> For the complete documentation index, see [llms.txt](https://www.netexec.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.netexec.wiki/ldap-protocol/enumerate-entra-id.md).

# Enumerate Entra ID

If Entra ID is deployed in Active Directory with cloud sync active, the MSOL account is a high value target, due to its default configuration of having DCSync privileges. This MSOL account can be extracted from a local database on the sync server. To find the Entra ID sync server you can use the NetExec module \`entra-id\`:

```bash
nxc ldap <ip> -u user -p pass -M entra-id
```

<figure><img src="/files/tEljGsZTvDXaqdSiq7yb" alt=""><figcaption><p>Hunt for the Entra ID sync server, dump the MSOL account and dump the NTDS.dit</p></figcaption></figure>