MicrosoftGraphIdentityandAccess

category: Authentication & Identity Management
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: MicrosoftGraphIdentityandAccess
  version: -1
configuration:
- section: Connect
  defaultvalue: 597c0375-766f-4e6d-ad2a-f48117044ac5
  display: Application ID (Client ID for Client credentials mode)
  name: app_id
  type: 0
  required: false
- section: Connect
  display: Tenant ID (required for Client Credentials mode)
  name: tenant_id
  type: 0
  required: false
- section: Connect
  displaypassword: Client Secret (required for Client Credentials mode)
  name: credentials
  type: 9
  additionalinfo: Client Secret. Required for Client Credentials mode)
  hiddenusername: true
  required: false
- section: Connect
  additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  display: Certificate Thumbprint
  name: creds_certificate
  type: 9
  displaypassword: Private Key
  advanced: true
  required: false
- section: Connect
  additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.
  display: Use Azure Managed Identities
  name: use_managed_identities
  type: 8
  required: false
- section: Connect
  additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  name: managed_identities_client_id
  hiddenusername: true
  type: 9
  required: false
- section: Connect
  defaultvalue: https://login.microsoftonline.com
  display: Azure AD endpoint
  name: azure_ad_endpoint
  options:
  - https://login.microsoftonline.com
  - https://login.microsoftonline.us
  - https://login.microsoftonline.de
  - https://login.chinacloudapi.cn
  type: 15
  additionalinfo: Azure AD endpoint associated with a national cloud.
  advanced: true
  required: false
- section: Connect
  display: Incident type
  name: incidentType
  type: 13
  required: false
  supportedModules:
  - agentix
  - xsiam
- section: Connect
  additionalinfo: Use a self-deployed Azure application and authenticate using the Client Credentials flow.
  display: Use Client Credentials Authorization Flow
  name: client_credentials
  type: 8
  required: false
- section: Connect
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  advanced: true
  required: false
- section: Connect
  display: Use system proxy settings
  name: proxy
  type: 8
  advanced: true
  required: false
- section: Collect
  name: isFetch
  display: Fetch incidents
  type: 8
  required: false
  supportedModules:
  - agentix
  - xsiam
- section: Collect
  name: first_fetch
  display: First Fetch Time Interval
  defaultvalue: 1 days
  type: 0
  additionalinfo: The time range to consider for the initial data fetch in the format <number> <unit>. For example, 1 hour, 2 hours, 6 hours, 12 hours, 24 hours, 48 hours, etc.
  required: false
- section: Collect
  defaultvalue: '50'
  display: Max Fetch Incidents Returned
  additionalinfo: The maximum number of incidents per request from Entra ID. Default is 50.
  name: max_fetch
  type: 0
  required: false
  supportedModules:
  - agentix
  - xsiam
- section: Collect
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
  supportedModules:
  - agentix
  - xsiam
- section: Collect
  display: Alerts to Fetch
  name: alerts_to_fetch
  defaultvalue: Risk Detections
  type: 15
  required: false
  advanced: true
  options:
  - Risky Users
  - Risk Detections
  additionalinfo: Select what type of Identity alert from MSGraph you want to ingest.
- section: Collect
  display: Fetch query
  name: fetch_filter_expression
  type: 0
  advanced: true
  required: false
- section: Collect
  display: Override Microsoft Entra ID Protection risk level
  name: override_issue_severity
  type: 8
  defaultvalue: 'true'
  additionalinfo: By default, Microsoft Entra ID Protection risk level is used as Cortex XSOAR/XSIAM issue severity. Select this option to override original risk level reported by Microsoft Entra ID Protection.
  advanced: true
  required: false
- section: Collect
  display: Issue severity
  name: issue_severity
  options:
  - critical
  - high
  - medium
  - low
  defaultvalue: medium
  type: 15
  additionalinfo: "Severity of the Cortex XSOAR/XSIAM issue to be created if Microsoft Entra ID Protection risk level override has been selected. Severity will be the same for all Microsoft Entra ID Protection alerts."
