redbyte1337/credspy

CredSpy is a Python command-line tool for security professionals testing Microsoft Entra ID environments, which is Microsoft's cloud identity platform (formerly called Azure Active Directory). Given a list of email addresses, it queries a public API that Microsoft's own login page uses to determine which accounts actually exist in a tenant and what authentication methods each account supports. The information it reveals for each email includes whether the account exists, what the account's preferred login method is (such as a password, a passwordless push notification, a passkey or FIDO2 hardware key, or a certificate), and a full list of every authentication method that account has enrolled. This is useful in security assessments to understand an organization's attack surface: knowing which accounts still rely on passwords, for example, is relevant when planning authorized phishing tests. The tool works without any credentials or authentication of its own. It replicates the same unauthenticated check the Microsoft login page performs when a user types their email before entering a password. Results stream to the terminal as each email is checked and can be exported to a CSV file. Filtered output lists (such as all existing accounts or all accounts using passwordless authentication) can be saved to separate text files for further use. Installation takes one command via pipx or pip. You run it from the terminal with a single email address or a text file containing many addresses. It supports routing traffic through a proxy, which is useful when working with interception tools during authorized tests. The README includes a clear disclaimer stating this tool is for authorized security testing only, against systems you own or have explicit written permission to test.