Auth Policies

auth-policies

auth-policies gives tenant-level identity policy context.

Use it when you need to understand whether guest access, app registration, consent, or related tenant controls make later identity findings more dangerous than they first appear.

What This Command Answers

• Does the tenant look permissive or restrictive?
• Are guest entry, app creation, or consent-driven growth easier than they should be?
• Which tenant-wide rules change how you should interpret later identity findings?

Run It

azurefox auth-policies --output table

For a saved artifact:

azurefox auth-policies --output json

Example Table Output

policy	state	scope	operator signal
Security Defaults	disabled	tenant	Security defaults are disabled for the tenant.
Authorization Policy	configured	tenant	guest invites: everyone; users can register apps; self-service permission grant policies assigned
CA002: Block legacy auth	disabled	users:all, apps:all	state: disabled; grants: block

When To Use It

• early in identity review when tenant-wide policy posture matters
• after a suspicious trust or app path appears
• when you need to know whether a small foothold could grow because policy is too permissive

What To Look For

• broad guest or external access posture
• permissive app-registration settings
• consent posture that makes app-based access easier to land or extend
• plain-language findings that explain impact without forcing you to decode policy names

Why It Matters

Tenant-wide policy settings change the meaning of many later findings.

An environment with loose guest controls, broad app creation, or permissive consent may turn a small identity foothold into a much larger problem. auth-policies helps you interpret the rest of the identity surface in the right policy context.

What Should Stand Out First

• broad guest and external access posture
• permissive app-registration and consent settings
• findings explained in plain language instead of raw policy names
• the settings that most change outside access or tenant growth

If You See..., Go Next To...

• If you see findings like Guest invitations are broadly allowed, go next to Role-Trusts because outside access becomes more important when tenant policy is already permissive.
• If you see findings like Users can register applications, go next to Role-Trusts because it helps explain which application trust edges would matter most if that app-creation surface were abused.

What To Do Next

• Use Role Trusts if permissive posture makes ownership or federation more important.
• Use Permissions if the policy posture makes a specific principal especially concerning.
• Treat weak tenant controls as context that raises the urgency of related identity findings.

Boundary

auth-policies is a tenant-control context command.

It should explain which policy settings change identity risk. It is not a full Entra audit or a per-user sign-in review.