  advanced: true
  hidden: false
  required: false
description: Use the Entra ID Identity And Access integration to manage roles and members (formerly Azure Active Directory Identity And Access).
display: Entra ID Identity And Access
name: MicrosoftGraphIdentityandAccess
script:
  commands:
  - description: Run this command to start the authorization process and follow the instructions in the command results.
    name: msgraph-identity-auth-start
  - description: "Run this command to complete the authorization process.\nShould be used after running the msgraph-identity-auth-start command."
    name: msgraph-identity-auth-complete
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: msgraph-identity-auth-reset
  - description: Tests connectivity to Microsoft.
    name: msgraph-identity-auth-test
  - description: Lists the roles in the directory.
    name: msgraph-identity-directory-roles-list
    arguments:
    - name: limit
      description: Maximum number of results to fetch.
      defaultValue: 10
    outputs:
    - contextPath: MSGraphIdentity.Role.deletedDateTime
      description: The time when a role was deleted. Displays only if a role was deleted.
      type: Date
    - contextPath: MSGraphIdentity.Role.description
      description: The description of the directory role.
      type: String
    - contextPath: MSGraphIdentity.Role.displayName
      description: The display name of the directory role.
      type: String
    - contextPath: MSGraphIdentity.Role.id
      description: The unique identifier of the directory role.
      type: String
    - contextPath: MSGraphIdentity.Role.roleTemplateId
      description: The ID of the directory role template on which the role is based.
      type: String
  - description: Activates a role by its template ID.
    name: msgraph-identity-directory-role-activate
    arguments:
    - name: role_template_id
      description: ID of the role template to activate. Can be retrieved using the msgraph-identity-directory-roles-list command.
      required: true
    outputs:
    - contextPath: MSGraphIdentity.Role.deletedDateTime
      description: The time when the role was deleted. Displays only if the role was deleted.
      type: Date
    - contextPath: MSGraphIdentity.Role.description
      description: The description of the directory role.
      type: String
    - contextPath: MSGraphIdentity.Role.displayName
      description: The display name of the directory role.
      type: String
    - contextPath: MSGraphIdentity.Role.id
      description: The unique identifier of the directory role.
      type: String
    - contextPath: MSGraphIdentity.Role.roleTemplateId
      description: The ID of the directory role template on which this role is based.
      type: String
  - description: Gets all members in a role ID.
    name: msgraph-identity-directory-role-members-list
    arguments:
    - name: role_id
      description: The ID of the application for which to get its role members list. Can be retrieved using the msgraph-identity-directory-roles-list command.
      required: true
    - name: limit
      description: The maximum number of members to fetch.
      defaultValue: 10
    outputs:
    - contextPath: MSGraphIdentity.RoleMember.user_id
      description: The unique identifier of the user in the role.
      type: String
    - contextPath: MSGraphIdentity.RoleMember.role_id
      description: The unique identifier of the role specified in the input.
      type: String
  - description: Adds a user to a role.
    name: msgraph-identity-directory-role-member-add
    arguments:
    - name: role_id
      description: The ID of the role to add the user to. Can be retrieved using the msgraph-identity-directory-roles-list command.
      required: true
    - name: user_id
      description: The ID of the user to add to the role. Can be retrieved using the msgraph-identity-directory-role-members-list command.
      required: true
  - description: Removes a user from a role.
    name: msgraph-identity-directory-role-member-remove
    arguments:
    - name: role_id
      description: ID of the role from which to remove the user. Can be retrieved using the msgraph-identity-directory-roles-list command.
      required: true
    - name: user_id
      description: ID of the user to remove from the role. Can be retrieved using the msgraph-identity-directory-role-members-list command.
      required: true
  - description: Retrieve an ip named location by id.
    name: msgraph-identity-ip-named-locations-get
    arguments:
    - name: ip_id
      description: The id of the named ip location to get from the api.
