When conducting security audits of cloud environments, we often encounter the question of how to assess the security of Microsoft Entra ID. In practice, we have found that a combination of Purple Knight and Prowler works very well for these audits, which is why we use both tools regularly. Their areas of focus complement each other effectively.
While Purple Knight provides a detailed view of identities, roles, and permissions, Prowler focuses on environment configuration, security policies, and the overall security posture of the tenant. Together, they make it possible to identify a broader range of security risks than would be possible by using only one of them.
Purple Knight is a security tool focused primarily on identities and permissions. Its purpose is to identify weaknesses that attackers could exploit when compromising user accounts or escalating privileges.
In Microsoft Entra ID environments, it focuses, for example, on:
One of the major advantages of Purple Knight is its ability to display the specific objects affected by a finding. For example, if it identifies a privileged account without MFA, it directly shows the specific user account. Similarly, it can list users using weak MFA methods or accounts with excessive permissions.
This makes the output highly practical for administrators who need to quickly identify and remediate specific issues.
More information about Purple Knight is available at this link.
Prowler is an open-source tool designed to assess the security posture of cloud environments. It supports AWS, Microsoft Azure, Google Cloud, and Microsoft 365, and includes hundreds of checks based on vendor recommendations, CIS benchmarks, and other security standards.
In the area of Microsoft Entra ID, it focuses mainly on:
Unlike Purple Knight, Prowler focuses more on the configuration of the environment as a whole. For example, it is very effective at identifying missing Conditional Access policies, insufficient protection of administrator accounts, or configurations that do not align with Microsoft’s recommended security practices.
However, it can also display the specific users, applications, or service principals affected by a given finding.
More information about Prowler is available here.
Purple Knight provides a detailed view of identities, permissions, and specific objects, while Prowler assesses the overall security configuration, governance, and alignment with recommended security standards. Combining both tools provides a significantly more comprehensive view of the environment’s security and makes it easier to identify areas that require improvement. By addressing the most critical findings from these tools, organizations can significantly improve security in an area that attackers continue to actively exploit.
