# GraphSpy

GraphSpy is a Red-Team & Adversary Emulation product. It runs on-premises. Pricing is free.

GraphSpy is a browser-based post-exploitation tool for Azure Active Directory and Office 365 environments that enables token management, reconnaissance, and interaction with Microsoft 365 services.

Checked October 2026.

## What is GraphSpy?

GraphSpy is a browser-based post-exploitation tool designed for Azure Active Directory and Office 365 environments. The tool provides security professionals with capabilities to manage access tokens, perform reconnaissance, and interact with Microsoft 365 services after gaining initial access to target systems.

The tool offers comprehensive token management functionality, allowing users to store and manage access and refresh tokens for multiple users and scopes. It supports device code authentication flows and provides capabilities to manipulate multi-factor authentication methods for maintaining persistence in compromised environments.

GraphSpy includes several modules for post-exploitation activities across Microsoft 365 services. The file access module enables interaction with OneDrive and SharePoint, providing download and upload capabilities for document manipulation. Email functionality allows access and manipulation through Outlook using either direct web access or Graph API integration.

The tool supports Microsoft Teams message reading and sending, Graph API searching across Microsoft 365 applications, and custom API request capabilities with template storage for repeated operations. It includes Entra ID user enumeration features for gathering detailed user information during reconnaissance phases.

GraphSpy operates as a local web application accessible through standard web browsers, supporting both light and dark modes for user preference. The tool can be installed via pipx and functions across multiple operating systems, with primary testing conducted on Linux and Windows platforms. It supports multiple database configurations to organize tokens and device codes for different assessment engagements.

Tags: Post Exploitation, Azure, Reconnaissance, Office 365, Microsoft 365, Active Directory

## Quick facts

- Category: [Offensive Security](https://cybersectools.com/categories/offensive-security-testing) · [Red-Team & Adversary Emulation](https://cybersectools.com/categories/offensive-security)
- Deployment: On-Premises
- Company size fit: Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 1,176
- Website: github.com

## GraphSpy FAQ

### What is GraphSpy?

GraphSpy is a product in the Red-Team & Adversary Emulation category. It covers Post Exploitation, Azure and Reconnaissance.

### What is the pricing for GraphSpy?

GraphSpy is free. Download and setup instructions are at https://github.com/RedByte1337/GraphSpy/.

### What are alternatives to GraphSpy?

Alternatives to GraphSpy listed on CybersecTools:

1. [Fortra Cobalt Strike](https://cybersectools.com/tools/fortra-cobalt-strike) - Threat emulation product for adversary simulations and red team operations (Commercial)
2. [Core Security Cobalt Strike](https://cybersectools.com/tools/core-security-cobalt-strike) - Post-exploitation threat emulation platform for red team operations. (Commercial)
3. [Red Specter Cheatsheet](https://cybersectools.com/tools/red-specter-cheatsheet) - CLI cheatsheet for Red Specter's 30-tool offensive security platform. (Commercial)
4. [Crimson7 Offensive Engineering](https://cybersectools.com/tools/crimson7-offensive-engineering) - Red/purple team and identity security assessment service simulating real adversary attacks (Commercial)
5. [Trickest Attack Surface Management](https://cybersectools.com/tools/trickest-attack-surface-management) - Platform for offensive security operations including ASM, VA, and DAST (Commercial)

Compare all GraphSpy alternatives at [https://cybersectools.com/alternatives/graphspy](https://cybersectools.com/alternatives/graphspy)

### What deployment and organization size does GraphSpy fit?

GraphSpy is available as on-premises software. It is listed for mid-market companies and enterprises. It is free.

## Compare GraphSpy with similar solutions

- [GraphSpy vs Fortra Cobalt Strike](https://cybersectools.com/compare/fortra-cobalt-strike-vs-graphspy)
- [GraphSpy vs Core Security Cobalt Strike](https://cybersectools.com/compare/core-security-cobalt-strike-vs-graphspy)
- [GraphSpy vs Red Specter Cheatsheet](https://cybersectools.com/compare/graphspy-vs-red-specter-cheatsheet)

All alternatives to GraphSpy: [/alternatives/graphspy](https://cybersectools.com/alternatives/graphspy)

---

Source: https://cybersectools.com/tools/graphspy

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on GraphSpy: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md