      required: true
    outputs:
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.time_created
      description: The time when an ip named location was created.
      type: Date
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.time_modified
      description: The time when an ip named location was updated.
      type: Date
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.display_name
      description: The display name of the ip named location.
      type: String
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.id
      description: The unique identifier of the ip named location.
      type: String
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.is_trusted
      description: Abollean that taled if the ip named location is a trusted source.
      type: String
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.ip_ranges
      description: List of ip ranges for the ip named location.
      type: Array
  - description: Retrieve all ip named locations.
    name: msgraph-identity-ip-named-locations-list
    arguments:
    - name: limit
      description: The limit for results we get from the api.
    - name: page
      description: The page to get the data from.
    - name: odata_query
      description: An odata query to send to the api.
    outputs:
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.ip_named_locations
      description: List of ip named locations.
      type: Array
  - description: Delete an ip named location by id.
    name: msgraph-identity-ip-named-locations-delete
    arguments:
    - name: ip_id
      description: The id of the named ip location to get from the api.
      required: true
  - description: Create an ip named location.
    name: msgraph-identity-ip-named-locations-create
    arguments:
    - name: ips
      description: 'A comma-separated list of IP ranges to add to the named location. Each range must be in CIDR notation (IPv4 or IPv6), for example: "12.34.221.11/22,2001:0:9d38:90d6:0:0:0:0/63". Bare IP addresses without a CIDR suffix (for example "0.0.0.0") are rejected by Microsoft Graph. See [the Microsoft Graph documentation](https://learn.microsoft.com/en-us/graph/api/conditionalaccessroot-post-namedlocations).'
      isArray: true
    - name: is_trusted
      description: Whether the IPs can be trusted.
      defaultValue: 'false'
    - name: display_name
      description: The display name for the IP location.
    outputs:
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.time_created
      description: The time when an ip named location was created.
      type: Date
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.time_modified
      description: The time when an ip named location was updated.
      type: Date
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.display_name
      description: The display name of the ip named location.
      type: String
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.id
      description: The unique identifier of the ip named location.
      type: String
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.is_trusted
      description: Abollean that taled if the ip named location is a trusted source.
      type: String
    - contextPath: MSGraph.conditionalAccess.namedIpLocations.ip_ranges
      description: List of ip ranges for the ip named location.
      type: Array
  - description: update an ip named location by id.
    name: msgraph-identity-ip-named-locations-update
    arguments:
    - name: ip_id
      description: The id of the named ip location to get from the api.
      required: true
    - name: ips
      description: 'A comma-separated list of IP ranges to set on the named location. Each range must be in CIDR notation (IPv4 or IPv6), for example: "12.34.221.11/22,2001:0:9d38:90d6:0:0:0:0/63". Bare IP addresses without a CIDR suffix (for example "0.0.0.0") are rejected by Microsoft Graph. See [the Microsoft Graph documentation](https://learn.microsoft.com/en-us/graph/api/conditionalaccessroot-post-namedlocations).'
      isArray: true
    - name: is_trusted
      description: Whether the IPs can be trusted.
    - name: display_name
      description: The display name for the IP location.
  - description: Retrieve all the detected risks.
    name: msgraph-identity-protection-risks-list
    arguments:
    - name: limit
      description: The limit for results we get from the api.
    - name: odata_query
      description: An odata query to send to the api.
    outputs:
    - contextPath: MSGraph.identityProtection.risks.additionalInfo
      description: dentityProtection.risks.additionalInfo
      type: string
    - contextPath: MSGraph.identityProtection.risks.userPrincipalName
      description: Risky user principal name.
      type: string
    - contextPath: MSGraph.identityProtection.risks.userDisplayName
      description: Risky user display name.
      type: string
    - contextPath: MSGraph.identityProtection.risks.userId
      description: Unique ID of the user.
      type: string
    - contextPath: MSGraph.identityProtection.risks.lastUpdatedDateTime
      description: Date and time that the risk detection was last updated. The DateTimeOffset type represents date and time information using the ISO 8601 format and is always in UTC time.
