Semperis/EntraGoat
A deliberately vulnerable Microsoft Entra ID environment. Learn identity security through hands-on, realistic attack challenges.
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
The project lists 2 contributors on GitHub.
Gained 65% more stars in the last 90 days than in the 90 days before.
Use Cases & Benefits
- Provides a deliberately vulnerable Microsoft Entra ID environment for hands-on identity security attack challenges.
- Enables realistic, isolated learning of identity misconfigurations and privilege escalation without impacting production systems.
- Use for training security professionals on black-box attack techniques against Entra ID configurations.
- Use for developing and testing detection and mitigation strategies for identity-based attacks in Microsoft Entra ID.
- Use for creating custom vulnerable scenarios to enhance organizational security awareness and incident response skills.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
MIT
Permissive: commercial use, modification and redistribution are allowed with attribution.
Community files
- README: present
- Contributing guide: present
Watch-outs
- No commits in the last six months (last push May 2026).
- No GitHub releases; pin a commit or tag instead of a release.
General guidance from repository metadata, not legal advice. How we score
From the README
EntraGoat is a deliberately vulnerable Microsoft Entra ID infrastructure designed to simulate real-world identity security misconfigurations and attack vectors. EntraGoat introduces intentional vulnerabilities in your environment to provide a realistic learning platform for security professionals. It features multiple privilege escalation paths and focuses on black-box attack methodologies.
EntraGoat uses PowerShell scripts and Microsoft Graph APIs to deploy vulnerable configurations in your Entra ID tenant. This gives users complete control over the learning environment while maintaining isolation from production systems.
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
Forks
99+5
Open issues
6+1
Compared with peers in Security
Fastest-growing repositories GStars tracks in this cohort for the week of Nov 1, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| cloudflare/security-audit-skill | 61.7K | +8.8K | 17 | — |
| KeygraphHQ/shannon | 51.2K | +1.1K | 32 | 8 days ago |
| vxcontrol/pentagi | 33.5K | +712 | 38 | 31 days ago |
| Asymptote-Labs/agent-beacon | 3.3K | +360 | 40 | today |
| caddyserver/caddy | 78.8K | +267 | 60 | 1 day ago |
| Semperis/EntraGoat | 1.0K | — | 11 | — |
| Category median | 51.2K | +712 | 38 | — |
Discover Repositories
Search across tracked repositories by name or description