I built an open-source, 100% local Microsoft Entra Security Analyzer

Description and use

IDSignal is a local, open‑source Microsoft Entra security analyzer that detects password sprays and MFA gaps without sending data to external services.

Problem

Analyzing Microsoft Entra ID (Azure AD) sign‑in logs for password sprays and MFA gaps requires tools that do not expose tenant data to third‑party cloud services.

Outcome

IDSignal provides automated hunting of password sprays, MFA gap detection, risk scoring, and a fast local UI without exposing data to external services.

Workflow

• 1. Install Docker on the local machine or private network.
• 2. Run the container with the command: docker run -d --name idsignal -v idsignal_data:/app/data -p 4317:4317 ghcr.io/sertacanbey/idsignal:latest.
• 3. Access the interactive dashboard on port 4317 to filter logs, hunt password sprays, spot MFA gaps, and view risk scores.

Evidence

I built IDSignal — an open-source, zero-cloud dependency security analyzer. It runs entirely locally on your own machine (or via Docker in your private network). Your tenant data never leaves your environment.

Source

Hunts Password Sprays: Unmasks distributed attacks (Event 50126) and groups them by threat actor IPs.

Source

Spots MFA Gaps: Pinpoints users who do not have MFA configured or active on their accounts.

Source

docker run -d --name idsignal -v idsignal_data:/app/data -p 4317:4317 ghcr.io/sertacanbey/idsignal:latest

Source