01:31.415Z","updated_at":"2026-07-30T00:01:32.391Z","avatar_url":"https://github.com/9t29zhmwdh-coder.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n  \u003cimg src=\"RayStudio.png\" alt=\"RayStudio Logo\" width=\"120\"/\u003e\n\n  \u003ch1\u003eentra-access-graph-engine\u003c/h1\u003e\n\u003c/div\u003e\n\n[🇬🇧 English Version](README.md)\n\n**Alle Entra-ID-Objekte in einen Zugriffsgraphen umwandeln. Eskalationspfade, versteckte Admin-Chains und Risikobewertungen erkennen. Rust, Offline-first, OTLP-ready.**\n\nRuft Benutzer, Gruppen, Rollen, Applikationen, Service Principals, AppRoleAssignments und DirectoryRoles über die Microsoft Graph API ab und erstellt daraus einen gerichteten Zugriffsgraphen. Die Engine erkennt Privilege-Escalation-Pfade, versteckte Admin-Chains (App → SP → Gruppe → GlobalAdmin) und klassifiziert jeden Knoten und jeden Pfad nach Risiko (Low / Medium / High / Critical). Export als JSON, GraphML oder selbstenthaltenem HTML-Report mit interaktivem D3.js-Graphen.\n\n[![CI](https://github.com/9t29zhmwdh-coder/entra-access-graph-engine/actions/workflows/ci.yml/badge.svg)](https://github.com/9t29zhmwdh-coder/entra-access-graph-engine/actions) [![CodeQL](https://github.com/9t29zhmwdh-coder/entra-access-graph-engine/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/9t29zhmwdh-coder/entra-access-graph-engine/security/code-scanning) [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/9t29zhmwdh-coder/entra-access-graph-engine/badge)](https://securityscorecards.dev/viewer/?uri=github.com/9t29zhmwdh-coder/entra-access-graph-engine) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13710/badge)](https://www.bestpractices.dev/projects/13710)\n\n![Microsoft | Entra ID](https://img.shields.io/badge/Microsoft-Entra_ID-0078d4?logo=microsoftazure\u0026logoColor=white) ![Platform](https://img.shields.io/badge/Platform-Windows_%7C_Ubuntu-lightgrey) ![Rust](https://img.shields.io/badge/Rust-CE422B?logo=rust\u0026logoColor=white) ![AI | Claude Code](https://img.shields.io/badge/AI-Claude_Code-black?logo=anthropic\u0026logoColor=white) ![AI | Copilot](https://img.shields.io/badge/AI-Copilot-black?logo=github\u0026logoColor=white)\n\n\u003e **So läuft das:** Dieses Tool ist ein Kommandozeilenprogramm, keine Desktop-App und kein Server. `eagraph scan` läuft einmal durch und schreibt einen Report (JSON/GraphML/HTML), es gibt keinen Installer und keinen Hintergrundprozess.\n\n![entra-access-graph-engine](docs/screenshot.png)\n\n---\n\n\u003e 🌱 Neu hier? → [Schritt-für-Schritt-Anleitung für Einsteiger](GETTING_STARTED.md)\n\n---\n\n**In der Praxis:** Du bekommst einen HTML-Report mit interaktivem Graphen, der zeigt, welche Konten über welche Ketten Admin-Rechte erreichen können, ganz ohne Azure-Zugangsdaten testbar via `--dry-run`.\n\n## Funktionen\n\n| Funktion | Beschreibung |\n|---|---|\n| Vollständige Entra-ID-Abdeckung | Benutzer, Gruppen, DirectoryRoles, Apps, Service Principals, AppRoleAssignments, OAuth2PermissionGrants |\n| Privilege-Chain-Erkennung | BFS bis Tiefe 6 von jedem Hochrisikoknoten, findet alle Eskalationspfade |\n| Risikobewertung | Bekannte Role-Template-IDs und Graph-API-Berechtigungen → Critical / High / Medium / Low |\n| Drei Exportformate | JSON, GraphML (Gephi/yEd), HTML mit interaktivem D3.js-Graphen |\n| Wöchentlicher Scan | GitHub-Actions-Workflow