Microsoft Identity And Access (Graph) is the gateway to access Azure Active Directory (Azure AD) resources to enable scenarios like managing administrator (directory) roles, inviting external users to an organization

Connect Microsoft Identity And Access (Graph) with Devo SOARD

1. Navigate to Automations > Integrations.

2. Search for Microsoft Identity And Access.

3. Click Details, then the + icon. Enter the required information in the following fields.

4. Label: Enter a connection name.

5. Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.

6. Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).

7. Remote Agent: Run this integration using the Devo SOAR Remote Agent.

8. Tenant ID: Tenant ID of the app created in Azure Active Directory.

9. Client ID: Client ID of the app created in Azure Active Directory.

10. Client Secret: Client secret of the app created in Azure Active Directory.

11. After you've entered all the details, click Connect.

Actions for Microsoft Identity And Access (Graph)

List Risk Detections

Get a list of the risk detection objects and their properties.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

json containing following items:

• has_error: True/False

• error: message/null

• result: List of Risk Detections.

Get Risk Detection

Retrieve the properties and relationships of a risk detection object.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Risk Detection.

List Risky Users

Get a list of the risky user objects and their properties.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: List of Risky Users

Get Risky User

Retrieve the properties and relationships of a risky user object.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Risky User

Confirm Compromised Risky User

Confirm one or more risky user objects as compromised. This action sets the targeted user's risk level to high.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Success/Failure

Dismiss Compromised Risky User

Dismiss the risk of one or more risky user objects. This action sets the targeted user's risk level to none.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: Success/Failure

List User History

Get the risky user history items from the history navigation property.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: List of User History

Get User History

Retrieve the properties and relationships of a risky user history item object

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: User History

List IP Named Location

Get a list of namedLocation objects.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

``` {json}{ "result": [ { "@odata.type": "#microsoft.graph.ipNamedLocation", "id": "0aab4fe7-d8ad-44cd-8c36-815fc0e82b24", "displayName": "1610469824546", "modifiedDateTime": "2022-04-11T07:20:08.871778Z", "createdDateTime": "2022-04-11T07:20:08.871778Z", "isTrusted": false, "ipRanges": [ { "@odata.type": "#microsoft.graph.iPv4CidrRange", "cidrAddress": "12.34.221.11/22" } ] }, { "@odata.type": "#microsoft.graph.ipNamedLocation", "id": "02e33bf8-c949-408e-950a-211b32223ce1", "displayName": "1610469824892", "modifiedDateTime": "2022-04-11T07:20:09.9641995Z", "createdDateTime": "2022-04-11T07:20:09.9641995Z", "isTrusted": false, "ipRanges": [ { "@odata.type": "#microsoft.graph.iPv4CidrRange", "cidrAddress": "12.34.221.11/22" } ] } ], "has_error": false, "error": null, "stdout": "", "stderr": "" }

Get IP Named Location

Get namedLocation object.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• has_error: True/False

• error: message/null

• result: IP Named Location Object

``` {json}{ "result": { "@odata.type": "#microsoft.graph.ipNamedLocation", "id": "0aab4fe7-d8ad-44cd-8c36-815fc0e82b24", "displayName": "1610469824546", "modifiedDateTime": "2022-04-11T07:20:08.871778Z", "createdDateTime": "2022-04-11T07:20:08.871778Z", "isTrusted": false, "ipRanges": [ { "@odata.type": "#microsoft.graph.iPv4CidrRange", "cidrAddress": "12.34.221.11/22" } ] }, "has_error": false, "error": null, "stdout": "", "stderr": "" }

Update IP Named Location

Update namedLocation objects.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

{json}{ "result": "Updated successfully.", "error": null, "has_error": false }

Release Notes

• v2.0.0 - Updated architecture to support IO via filesystem

• v1.1.1 - Added 5 new actions: List IP NamedLocation, Create IP NamedLocation, Get IP NamedLocation, Update IP NamedLocation and Delete IP NamedLocation.