Domain Enumeration
Check if company is utilizing Azure AD
We can visit the url below to see if a company is utilizing Azure AD. Replace "COMPANY' with the domain name.
https://login.microsoftonline.com/[email protected]&xml=1
We can see below that the domain (rottadev) is utilizing Azure AD

Enumerate Subdomains
We can utilize the tool MicroBurst to perform subdomain enumeration.
PS> Invoke-EnumerateAzureSubDomains -Base rottadev -verbose
rottadevimages.sharepoint.com SharePoint
images-rottadev.sharepoint.com SharePoint
imagesrottadev.sharepoint.com SharePoint
internal-dist-rottadev.sharepoint.com SharePoint
internal-distrottadev.sharepoint.com SharePoint
rottadev-internal-dist.sharepoint.com SharePoint
internalrottadev.sharepoint.com SharePoint
rottadevinternal.sharepoint.com SharePoint
Last updated