AzureHound Community Edition Flags

AzureHound Community Edition has several optional flags that let you control scan scope, performance, output, and other behaviors.

Enumeration Commands and Options

The list command collects all supported Entra ID and Azure Resource Manager data. Add a collection option directly after list to limit the scope.

For example, use azurehound list az-ad to collect all supported Entra ID data and azurehound list apps to collect only application registrations within Entra ID. Run azurehound list -h to see all available collection commands.

The following tree logically groups every collection option by resource and abuse type. This grouping does not mean an aggregate command emits every option shown beneath it. All options are direct children of list; for example, run azurehound list apps, not azurehound list az-ad apps.

list # Collects both Entra ID and Azure Resource Manager data
├── az-ad # Collects all supported Entra ID data
│   ├── apps # Collects application registrations
│   │   ├── app-owners # Collects explicitly assigned owners of application registrations
│   │   └── appfics # Collects federated identity credentials for application registrations
│   ├── devices # Collects devices
│   ├── groups # Collects security-enabled groups
│   │   ├── group-members # Collects group memberships
│   │   └── group-owners # Collects explicitly assigned owners of groups
│   ├── roles # Collects Entra ID directory role definitions
│   │   └── role-assignments # Collects Entra ID directory role assignments
│   ├── service-principals # Collects service principals
│   │   ├── app-role-assignments # Collects principals assigned application roles exposed by service principals
│   │   └── service-principal-owners # Collects explicitly assigned owners of service principals
│   ├── tenants # Collects the target tenant and other accessible tenants
│   ├── unified-role-assignment-policies # Collects tenant-wide Entra PIM directory role policy assignments and activation requirements
│   ├── unified-role-eligibility-schedule-instances # Collects Entra PIM directory role eligibility instances
│   └── users # Collects users, including guest users in the target tenant
└── az-rm # Runs the aggregate Azure Resource Manager collection
    ├── management-groups # Collects management groups
    │   ├── management-group-descendants # Collects descendant management groups and subscriptions
    │   └── management-group-role-assignments # Collects role assignments at management group scope
    │       ├── management-group-contributors # Collects principals with the Contributor role on management groups
    │       ├── management-group-owners # Collects principals with the Owner role on management groups
    │       └── management-group-user-access-admins # Collects principals with the User Access Administrator role on management groups
    └── subscriptions # Collects subscriptions
        ├── subscription-role-assignments # Collects role assignments at subscription scope
        │   ├── subscription-contributors # Collects principals with the Contributor role on subscriptions
        │   ├── subscription-owners # Collects principals with the Owner role on subscriptions
        │   └── subscription-user-access-admins # Collects principals with the User Access Administrator role on subscriptions
        ├── resource-groups # Collects resource groups
        │   └── resource-group-role-assignments # Collects role assignments that apply to resource groups
        │       ├── resource-group-contributors # Collects principals with the Contributor role on resource groups
        │       ├── resource-group-owners # Collects principals with the Owner role on resource groups
        │       └── resource-group-user-access-admins # Collects principals with the User Access Administrator role on resource groups
        ├── automation-accounts # Collects Automation accounts
        │   └── automation-account-role-assignments # Collects role assignments that apply to Automation accounts
        ├── container-registries # Collects container registries
        │   └── container-registry-role-assignments # Collects role assignments that apply to container registries
        ├── function-apps # Collects function apps
        │   └── function-app-role-assignments # Collects role assignments that apply to function apps
        ├── key-vaults # Collects key vaults
        │   ├── key-vault-access-policies # Collects legacy access policies for key vaults
        │   └── key-vault-role-assignments # Collects role assignments that apply to key vaults
        │       ├── key-vault-contributors # Collects principals with the Contributor role on key vaults
        │       ├── key-vault-kvcontributors # Collects principals with the Key Vault Contributor role on key vaults
        │       ├── key-vault-owners # Collects principals with the Owner role on key vaults
        │       └── key-vault-user-access-admins # Collects principals with the User Access Administrator role on key vaults
        ├── logic-apps # Collects logic apps
        │   └── logic-app-role-assignments # Collects role assignments that apply to logic apps
        ├── managed-clusters # Collects Azure Kubernetes Service managed clusters
        │   └── managed-cluster-role-assignments # Collects role assignments that apply to managed clusters
        ├── storage-accounts # Collects storage accounts
        │   ├── storage-account-role-assignments # Collects role assignments that apply to storage accounts
        │   └── storage-containers # Collects blob containers in storage accounts
        ├── virtual-machines # Collects virtual machines
        │   └── virtual-machine-role-assignments # Collects role assignments that apply to virtual machines
        │       ├── virtual-machine-admin-logins # Collects principals with the Virtual Machine Administrator Login role
        │       ├── virtual-machine-avere-contributors # Collects principals with the Avere Contributor role on virtual machines
        │       ├── virtual-machine-contributors # Collects principals with the Contributor role on virtual machines
        │       ├── virtual-machine-owners # Collects principals with the Owner role on virtual machines
        │       ├── virtual-machine-user-access-admins # Collects principals with the User Access Administrator role on virtual machines
        │       └── virtual-machine-vmcontributors # Collects principals with the Virtual Machine Contributor role
        ├── vm-scale-sets # Collects virtual machine scale sets
        │   └── vm-scale-set-role-assignments # Collects role assignments that apply to virtual machine scale sets
        └── web-apps # Collects web apps
            └── web-app-role-assignments # Collects role assignments that apply to web apps

Authentication Flags

AzureHound supports several authentication options. You can control how AzureHound authenticates by using command-line flags or the configuration file. Some flags should always be used together and are presented here in the context of their authentication use cases.

