> For the complete documentation index, see [llms.txt](https://www.netexec.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.netexec.wiki/ldap-protocol/enumerate-entra-id.md).

# Enumerate Entra ID

Find the Entra ID synchronization server

If Entra ID is deployed in Active Directory with cloud sync active, the MSOL account is a high value target, due to its default configuration of having DCSync privileges. This MSOL account can be extracted from a local database on the sync server. To find the Entra ID sync server you can use the NetExec module \`entra-id\`:

```bash
nxc ldap <ip> -u user -p pass -M entra-id
```

<figure><img src="https://361548579-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fb0qbsNvsXjRTsQcNipGM%2Fuploads%2Fgit-blob-833283fd1f8d4a8d7d4947c1f2191c51f2e34a82%2Fentra-id.png?alt=media" alt=""><figcaption><p>Hunt for the Entra ID sync server, dump the MSOL account and dump the NTDS.dit</p></figcaption></figure>