Microsoft Entra ID
Assess users, privileged roles, MFA registration, PIM eligibility/activation, Conditional Access posture, applications, consent, owners, and credential metadata.
SPB Labs · Identity Security
V1.2 · LiveIndependently developed
IdentityGuard
Identity Security Posture Assessment for Microsoft Entra ID & Active Directory
Find identity risk. Prioritize remediation. Demonstrate improvement. IdentityGuard combines local read-only collectors with browser-local analysis to assess Entra ID, Active Directory, and hybrid identity environments without requiring raw directory data to be stored on an IdentityGuard server.
Use synthetic demo data immediately, or run the local collectors in an authorized environment and import the generated JSON.
Why IdentityGuard
Identity risk is usually spread across tools, directories, and teams.
Administrators can see users in one console, privileged roles in another, Conditional Access somewhere else, on-premises group membership in Active Directory, and application consent in yet another view. The difficult part is turning those separate signals into a prioritized security picture.
IdentityGuard brings those signals into one assessment workflow: identify the risk, explain why it matters, show what to remediate, track the work, reassess, and communicate the result.
Capabilities
From posture assessment to remediation evidence
IdentityGuard is designed around the full lifecycle of identity security work—not just a single score.
Active Directory
Assess privileged groups, stale accounts, password-account flags, Kerberos preauthentication, delegation, service-account indicators, computers, and domain policy.
Hybrid Identity
Correlate Entra and AD identities to surface cross-environment privilege, authentication, lifecycle, service-account, and legacy-configuration risk.
Risk Scoring & Visuals
Translate findings into severity, category scores, overall posture, remediation potential, risk distribution, and current-versus-projected security posture.
Remediation Playbooks
Every finding includes trigger context, risk explanation, remediation sequence, verification guidance, and modeled score impact.
Remediation Tracker
Manage Open, In Progress, Accepted Risk, and Resolved findings with owner, target date, notes, and remediation evidence.
History & Comparison
Save browser-local snapshots and compare baseline versus follow-up: score, critical/high counts, categories, resolved findings, new findings, and persistent risks.
Executive & Audit Outputs
Generate leadership-ready summaries, PDF reports, management priorities, trend views, Evidence Readiness, accepted-risk registers, sign-off, and an Audit & Evidence Pack.
Architecture
Local collection. Local analysis. Actionable output.
The architecture intentionally separates data collection from the public web application.
1Entra ID / Active DirectoryAuthorized environment
→
2Local PowerShell CollectorRead-only assessment collection
→
3Local JSONStored on administrator workstation
→
4IdentityGuard BrowserClient-side assessment & scoring
→
5Reports & EvidencePDF, history, tracker, executive, audit
Privacy & Security Model
What stays local matters.
IdentityGuard V1.2 is designed so the raw assessment dataset can be processed in the browser instead of being stored in an IdentityGuard server-side database.
Read the Security Details →Browser-local analysis
Imported Entra/AD JSON is analyzed in the browser in the current release.
No passwords or hashes
Collectors are not designed to export passwords, password hashes, Kerberos keys, or application secret values.
No user content
Email bodies, Teams messages, OneDrive/SharePoint document content, and arbitrary user files are not part of the collector design.
Anonymization available
Collector output can be anonymized when real identity names are unnecessary.
Collector JSON is still sensitive
Names, UPNs, roles, application metadata, account status, and security configuration should be handled as confidential security information.
Browser-local records need endpoint protection
History, remediation tracking, and sign-off summaries use browser localStorage, so use a trusted managed browser profile.
Workflow
Security improvement you can measure
A repeatable workflow turns a point-in-time assessment into evidence of risk reduction.
Run the authorized Entra and/or AD collector locally.
Select the generated JSON in IdentityGuard.
Review score, categories, findings, visuals, and projected posture.
Start with Critical and High findings and open the remediation playbooks.
Assign owner, target date, status, notes, and evidence.
Run fresh collectors after approved remediation changes.
Measure before/after score and finding changes using saved snapshots.
Use PDF, Executive Mode, and Audit & Evidence Pack for stakeholders.
Product Screenshots
One platform, multiple audiences
Screenshots below use IdentityGuard's synthetic demo dataset; they do not contain production identity data.
What You Gain
More than a list of security findings
See cloud, on-premises, and hybrid identity risk in one prioritized view.
Turn findings into owned remediation work with target dates and evidence.
Show how posture changed after remediation instead of relying on anecdotal progress.
Give technical teams, management, and audit different views of the same assessment.
Keep the raw assessment workflow local rather than requiring a hosted identity-data repository.
Document accepted risk, resolved evidence, limitations, sign-off, and review status.
Ready to Explore
Launch IdentityGuard
Start with the synthetic demo dataset, review the full workflow, then use the local collectors when you are ready to assess an authorized environment.