      type: string
    - contextPath: MSGraph.identityProtection.risks.detectedDateTime
      description: Date and time that the risk was detected. The DateTimeOffset type represents date and time information using the ISO 8601 format and is always in UTC time.
      type: string
    - contextPath: MSGraph.identityProtection.risks.activityDateTime
      description: Date and time that the risky activity occurred. The DateTimeOffset type represents date and time information using the ISO 8601 format and is always in UTC time.
      type: string
    - contextPath: MSGraph.identityProtection.risks.location.state
      description: State of the sign-in.
      type: string
    - contextPath: MSGraph.identityProtection.risks.location.geoCoordinates.longitude
      description: Longitude of the sign-in.
      type: string
    - contextPath: MSGraph.identityProtection.risks.location.geoCoordinates.latitude
      description: Latitude of the sign-in.
      type: string
    - contextPath: MSGraph.identityProtection.risks.location.countryOrRegion
      description: Country or region of the sign-in.
      type: string
    - contextPath: MSGraph.identityProtection.risks.location.city
      description: City of the sign-in.
      type: string
    - contextPath: MSGraph.identityProtection.risks.ipAddress
      description: Provides the IP address of the client from where the risk occurred.
      type: string
    - contextPath: MSGraph.identityProtection.risks.tokenIssuerType
      description: Indicates the type of token issuer for the detected sign-in risk. The possible values are AzureAD, ADFederationServices, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.risks.activity
      description: Indicates the activity type the detected risk is linked to. The possible values are signin, user, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.risks.detectionTimingType
      description: Timing of the detected risk (real-time/offline). The possible values are notDefined, realtime, nearRealtime, offline, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.risks.source
      description: Source of the risk detection. For example, activeDirectory.
      type: string
    - contextPath: MSGraph.identityProtection.risks.riskDetail
      description: Reason why the user is considered a risky user. The possible values are limited to none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.risks.riskstate
      description: State of the user's risk. The possible values are none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.risks.riskLevel
      description: Risk level of the detected risky user. The possible values are low, medium, high, hidden, none, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.risks.riskType
      description: Deprecated. Use riskEventType instead. List of risk event types.
      type: string
    - contextPath: MSGraph.identityProtection.risks.riskEventType
      description: The type of risk event detected. The possible values are unlikelyTravel, anonymizedIPAddress, maliciousIPAddress, unfamiliarFeatures, malwareInfectedIPAddress, suspiciousIPAddress, leakedCredentials, investigationsThreatIntelligence, generic,adminConfirmedUserCompromised, mcasImpossibleTravel, mcasSuspiciousInboxManipulationRules, investigationsThreatIntelligenceSigninLinked, maliciousIPAddressValidCredentialsBlockedIP, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.risks.correlationId
      description: Correlation ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
      type: string
    - contextPath: MSGraph.identityProtection.risks.requestId
      description: The ID of the sign-in associated with the risk detection. This property is null if the risk detection is not associated with a sign-in.
      type: string
    - contextPath: MSGraph.identityProtection.risks.id
      description: Unique ID of the risk detection.
      type: string
  - description: Retrieve the risky users in active directory.
    name: msgraph-identity-protection-risky-user-list
    arguments:
    - name: limit
      description: The limit for results we get from the api.
    - name: odata_query
      description: An odata query to send to the api.
    outputs:
    - contextPath: MSGraph.identityProtection.risky-users.userPrincipalName
      description: Risky user principal name.
      type: string
    - contextPath: MSGraph.identityProtection.risky-users.userDisplayName
      description: Risky user display name.
      type: string
    - contextPath: MSGraph.identityProtection.risky-users.riskDetail
      description: Reason why the user is considered a risky user. The possible values are limited to none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.risky-users.riskstate
      description: State of the user's risk. The possible values are none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.risky-users.riskLevel
      description: Risk level of the detected risky user. The possible values are low, medium, high, hidden, none, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.risky-users.riskLastUpdatedDateTime
      description: The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using the ISO 8601 format and is always in UTC time.
