IDENTITYGUARD ENTRA COLLECTOR V0.1
==================================

Purpose
-------
Creates an IdentityGuard-compatible JSON assessment file from a Microsoft Entra ID
tenant using delegated, read-only Microsoft Graph access.

The JSON remains on the administrator's local computer. The administrator chooses
whether to import it into IdentityGuard.

What V0.1 collects
------------------
- User account status and user type
- Recent sign-in age, when available
- MFA registration state, when available
- Direct Microsoft Entra directory role assignments
- Conditional Access policy inventory and direct exclusions
- Application registrations and configured API permissions
- Basic application credential age
- Counts/metadata needed for IdentityGuard posture analysis

What it does NOT collect
------------------------
- Passwords or password hashes
- Authentication secrets or access tokens in the JSON
- Email or mailbox content
- Teams messages
- OneDrive / SharePoint documents
- Browser history
- User files
- Message content

Required Microsoft Graph delegated read scopes
-----------------------------------------------
- User.Read.All
- AuditLog.Read.All
- RoleManagement.Read.Directory
- Policy.Read.All
- Application.Read.All

Some APIs also require the signed-in administrator to hold an appropriate
Microsoft Entra directory role. If a section cannot be collected, the script
records a warning instead of pretending that data exists.

Prerequisite
------------
Install Microsoft's Graph authentication module:

  Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

The collector intentionally does not install software automatically.

Run
---
Open PowerShell in the folder containing the collector:

  .\IdentityGuard-Entra-Collector.ps1

For an anonymized file:

  .\IdentityGuard-Entra-Collector.ps1 -Anonymize

To choose the output location:

  .\IdentityGuard-Entra-Collector.ps1 -OutputPath "C:\Temp\IdentityGuard.json"

Then import the JSON into:

  https://labs.snehashispriyabarua.com/identityguard/

Privacy model
-------------
The V0.1 IdentityGuard web application processes imported JSON/CSV in the browser.
The design goal is to keep assessment data local rather than storing tenant
identity data in an SPB Labs database.

Important V0.1 limitations
--------------------------
- Direct Entra role assignments are evaluated; PIM/eligible and group-based role
  assignments need deeper collection in a later release.
- Conditional Access user coverage is an approximation in V0.1.
- Application permissions are configured permissions, not a complete effective
  consent/permission analysis.
- Legacy authentication usage is not automatically inferred yet.

Use
---
Run only in environments where you are authorized to perform identity/security
assessment. Review the generated JSON before sharing it with anyone.
