EntraGuard Features

Collection (Microsoft Graph)

EntraGuard collects via 13 dedicated async collectors with pagination, retry and rate limiting.

License Optimization

5 license-aware rules cross-check your tenant's purchased Microsoft SKUs against the Zero Trust capabilities they unlock. Flags paid-for features that were never activated.

Feature Catalog

Built-in Zero Trust reference mapping Microsoft SKUs to capabilities per pillar (Verify Explicitly, Least Privilege, Assume Breach). Auto-updated weekly, manual refresh, semver-aware versioning. Available under Settings → Feature Catalog.

Compliance Reports

Generate compliance reports against 4 industry frameworks. Each report maps EntraGuard findings to framework controls with a coverage score and per-control pass/fail detail. Export as branded PDF.

Per-finding PDF export

Export any individual finding as a branded PDF. Includes severity, evidence, affected resources, MITRE ATT&CK mapping, compliance framework references and step-by-step remediation (Entra admin center, PowerShell, Graph API). Useful for sharing specific findings with remediation owners without exposing the full audit report.

LDAP Hybrid AD Analysis

On-premise Active Directory collector via LDAP. Collects AD users, groups and computers, then correlates with Entra ID objects via SYNCED_TO_ENTRA bridge relationships in Neo4j.

Realtime Monitoring Enterprise

Microsoft Graph change notifications detect directory changes (user, group, role, app modifications) in near real-time. Webhook receiver with Redis debouncing triggers automatic incremental collection via Celery tasks. Subscription renewal is managed by Celery Beat. Enables continuous security posture monitoring without scheduled full scans.

Analysis — rule engines

MITRE ATT&CK mapping

Every finding is mapped to MITRE ATT&CK Cloud Matrix tactics and techniques:

• TA0001 Initial Access (T1078.004 Cloud Accounts)
• TA0003 Persistence (T1098.001, T1098.003)
• TA0004 Privilege Escalation (T1484.002, T1098.005)
• TA0005 Defense Evasion (T1548.005)
• TA0008 Lateral Movement (T1550.001 Application Access Token)

Attack graph (Neo4j)

Built-in queries: all paths to Global Admin, transitive access to sensitive apps, role-assignable groups with guests, shortest path between nodes. Interactive viewer with Cypher query builder and PNG/SVG export.

Scoring & grading

• Score 0–100 weighted on: finding criticality (Critical x10, High x5, Medium x2, Low x1), viable attack paths, admin surface, MFA posture, CA posture
• Grade: A (≥90), B (≥75), C (≥60), D (≥40), F (<40)
• Breakdown by category: Identity, Privileged Access, Conditional Access, Applications, Devices, Governance
• Score delta: difference between two audits — new findings, resolved findings, score drift, attack path evolution

Reports

Remediation tutorials

Each finding includes step-by-step remediation via the Entra admin center, PowerShell / Microsoft Graph SDK equivalent, Graph API (HTTP method + payload) and references to Microsoft docs, CIS benchmarks and MITRE.

API & automation

• REST API — /api/v1 (internal) + /export/v1 (Enterprise exports)
• Scheduler (Enterprise) — cron-based recurring audits with notifications
• Webhooks (Enterprise) — Slack, Microsoft Teams, generic HTTP JSON
• Multi-tenant (Enterprise) — up to 10 Entra ID tenants, row-level isolation, aggregated MSP scores
• SIEM integrations (Enterprise) — Splunk, Sentinel, Elastic, QRadar

Product security

• Non-root users in containers
• API keys stored as SHA-256 hashes, timing-safe comparison
• Entra ID credentials encrypted AES-GCM in database
• Licence signed RSA-2048 PKCS1v15 SHA-256
• No telemetry — structured logs with secret redaction