      type: DateTime
    - contextPath: MSGraph.identityProtection.risky-users.isProcessing
      description: Indicates whether a user's risky state is being processed by the backend.
      type: Boolean
    - contextPath: MSGraph.identityProtection.risky-users.isDeleted
      description: Indicates whether a user is delted.
      type: Boolean
    - contextPath: MSGraph.identityProtection.risky-users.id
      description: Unique ID of the risky user.
      type: string
  - description: Retrieve the risky users history in active directory.
    name: msgraph-identity-protection-risky-user-history-list
    arguments:
    - name: limit
      description: The limit for results we get from the api.
    - name: odata_query
      description: An odata query to send to the api.
    - name: user_id
      description: The id of the user to get the history for.
      required: true
    outputs:
    - contextPath: MSGraph.identityProtection.RiskyUserHistory.userPrincipalName
      description: Risky user principal name.
      type: string
    - contextPath: MSGraph.identityProtection.RiskyUserHistory.userDisplayName
      description: Risky user display name.
      type: string
    - contextPath: MSGraph.identityProtection.RiskyUserHistory.riskDetail
      description: Reason why the user is considered a risky user. The possible values are limited to none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, hidden, adminConfirmedUserCompromised, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.RiskyUserHistory.riskstate
      description: State of the user's risk. The possible values are none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.RiskyUserHistory.riskLevel
      description: Risk level of the detected risky user. The possible values are low, medium, high, hidden, none, and unknownFutureValue.
      type: string
    - contextPath: MSGraph.identityProtection.RiskyUserHistory.riskLastUpdatedDateTime
      description: The date and time that the risky user was last updated. The DateTimeOffset type represents date and time information using the ISO 8601 format and is always in UTC time.
      type: DateTime
    - contextPath: MSGraph.identityProtection.RiskyUserHistory.isProcessing
      description: Indicates whether a user's risky state is being processed by the backend.
      type: Boolean
    - contextPath: MSGraph.identityProtection.RiskyUserHistory.isDeleted
      description: Indicates whether the user is deleted.
      type: Boolean
    - contextPath: MSGraph.identityProtection.RiskyUserHistory.id
      description: Unique ID of the risky user.
      type: string
  - description: Retrieve Microsoft Entra ID sign-in event.
    name: msgraph-identity-audit-signin-event-get
    arguments:
    - name: id
      description: Unique ID representing the sign-in event.
      required: true
    outputs:
    - contextPath: MSGraphIdentity.AuditLog.signIns.appDisplayName
      description: App name displayed in the Microsoft Entra admin center.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.appId
      description: Unique GUID that represents the app ID in the Microsoft Entra ID.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.appliedConditionalAccessPolicies
      description: List of conditional access policies that the corresponding sign-in activity triggers.
      type: array
    - contextPath: MSGraphIdentity.AuditLog.signIns.clientAppUsed
      description: Identifies the client used for the sign-in activity. Modern authentication clients include Browser, modern clients. Legacy authentication clients include Exchange ActiveSync, IMAP, MAPI, SMTP, POP, and other clients.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.conditionalAccessStatus
      description: Reports status of activated conditional access policy. Possible values are success, failure, notApplied, and unknownFutureValue.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.correlationId
      description: The request ID sent from the client when the sign-in is initiated. Used to troubleshoot sign-in activity.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.createdDateTime
      description: Date and time (UTC) the sign-in was initiated.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.deviceDetail
      description: Device information from where the sign-in occurred; includes device ID, operating system, and browser.
      type: object
    - contextPath: MSGraphIdentity.AuditLog.signIns.id
      description: Unique ID representing the sign-in activity.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.ipAddress
      description: IP address of the client used to sign in.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.isInteractive
      description: Indicates whether a sign-in is interactive.
      type: boolean
    - contextPath: MSGraphIdentity.AuditLog.signIns.location
      description: Provides the city, state, and country code where the sign-in originated.