für geplante Risikoberichte als Artefakte |\n| Dry-Run-Modus | `--dry-run` nutzt internen Mock-Graphen für CI und Demos ohne Azure-Zugangsdaten |\n\n---\n\n## Risikolevel\n\n| Level | Beispiele |\n|---|---|\n| Critical | Global Administrator, Privileged Role Administrator, Apps mit `RoleManagement.ReadWrite.Directory` |\n| High | Application Administrator, User Administrator, Exchange Administrator, Apps mit `User.ReadWrite.All` |\n| Medium | Alle anderen Directory-Rollen |\n| Low | Benutzer, Gruppen, Apps ohne bekannte Hochrisiko-Berechtigungen |\n\n---\n\n## Voraussetzungen\n\n- Rust 1.78+\n- Azure App-Registrierung mit **Anwendungs**-Berechtigungen (nicht delegiert): `Directory.Read.All`, `RoleManagement.Read.Directory`, `Application.Read.All`\n\n---\n\n## Schnellstart\n\n```bash\ngit clone https://github.com/9t29zhmwdh-coder/entra-access-graph-engine.git\ncd entra-access-graph-engine\ncargo build --release\n\n# Ohne Azure-Zugangsdaten testen\n./target/release/eagraph scan --dry-run --format html --output report\n\n# Live-Scan\nexport AZURE_TENANT_ID=your-tenant-id\nexport AZURE_CLIENT_ID=your-client-id\nexport AZURE_CLIENT_SECRET=your-client-secret\n./target/release/eagraph scan --format html --output report --min-risk high\n```\n\n---\n\n## Deinstallation / Datenbereinigung\n\nLösche das `target/` Build-Verzeichnis und die generierten Report-Dateien (`report.html`, `.json`, `.graphml`). Es werden keine Zugangsdaten oder Zwischenergebnisse ausserhalb dieser Dateien gespeichert.\n\n---\n\n## Projektstruktur\n\n```\ncrates/\n  eagraph-core/src/\n    graph_client.rs      Microsoft Graph API Client (OAuth2, Paginierung)\n    node_builder.rs      API-Antwort zu Node/Edge-Modell + Mock-Graph\n    edge_analyzer.rs     petgraph DiGraph (EntraGraph)\n    chain_detector.rs    BFS Privilege-Chain-Finder (max. Tiefe 6)\n    risk_scorer.rs       Rollenvorlagen-IDs und Berechtigungsbasierte Risikobewertung\n    exporter.rs          JSON, GraphML, HTML + D3.js Export\n    model.rs             Node, Edge, AccessGraph, PrivilegeChain, RiskReport\n  eagraph-cli/src/\n    main.rs              CLI-Einstiegspunkt (clap)\n.github/workflows/\n  ci.yml                 Ubuntu + Windows CI\n  weekly-scan.yml        Wöchentlicher Scan montags 06:00 UTC\n```\n\n---\n\n## Ausgabebeispiele\n\nSiehe [`examples/sample_graph.json`](examples/sample_graph.json) und [`examples/sample_risk_report.json`](examples/sample_risk_report.json).\n\n---\n\n## Azure-Integration\n\nSiehe [`docs/azure_integration.md`](docs/azure_integration.md) für:\n- Einrichtung der App-Registrierung und benötigte Berechtigungen\n- Konfiguration der GitHub-Actions-Secrets für den wöchentlichen Scan\n- KQL-Abfragen für Application Insights\n\n---\n\n## Roadmap\n\nSiehe [ROADMAP.md](ROADMAP.md).\n\n---\n\n**Autor:** [Rafael Yilmaz](https://github.com/9t29zhmwdh-coder) · **Status:** Active · ![version](https://img.shields.io/github/v/release/9t29zhmwdh-coder/entra-access-graph-engine?color=6b7280\u0026style=flat-square) · **Lizenz:** MIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F9t29zhmwdh-coder%2Fentra-access-graph-engine","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F9t29zhmwdh-coder%2Fentra-access-graph-engine","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F9t29zhmwdh-coder%2Fentra-access-graph-engine/lists"}