SuiteAuth
Conditional Access Pen Testing Toolkit
Simulate every signal. Test every policy. Trust nothing.
Purpose-built for purple teams who need to validate what happens when identity, authentication, network, and device controls are pushed to their limits.
Built by researchers with a proven track record of finding critical flaws in Microsoft Entra ID, including MFA bypass and device compliance bypass vulnerabilities.
Your local Conditional Access pen testing toolkit.
Simulated run , Contoso test tenant
- Auth
- Identity
- Device
- Sessions
- Playbooks
Device Registration
session 4a2e8f91-bc47-4d3a-9e12-7f6c8d5a0b34
- Status
- Registered
- Device
- Android Contoso
- Compliance
- Compliant (3/3)
- PRT
- v4 acquired
PRT Acquired11/11
Timeline
Session Created
Identity Resolved
Token Acquisition
OAuth Authentication
Token Redeemed
Device Registered
Intune Enrolment
Compliance Policies
Device Compliance
Windows Hello
PRT Acquired
- joinType
- 0
- osVersion
- 10.0.19041
- hasPrt
- True
- deviceType
- Mobile
Your Conditional Access policies are untested.
You've spent months building layered Conditional Access policies. But have you actually tested what happens when an attacker simulates a compliant device? Registers their own MFA? Spoofs a trusted network? Most organisations can't answer that.
Blind Trust in Policy Logic
No Visibility Into Gaps
Manual Testing Doesn't Scale
Four pillars of total simulation.
SuiteAuth simulates the four signal categories that Conditional Access evaluates, giving purple teams full control over every variable in the authentication decision.
Identity Simulation
Become anyone.
Simulate any user or service principal in your tenant. Test how policies respond to different identity types, roles, and group memberships without compromising real credentials.
- User identity impersonation
- Service principal simulation
- Role & group membership emulation
- Guest vs member identity testing
Authentication Simulation
Bypass every factor.
Simulate the full spectrum of authentication methods, from passkeys and FIDO2 to Microsoft Authenticator push, OTP, and mobile app protections. Auto-register MFA factors programmatically.
- Passkey / FIDO2 attestation
- Microsoft Authenticator simulation
- OTP factor registration & capture
Network Simulation
Spoof any location.
Simulate VPN connections and trusted network locations. Test whether your Named Locations and network-based CA policies actually enforce what you think they do.
- VPN tunnel simulation
- Named Location emulation
- IP-based policy emulation
- Compliant network attestation
Device Simulation
Trust nothing.
Simulate mobile and desktop devices with full Intune MDM enrolment, PRT v3/v4 token acquisition, and device compliance. Register real devices programmatically and achieve compliance state.
- Intune MDM active enrolment
- PRT v3, v4 and Secure Enclave emulation
- Device compliance achievement
- Mobile & desktop simulation
Intelligent session & request management.
SuiteAuth doesn't just simulate signals, it manages the full lifecycle. From active Intune device registration to automated MFA factor enrolment, every request is tracked, every token is managed, and every session is persistent.
Active Device Registration
Register devices to Intune MDM programmatically and achieve compliance state in real-time.
Automated MFA Enrolment
Register for MFA factors automatically, no manual intervention required.
Persistent Session Store
All tokens, sessions, and state are stored in a local database for full auditability.
Token Lifecycle Management
Automatic token refresh, expiry tracking, and re-authentication when needed.
Session manager
- Active sessions
- 3
- Tokens managed
- 12
- Devices enrolled
- 2
- MFA factors
- 4
- Compliance status
- Achieved
labs@m42:~$ suiteauth enrol --device "WIN-PENTEST01" --mdm intune
[*] Initiating MDM enrolment...
[✓] Device registered: WIN-PENTEST01
[✓] Compliance policies evaluated: 6/6 pass
[✓] PRT v4 acquired, token cached
labs@m42:~$
Playbooks: end‑to‑end attack chains.
Define repeatable, automated attack sequences that chain together device enrolment, authentication, policy testing, and exploitation, all in a single YAML playbook.
- 01
Register Device
Enrol a simulated device into Intune MDM, configure compliance policies, and acquire a PRT.
- 02
Authenticate
Register MFA factors, simulate auth methods, and obtain access tokens with the desired claims.
- 03
Validate Policy
Test which CA policies grant or block access across every combination of signals.
- 04
Exploit & Report
Execute post-exploitation actions, enumerate accessible resources, and generate findings.
name: "Full CA Policy Assessment"version: 1.0 phases: - name: "device_registration" action: enrol_device mdm: intune compliance: true - name: "authenticate" action: acquire_token methods: [passkey, authenticator] - name: "exploit" action: post_exploit targets: [mail, teams, sharepoint]See what an attacker sees. After the bypass.
Once SuiteAuth achieves access, it demonstrates the real-world impact by interacting with Microsoft 365 services, proving the business risk of policy gaps to stakeholders who need to see it to believe it.
Email Access
Read, search, and send emails from compromised mailboxes. Full Graph API mailbox enumeration.
Teams Messages
Read and send messages across Teams channels and chats. Enumerate team memberships and files.
SharePoint & OneDrive
Upload and download files from SharePoint sites and OneDrive. Enumerate site structures and permissions.
Resource Enumeration
Map accessible resources, permissions, and lateral movement paths from the compromised identity.
Portable. Self-contained. No cloud required.
SuiteAuth runs entirely on your machine. All sessions, tokens, device registrations, and findings are stored in a local encrypted database. Take it anywhere: client sites, your home lab, or on the road. Nothing phones home.
- Local Database
- Encrypted SQLite store for all state
- Playbook Engine
- YAML-defined automation chains
- Zero Dependencies
- Single binary, no external services
- Cross-Platform
- Windows, macOS, and Linux support
See the attack path before the attacker does.
Conditional Access policies are only as strong as the assumptions they're built on. SuiteAuth doesn't just test individual signals, it chains them together to reveal the full attack path an adversary would follow to bypass your controls and reach critical resources.
The result is a visual, step-by-step breakdown of every path through your policy stack, from initial access to blast radius. Run it before and after policy changes to validate remediation with deterministic evidence, not assumptions.
Proprietary engine, built on years of Conditional Access research and real-world bypass discovery. This is the tooling behind our findings.
- 01
Signal Emulation
SuiteAuth reconstructs the exact combination of identity, device, network, and authentication signals your policies evaluate, replicating what an attacker would present at the gate.
- 02
Policy Traversal
Each Conditional Access policy is exercised against the emulated signals. SuiteAuth maps which policies grant, block, or silently fall through, exposing logic gaps no audit tool can catch.
- 03
Blast Radius Analysis
For every validated bypass, SuiteAuth calculates the downstream impact, which resources are reachable, what data is exposed, and how far lateral movement extends from a single policy gap.
- 04
Before & After Validation
Replay the same attack path after remediation. SuiteAuth gives you deterministic proof that your policy change closed the gap, evidence your board and auditors can rely on.
Get early access.
SuiteAuth is currently in closed beta with select purple teams and security consultancies. Join the waitlist to be notified when we open the next cohort.
Built by the researchers who found MFA & device compliance bypasses in Microsoft Entra ID.
SuiteAuth is provided for security testing of environments you own or are contracted to test under written authorisation. Unauthorised access to computer systems is an offence under the Cybercrime Act 2001 (Cth) and equivalent foreign law.