      type: object
    - contextPath: MSGraphIdentity.AuditLog.signIns.resourceDisplayName
      description: Name of the resource the user signed into.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.riskDetail
      description: The reason behind a specific state of a risky user, sign-in, or a risk event. The value none means that Microsoft Entra risk detection did not flag the user or the sign-in as a risky event so far.
      type: array
    - contextPath: MSGraphIdentity.AuditLog.signIns.riskEventTypes_v2
      description: The list of risk event types associated with the sign-in.
      type: array
    - contextPath: MSGraphIdentity.AuditLog.signIns.riskLevelAggregated
      description: Aggregated risk level. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.riskLevelDuringSignIn
      description: Risk level during sign-in. The value hidden means the user or sign-in wasn't enabled for Microsoft Entra ID Protection.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.riskState
      description: Reports status of the risky user, sign-in, or a risk event.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.status
      description: Sign-in status. Includes the error code and description of the error (if a sign-in failure occurs).
      type: object
    - contextPath: MSGraphIdentity.AuditLog.signIns.userDisplayName
      description: Display name of the user that initiated the sign-in.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.userId
      description: ID of the user that initiated the sign-in.
      type: string
    - contextPath: MSGraphIdentity.AuditLog.signIns.userPrincipalName
      description: User principal name of the user that initiated the sign-in. This value is always in lowercase.
      type: string
  - description: Delete an ip named location by id.
    name: msgraph-identity-protection-risky-user-confirm-compromised
    arguments:
    - name: user_ids
      description: The ids of the users to compromise seperated be commas.
      required: true
    compliantpolicies:
    - User Hard Remediation
  - description: Delete an ip named location by id.
    name: msgraph-identity-protection-risky-user-dismiss
    arguments:
    - name: user_ids
      description: The ids of the users to dismiss seperated be commas.
      required: true
    compliantpolicies:
    - User Soft Remediation
  - description: Retrieve one or all Conditional Access policies from Microsoft Graph API.
    name: msgraph-identity-ca-policies-list
    arguments:
    - name: policy_id
      description: The ID of the Conditional Access policy to retrieve. If not provided, all policies will be returned.
    - name: filter
      description: The OData filter query to retrieve specific Conditional Access policies.
    - name: limit
      description: The maximum number of Conditional Access policies to return. Applicable only when all_results is set to false.
    - name: all_results
      description: Whether to retrieve all results without applying the 'limit'. Default value is true.
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.id
      description: The unique ID of the Conditional Access policy.
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.displayName
      description: The display name of the Conditional Access policy.
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.createdDateTime
      description: The date and time the policy was created.
      type: date
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.modifiedDateTime
      description: The date and time the policy was last modified.
      type: date
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.state
      description: The state of the policy (enabled/disabled).
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.signInRiskLevels
      description: List of sign-in risk levels this policy applies to.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.clientAppTypes
      description: Client application types this policy targets.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.applications.includeApplications
      description: List of applications included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.applications.excludeApplications
      description: List of applications excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.applications.includeUserActions
      description: User actions included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.includeUsers
      description: User IDs included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.excludeUsers
      description: User IDs excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.includeGroups
      description: Group IDs included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.excludeGroups
      description: Group IDs excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.includeRoles
      description: Role IDs included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.excludeRoles
      description: Role IDs excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.platforms.includePlatforms
      description: Platforms included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.platforms.excludePlatforms
      description: Platforms excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.locations.includeLocations
      description: Location IDs included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.locations.excludeLocations
      description: Location IDs excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.grantControls.operator
      description: Logical operator used in the grant controls (e.g., AND, OR).
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.grantControls.builtInControls
      description: List of built-in access controls (e.g., MFA, compliant device).
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.grantControls.customAuthenticationFactors
      description: Custom authentication factors used in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.grantControls.termsOfUse
      description: List of Terms of Use policy IDs applied.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.sessionControls.cloudAppSecurity.cloudAppSecurityType
      description: The type of cloud app security control.
