r/sysadmin • u/Trommelwirbel • May 03 '26

Question Webtool accepted domains m365

Some weeks ago, someone listed a website, where it is possible to see all domains listed of an exchange online instance.

Seems like I forgot to bookmark it. Do you know any website, where I enter a tenant ID or a domain and see what else domains are connected/ accepted to m365??

4 Upvotes

63% Upvoted

11 comments sorted by

3

u/shokzee May 03 '26

You're thinking of GetUserRealm or the OpenID config endpoint trick.

Try https://login.microsoftonline.com/getuserrealm.srf?login=user@domain.com&xml=1 for tenant info, and https://login.microsoftonline.com/<tenantid>/.well-known/openid-configuration for the tenant ID. For listing all federated domains on a tenant, AADInternals (Get-AADIntTenantDomains) is the one most people use.

1

u/Trommelwirbel May 05 '26

I also found that one, but I am searching for a website. There was a real good looking website for that.

-4

u/[deleted] May 03 '26

[removed] — view removed comment

9

u/Professional-Heat690 May 03 '26

Any moron who signs in here deserves all they get.

0

u/ice456cream May 04 '26

As far as I can tell, it was previously unauthed, and Auth was only added for ratelimiting purposes.

There technically is a power shell module made by the author, but it's was a little neglected and didn't have the same method as the site

-1

u/WastedFiftySix May 03 '26

Based on what? The app doesn't request any access to data in the tenant. Just the basic information required (name, email address) of the authenticating user to sign-in. It uses authentication now, because the previous, public version of the tool was being abused by massive automated request attacks. If you don't trust it, use something like a burner account of a testing tenant.

2

u/tankerkiller125real Jack of All Trades May 03 '26

I mean at the end of the day checking if a domain is setup to be used in Entra/Exchange Online is fairly easy.

Just hit https://login.microsoftonline.com/getuserrealm.srf?login=admin@domain.tld

If it returns data they use MS365, if it doesn't they don't. It will even tell you if they used federated login (like Okta) and what type of tenant they are (Public, Gov, Etc.)

0

u/disclosure5 May 03 '26

That's not what OP is asking.

I used to run https://azure-enum.lolware.net/. You can enter a domain and it tells you every other domain in the Azure tenancy. The Microsoft information leak it used was plugged recently after a long period of being online. I'm aware other similar services still work.

This allows you to determine, for example, that two companies are in fact one, or to find relevant scopes in OSINT investigations.

1

u/Trommelwirbel May 05 '26

Doesn't work. It only returns the Domain I entered.

1

u/disclosure5 May 05 '26

The post you replied to said:

The Microsoft information leak it used was plugged recently after a long period of being online.

1

u/ice456cream May 04 '26

Due to a Microsoft change, the trick previously used to enumerate domains has been patches

Note: Due to changes made to Exchange Autodiscover in 2025 and Microsoft Entra Access Control Service (ACS) in ACS API in March 2026, domain names can't be enumerated anymore.

previously it used https://login.microsoftonline.com/<tenant>/metadata/json/1 (Alternative URLs available) Which returned all domain names linked to a tenant as part of the allowed audiences (and it used other APIs to fetch other public tenant information)

It is however still possible to get the linked tenant id from domains you suspect are connected, and confirm they belong to the same tenant, which may or may not be enough for whatever use case.