Refactor README for script usage and file names

Updated README to clarify script usage and rename files.

Author: rolling-code

README.md

@@ -25,7 +25,8 @@ PowerShell-Scripts/
 │   └── grant_consent_MSGraph.ps1
 │   └── sendmail.py
 │   └── Check-AllPowerfulAzurePerms3.ps1
-│   └── enum_entra_admins.ps1 & find_disabled_ad_accounts.ps1
+│   └── enum_entra_admins.ps1
+│   └── find_disabled_accounts.ps1
 │   └── watch_X_job3.ps1
 │   └── Audit-AllUsersRolePerms.ps1
 │   └── Get-DisabledUsersLicenses6.ps1
@@ -133,7 +134,9 @@ Notice the MFA requirement error description, as expected.
 ![Notice the MFA requirement](Azure%20Active%20Directory/docs/image-20250514-202748.png)
 
 Use like so:
-`.\get_az_token.ps1 -TenantId "xxx" -Username "you@foo.bar" -ClientId "yyy" -AcknowledgeAuthorizedTesting`
+```powershell
+.\get_az_token.ps1 -TenantId "xxx" -Username "you@foo.bar" -ClientId "yyy" -AcknowledgeAuthorizedTesting
+```
 
 ---
 ### `aadinternals_audit6.ps1`
@@ -156,7 +159,9 @@ Performs a read-only analysis of the user-assignment scope for Microsoft Entra C
 The script does not calculate whether every policy will trigger during a specific authentication attempt. Conditional Access runtime conditions such as cloud application, device compliance, platform, location, user or sign-in risk, client type, and authentication flow require the Conditional Access What If tool or sign-in-log evidence.
 
 Use like so:
-`.\get_policies.ps1 -UserPrincipalName "foo@contoso.com" -OutputCsv ".\ConditionalAccessUserTargeting.csv"`
+```powershell
+.\get_policies.ps1 -UserPrincipalName "foo@contoso.com" -OutputCsv ".\ConditionalAccessUserTargeting.csv"
+```
 
 Microsoft Graph Command Line Tools must be granted. If not you will be prompted like so:
 
@@ -169,9 +174,11 @@ Demonstrates how a privileged Microsoft Graph administrator can programmatically
 This administrative workflow illustrates one mechanism that can be abused after a highly privileged identity or application is compromised. The script does not create a malicious application, perform consent phishing, obtain tokens, or independently bypass MFA. Because it modifies tenant consent and application assignments using highly privileged Graph permissions, it should be used only in an isolated lab or explicitly authorized administrative workflow.
 
 Use like so:
-`.\grant_consent_MSGraph.ps1  -ClientAppId "11111111-1111-1111-1111-111111111111"`
+```powershell
+.\grant_consent_MSGraph.ps1  -ClientAppId "11111111-1111-1111-1111-111111111111"
 
-`.\grant_consent_MSGraph.ps1 -UserPrincipalName "alice@contoso.com"`
+.\grant_consent_MSGraph.ps1 -UserPrincipalName "alice@contoso.com"
+```
 
 
 ---
@@ -212,18 +219,27 @@ This read-only script audits Azure Storage accounts across all subscriptions acc
 This script consumes the container CSV generated by Get-AzureStorageAnonymousAccess.ps1 and performs unauthenticated curl.exe tests against each applicable Blob container. It checks anonymous container enumeration and can optionally validate exact-object access using a one-byte range request when the CSV contains an ExactBlobName column.
 
 Use like so:
-`.\Test-AzureBlobAnonymousEndpoints.ps1 -InputCsv "C:\Users\mario\StorageContainerPublicAccessDetails-20260730-003512.csv"`
+```powershell
+.\Test-AzureBlobAnonymousEndpoints.ps1 -InputCsv "C:\Users\mario\StorageContainerPublicAccessDetails-20260730-003512.csv"
+```
+
+
+---
+### `enum_entra_admins.ps1 `
 
+Searches Microsoft Entra for groups whose display names match a configurable administrator-like pattern and exports their direct and nested user members to AdminLikeAccounts_Report.csv. The report includes each user’s current Entra account status and hybrid synchronization attributes, but the naming match is a discovery signal and does not by itself prove that a group grants privileged access.
+By default, the script searches for group names containing administrator and resolves membership transitively, including users inherited through nested groups.
 
 ---
-### `enum_entra_admins.ps1 & find_disabled_ad_accounts.ps1`
+### `find_disabled_accounts.ps1`
 
-enum_entra_admins.ps1 will look at Entra groups with "administrator" as a display name. 
-Then it will try to find users of that group, and output data to AdminLikeAccounts_Report.csv
+Reads any CSV containing Microsoft Entra user principal names or object IDs and checks whether each unique account is enabled or disabled in Entra ID. The script automatically detects common identity-column names, exports disabled accounts to DisabledAccounts_Report.csv, and can optionally produce a complete report containing enabled, disabled, unresolved, and failed lookups.
+The script queries Microsoft Graph and therefore does not require a corporate network, VPN, domain controller, RSAT, or the on-premises Active Directory PowerShell module
+
+```powershell
+.\find_disabled_accounts.ps1 -CsvPath ".\accounts.csv"
+```
 
-find_disabled_ad_accounts.ps1 will read that input file AdminLikeAccounts_Report.csv and try to determine if any of these admins is "disabled".
-It will produce a spreadsheet file named DisabledAccounts_Report.csv
-Admins should investigate these files and clean up their AD/AAD as needed.
 
 ---
 ### `Get-DisabledUsersLicenses6.ps1`