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.sessionControls.cloudAppSecurity.isEnabled
      description: Whether cloud app security is enabled.
      type: boolean
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.sessionControls.signInFrequency.value
      description: Sign-in frequency value.
      type: number
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.sessionControls.signInFrequency.type
      description: Unit of the sign-in frequency (e.g., hours, days).
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.sessionControls.signInFrequency.isEnabled
      description: Whether sign-in frequency control is enabled.
      type: boolean
  - description: Delete specific Conditional Access policy by ID.
    name: msgraph-identity-ca-policy-delete
    arguments:
    - name: policy_id
      description: The ID of the Conditional Access policy to delete.
      required: true
  - description: Creates a Conditional Access policy.
    name: msgraph-identity-ca-policy-create
    arguments:
    - name: policy
      description: "JSON object containing the policy details. Ensure a valid policy object is passed. \n"
    - name: policy_name
      description: The name of the Conditional Access policy to be created. Required if policy argument not present.
    - name: state
      description: "The state of the policy.\nRequired if policy argument not present.\n"
      auto: PREDEFINED
      predefined:
      - enabled
      - disabled
    - name: sign_in_risk_levels
      description: "List of sign-in risk levels for the policy. Options: `low`, `medium`, `high`, `none`.\nRequired if policy argument not present.\n"
      isArray: true
    - name: user_risk_levels
      description: "List of user risk levels for the policy. Options: `low`, `medium`, `high`.\nRequired if policy argument not present.\n"
      isArray: true
    - name: client_app_types
      description: "List of types of client apps to be included in the policy. Options: `all`, `browser`, `mobileAppsAndDesktopClients`, `exchangeActiveSync`, `easSupported`, `other`.\nRequired if policy argument not present.\n"
      isArray: true
    - name: include_applications
      description: "List of application IDs to be included in the policy. If no applications are defined, `includeApplications: 'none'` will be used.\n"
      isArray: true
    - name: exclude_applications
      description: "List of application IDs to be excluded from the policy.\n"
      isArray: true
    - name: include_user_actions
      description: "List of user actions to be included in the policy.\n"
      isArray: true
      auto: PREDEFINED
      predefined:
      - vrn:user:registersecurityinfo
      - urn:user:registerdevice
    - name: include_users
      description: "List of user IDs to be included in the policy. Options: None, All, GuestsOrExternalUsers.\n"
      isArray: true
    - name: exclude_users
      description: "List of user IDs to be excluded from the policy.\n"
      isArray: true
    - name: include_groups
      description: "List of group IDs to be included in the policy.\n"
      isArray: true
    - name: exclude_groups
      description: "List of group IDs to be excluded from the policy.\n"
      isArray: true
    - name: include_roles
      description: "List of role IDs to be included in the policy.\n"
      isArray: true
    - name: exclude_roles
      description: "List of role IDs to be excluded from the policy.\n"
      isArray: true
    - name: include_platforms
      description: "List of platforms to be included in the policy. Options: `Android`, `iOS`, `Windows`, `windowsPhone`, `macOS`, `Linux`, `all`.\n"
      isArray: true
    - name: exclude_platforms
      description: "List of platforms to be excluded from the policy.\n"
      isArray: true
    - name: include_locations
      description: "List of location IDs to be included in the policy. Options: `All`, `AllTrusted`, or a list of specific location IDs.\n"
      isArray: true
    - name: exclude_locations
      description: "List of location IDs to be excluded from the policy.\n"
      isArray: true
    - name: grant_control_operator
      description: "The operator for grant control.\nDefault value is 'AND'."
      defaultValue: AND
      auto: PREDEFINED
      predefined:
      - AND
      - OR
    - name: grant_control_enforcement
      description: "List of built-in controls for the policy. Options: `block`, `mfa`, `compliantDevice`, `domainJoinedDevice`, `approvedApplication`, `compliantApplication`, `passwordChange`.\nDefault value is 'mfa'\nSpecial considerations when using `passwordChange`: \n- `passwordChange` must be accompanied by `mfa` using an `AND` operator.\n- `passwordChange` must be used with `userRiskLevels`.\n- The policy should target all applications and not exclude any.\n"
      isArray: true
      defaultValue: mfa
    outputs:
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.id
      description: The unique ID of the Conditional Access policy.
