ROADRecon Azure AD

roadrecon auth -u <user> -p <pass>; roadrecon gather

Dump Azure AD information (users, groups, roles, devices, policies) with ROADtools and save it to SQLite for offline querying.

Run it when you have credentials for an Azure AD user (phishing, dump, token) and want to map the tenant without leaving repeated calls: roadrecon gather makes the Graph API calls once, saves everything to a local database, and then you query offline. Ideal for planning escalations (privileged roles, dynamic groups).

Graph API calls remain in Azure AD sign-in logs and audit logs. Accounts with Conditional Access (managed devices only) will fail authentication. For a single data point (a user, a role), a direct Graph call is more discreet.