// Entra Privileged Access Audit

Stop shipping
god-mode accounts
to production.

Find privilege drift in Microsoft 365 / Entra ID before it becomes an incident. Intern God-Mode — the pattern of over-privileged identities that accumulate through ticket-driven permission creep and onboarding laziness. The free scanner is read-only and local; the paid toolkit handles rollback-safe remediation.

WE DON'T EVEN WANT YOUR EMAIL.
SCAN FREE.
free audit — no sign-up
PowerShell 
PS> irm https://raw.githubusercontent.com/algonoco/algono/main/prontoso/Scan-EntraPrivilegedUsers.ps1 -OutFile .\Scan-EntraPrivilegedUsers.ps1
PS> notepad .\Scan-EntraPrivilegedUsers.ps1
PS> .\Scan-EntraPrivilegedUsers.ps1 -TenantIdOrDomain yourtenant.onmicrosoft.com -UseDeviceAuthentication
open script in browser
Inspect first. Runs locally. Writes reports only to your workstation.
// scan
[ CRIT ] svc_deploy — Global Administrator, stale sign-in, no documented owner
[ CRIT ] intern_jsmith — Global Administrator via nested group SALES_ALL → HELPDESK_TIER1
[ HIGH ] breakglass_old — privileged role assignment outside exception list
[ HIGH ] guest_admin — external identity with privileged directory exposure
[ INFO ] Summary written to ./artifacts/entra-privileged-scan/summary.md

// what it targets

Entra privilege drift, visible.

  • Stale Global Admin and privileged role assignments
    Weak ownership or stale sign-in signals on high-blast-radius identities
    Critical
  • Privileged users outside your exception model
    Accounts with privileged roles but no approved business reason
    Critical
  • Group-inherited privileged access paths
    Group membership that creates effective privileged role exposure
    High
  • Eligible privileged assignments
    PIM eligibility review when requested and available in the tenant
    High
  • External identities with privileged exposure
    Guest or external accounts appearing in privileged assignment paths
    High
  • Review-ready local artifacts
    JSON, CSV, and Markdown output for triage and change-control notes
    Medium

// what you get

Scan, remediate, roll back.

[01]
Audit Script — read-only
PowerShell. Connects to Entra ID through Microsoft Graph. Produces structured JSON/CSV findings and a Markdown summary. No writes. No callback. No agent.
[02]
Remediation Toolkit
Paid toolkit applies fixes from the findings report. Every write operation is captured in a timestamped rollback manifest before execution. Supports dry-run mode.
[03]
Rollback Path
Rollback reads the manifest and restores role assignments, group memberships, and account states captured before remediation.
[04]
Single-org perpetual license
One tenant. No seats, no SaaS, no callbacks. Public scanner stays inspectable; paid remediation is delivered separately.
rollback.ps1 — example session PowerShell 
PS> ./algono-rollback.ps1 -Manifest ./algono-rollback-2026-04-04T031200Z.json

  Algono Rollback v1.x
  Manifest: 2026-04-04T03:12:00Z  |  14 operations
  ────────────────────────────────────────────────

  [01/14] Restoring svc_deploy → Global Administrator assignment ... OK
  [02/14] Reverting intern_jsmith → inherited role path ......... OK
  [03/14] Re-enabling app_reg_legacy Graph role assignment .... OK
  [...]
  [14/14] Guest account restore complete ...................... OK

  ────────────────────────────────────────────────
  Rollback complete. 14/14 operations succeeded.
  Verify in the Entra admin portal before closing change ticket.

// pricing

One price. No games.

$400
one-time · single org
  • Audit script (read-only, inspectable, safe to run locally)
  • Remediation script with dry-run mode
  • Rollback script + JSON manifest format
  • Delivery handled separately from the public scanner repo
  • Perpetual license for the current version — no maintenance tail, no forced updates
$ checkout — $400

Payment via Stripe. Toolkit delivery is separate from the public scanner repository.
Software provided as-is. One-time purchase for the current toolkit build. No subscription, no recurring fees, no automated updates.
Questions: [email protected]

// faq

Common questions.

No agent. No persistent install. PowerShell scripts you run on-demand from a management workstation or jump host with appropriate Microsoft Graph permissions. Nothing phones home.
Read-only. For the public Entra scanner: User.Read.All, AuditLog.Read.All, RoleManagement.Read.Directory, and GroupMember.Read.All delegated Microsoft Graph scopes.
One Entra ID tenant. Run it as many times as you want against that environment. If you need to use it across multiple client tenants (MSP scenario), contact [email protected].
JSON flat file. Each entry records: operation type, target object (DN or Entra OID), attribute changed, prior value, new value, and a timestamp. Human-readable. You can inspect it before running rollback, or integrate it with your change management tooling.
The free audit script is a direct download. No sign-up, no issue to open, no email required. Save it locally, inspect it, then run it with your tenant: .\Scan-EntraPrivilegedUsers.ps1 -TenantIdOrDomain yourtenant.onmicrosoft.com -UseDeviceAuthentication. Read-only, no writes. If you have findings worth fixing, the toolkit is $400.
The paid remediation toolkit is delivered separately from this public scanner repository so the free scanner can remain inspectable without exposing paid artifacts.