Gather some info about a particular Azure Tenant.
This is basically a less functional mirror of AAD Internals' OSINT page, but aims to do less, faster.
With this tool, you can get the Tenant ID, Branding (brand name, not logo), Region, and associated domains (without the enrichment that AADInternals does) for an Azure Tenant.
In May 2025, Microsoft announced restrictions on enumerating tenant domains as an outsider. As of August 2025, these changes are apparently fully rolled out, effectively breaking this tool. For updates and discussion, see Issue #1 on GitHub.
As of August 2025, AAD Internals' OSINT page still functions as expected (how, I am not sure), so if getting a list of associated tenant domains is important to you, please use that tool instead.
Because it does less, it's faster. Requesting microsoft.com will take roughly half the time (if
not less!) with azure-osint.kmsec.uk compared to AAD Internals' OSINT page (at the time of testing, 2.6s vs 5.4s).
Submit a domain
This was built to provide a quicker and less verbose public API for Azure OSINT.
All information on how this works behind the scenes can be viewed on the Github repository, however all functionality is
re-implemented from AADInternals so you're better off visiting AAD Internals's OSINT page or viewing the enumeration
functions predominately found in
AccessToken_utils.ps1
within AADInternals Suite.
Get-OpenIDConfiguration
- AADInternals uses this to retrieve the Region, but I use this as a shortcut to also get the Tenant
ID in one fetch request.Get-UserRealmV2
- retrieves the brand identityGet-TenantDomains