For authentication flags, AzureHound reads file contents only from paths passed to --cert and --key. Every other authentication flag takes a literal value and does not interpret that value as a file path.

Authenticating with Username and Password

• -u or --username — The Entra ID user’s user principal name (UPN), in [e-mail] format.
• -p or --password — The user’s clear-text password value.
• -t or --tenant — The directory tenant value, in GUID or friendly-name format.

Example:

./azurehound -u "[e-mail]" -p "MyVerySecurePassword123" --tenant "contoso.onmicrosoft.com" list

You can omit the password from the command line, and AzureHound will interactively prompt you for it instead.

Authenticating with Service Principal Secret

• -a or --app — The application (client) ID value assigned when the app was registered.
• -s or --secret — The client secret value generated for the app registration.
• -t or --tenant — The directory tenant value, in GUID or friendly-name format.

Example:

./azurehound -a "6b5adee8-0d36-45b6-b393-8f29ae8a8cc8" -s "MyVerySecureClientSecret123" --tenant "contoso.onmicrosoft.com" list

Authenticating with Service Principal Certificate

• -a or --app — The application (client) ID value assigned when the app was registered.
• --cert — The path to the certificate uploaded for the app registration, in PEM format. AzureHound reads the certificate from this file.
• -k or --key — The path to the certificate’s private key file, in PEM format. AzureHound reads the private key from this file.
• --keypass (optional) — The literal passphrase value to use if the private key is encrypted.
• -t or --tenant — The directory tenant value, in GUID or friendly-name format.

Example:

./azurehound -a "6b5adee8-0d36-45b6-b393-8f29ae8a8cc8" --cert ./certificate.pem --key ./key.pem --tenant "contoso.onmicrosoft.com" list

Authenticating with Azure Managed Identity

• --managed-identity — Use Azure Managed Identity to authenticate. Use this when running AzureHound on an Azure resource, such as a virtual machine or App Service, with a managed identity assigned.
• --managed-identity-client-id (optional) — The client ID value of a user-assigned managed identity. If not provided, AzureHound uses the system-assigned identity.
• -t or --tenant — The directory tenant value, in GUID or friendly-name format.

Example (system-assigned):

./azurehound --managed-identity --tenant "contoso.onmicrosoft.com" list

Example (user-assigned):

./azurehound --managed-identity --managed-identity-client-id "6b5adee8-0d36-45b6-b393-8f29ae8a8cc8" --tenant "contoso.onmicrosoft.com" list

Authenticating with a JWT

• -j or --jwt — The literal value of a Microsoft Graph or Azure Resource Manager scoped JWT.

Example:

./azurehound -j "ey..." list az-ad

Authenticating with a Refresh Token

• -r or --refresh-token — The literal refresh token value. AzureHound exchanges it for an appropriately scoped JWT when accessing the Microsoft Graph and Azure Resource Manager APIs.
• -t or --tenant — The directory tenant value, in GUID or friendly-name format.

Example:

./azurehound -r "0.ARwA6Wg..." --tenant "contoso.onmicrosoft.com" list

Additional Scoping and Output Flags

• -b - Filter by one or more subscription IDs. AzureHound will automatically dedupe this list for you.
• -m - Filter by one or more management group IDs. AzureHound will automatically dedupe all descendant management groups and subscriptions for you.
• -o or --output - Instructs AzureHound to write its output to a specified file name. Accepts either a bare filename (azurehound.json, written to the current working directory) or an absolute path (~/azurehound.json).
• --log-file - Write logs to the specified file. Accepts either a bare filename (log.txt, written to the current working directory) or an absolute path (~/azurehound.log).
• --json - Emit logs as structured JSON instead of the default line-based format. Requires --log-file to be set.
• -v or --verbosity - AzureHound verbosity level (defaults to 0), a higher value gives more verbosity [Min: -1, Max: 2]
• --version - Print the AzureHound version and exit.

Custom User-Agent

-U or --user-agent - Set a custom User-Agent header for all HTTP requests. This can be useful for evasion purposes or for debugging and identification. If not specified, AzureHound uses the default User-Agent value.

Example:

./azurehound list --tenant "contoso.onmicrosoft.com" -u "[e-mail]" -p "MyVerySecurePassword123" --user-agent "MyCustomAgent/1.0"