EntraGoat is a deliberately vulnerable Microsoft Entra ID infrastructure for security professionals. Deploy real-world identity misconfigurations and privilege escalation paths in your own tenant, then practice exploiting them in a safe, black-box CTF format.
📖 Documentation | 📝 Blog Posts
- Microsoft Entra ID test/trial tenant with Global Administrator
- Microsoft Graph PowerShell SDK
git clone https://github.com/Semperis/EntraGoat && cd EntraGoat
Install-Module Microsoft.Graph -Scope CurrentUser -Force
.\Start-EntraGoat.ps1Requires Windows (WPF). Works on PowerShell 5.1+ and 7+.
Zoom: Ctrl+Plus / Ctrl+Minus / Ctrl+0
git clone https://github.com/Semperis/EntraGoat && cd EntraGoat
Install-Module Microsoft.Graph -Scope CurrentUser -Force
cd frontend && npm install && npm startOpen http://localhost:3000
cd scenarios
.\EntraGoat-Scenario1-Setup.ps1See docs/getting-started.md for detailed setup instructions.
| # | Name | Difficulty |
|---|---|---|
| 1 | Misowned and Dangerous — Owner's Manual to Global Admin | Beginner |
| 2 | Graph Me the Crown (and Role) | Beginner |
| 3 | Group MemberShipwreck — Sailed into Admin Waters | Beginner |
| 4 | I (Eligibly) Own That | Intermediate |
| 5 | Department of Escalations - AU Ready for This? | Advanced |
| 6 | CBA (Certificate Bypass Authority) - Root Access Granted | Advanced |
Each scenario includes a setup script, cleanup script, solution walkthrough, and a hidden flag.
| Home |
|---|
 |
| Challenge |
|---|
 |
| Setup | Cleanup |
|---|---|
 |
 |
| Dashboard | Challenge |
|---|---|
 |
 |
- Black Hat USA 2025 — Arsenal
- DEF CON 33 — Demo Labs
- BSides Frankfurt 2025
- SEC-T 0x11
- Black Hat SecTor 2025 — Arsenal
- Black Hat Europe 2025 — Arsenal
- Black Hat Asia 2026 — Arsenal
- What Is EntraGoat?
- Getting Started with EntraGoat
- Scenario 1: Service Principal Ownership Abuse
- Scenario 2: Exploiting App-Only Graph Permissions
- Scenario 6: Certificate-Based Authentication Abuse
For educational and authorized testing only. Use a dedicated test tenant. See LICENSE for full terms. The authors assume no liability for misuse.
Happy Hunting! — The EntraGoat Team