AetherCred
Entra ID credential and posture reporting over the Graph API
Overview
AetherCred pulls the identity risk signals that are scattered across the Entra ID portal into one report: stale credentials, privileged accounts nobody uses, and legacy authentication still enabled.
The problem
The questions an auditor asks are answerable in the portal, but only one blade at a time. Which privileged accounts have not signed in for 90 days, which service principal secrets never expire, and who is still not registered for MFA are three separate hunts, so in practice they get done once a year.
How it works
PowerShell queries directory objects through the Microsoft Graph SDK, checks account hygiene against CIS benchmarks, looks for gaps in conditional access coverage, and writes the findings out as an HTML report.
Design decisions
- Graph batch queries keep a full tenant scan inside the API throttle limits.
- Risk scoring weights user risk tier, credential age, and how privileged the role is, so the report has an order rather than an alphabet.
- The output is a single self-contained HTML file, which is what auditors actually accept.