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.displayName
      description: The display name of the Conditional Access policy.
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.createdDateTime
      description: The date and time the policy was created.
      type: date
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.modifiedDateTime
      description: The date and time the policy was last modified.
      type: date
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.state
      description: The state of the policy (enabled/disabled).
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.signInRiskLevels
      description: List of sign-in risk levels this policy applies to.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.clientAppTypes
      description: Client application types this policy targets.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.applications.includeApplications
      description: List of applications included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.applications.excludeApplications
      description: List of applications excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.applications.includeUserActions
      description: User actions included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.includeUsers
      description: User IDs included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.excludeUsers
      description: User IDs excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.includeGroups
      description: Group IDs included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.excludeGroups
      description: Group IDs excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.includeRoles
      description: Role IDs included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.users.excludeRoles
      description: Role IDs excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.platforms.includePlatforms
      description: Platforms included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.platforms.excludePlatforms
      description: Platforms excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.locations.includeLocations
      description: Location IDs included in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.conditions.locations.excludeLocations
      description: Location IDs excluded from the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.grantControls.operator
      description: Logical operator used in the grant controls (e.g., AND, OR).
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.grantControls.builtInControls
      description: List of built-in access controls (e.g., MFA, compliant device).
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.grantControls.customAuthenticationFactors
      description: Custom authentication factors used in the policy.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.grantControls.termsOfUse
      description: List of Terms of Use policy IDs applied.
      type: list
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.sessionControls.cloudAppSecurity.cloudAppSecurityType
      description: The type of cloud app security control.
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.sessionControls.cloudAppSecurity.isEnabled
      description: Whether cloud app security is enabled.
      type: boolean
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.sessionControls.signInFrequency.value
      description: Sign-in frequency value.
      type: number
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.sessionControls.signInFrequency.type
      description: Unit of the sign-in frequency (e.g., hours, days).
      type: string
    - contextPath: MSGraphIdentity.ConditionalAccessPolicy.sessionControls.signInFrequency.isEnabled
      description: Whether sign-in frequency control is enabled.
      type: boolean
  - description: Updates a Conditional Access policy. By default, the command attempts to **append** values to existing list-based fields (e.g., `include_users`, `include_groups`, etc.). If a field does not support appending (i.e., it's not a list), the command **overrides** the existing value with the new one.
    name: msgraph-identity-ca-policy-update
    arguments:
    - name: policy_id
      description: The ID of the Conditional Access policy to update.
      required: true
    - name: policy
      description: "JSON object containing the policy details. Ensure a valid policy object is passed. If no `policy` argument is provided,\nother required arguments like `policy_name`, `state`, etc. must be included.\n"
    - name: policy_name
      description: The name of the Conditional Access policy to be created.
    - name: state
      description: "The state of the policy.\n"
      auto: PREDEFINED
      predefined:
      - enabled
      - disabled
    - name: sign_in_risk_levels
      description: "List of sign-in risk levels for the policy. Options: `low`, `medium`, `high`, `none`.\n"
      isArray: true
    - name: user_risk_levels
      description: "List of user risk levels for the policy. Options: `low`, `medium`, `high`.\n"
      isArray: true
    - name: client_app_types
      description: "Types of client apps to be included in the policy. Options: `all`, `browser`, `mobileAppsAndDesktopClients`, `exchangeActiveSync`, `easSupported`, `other`.\n"
      isArray: true
    - name: include_applications
      description: "List of application IDs to be included in the policy. If no applications are defined, `includeApplications: 'none'` will be used.\n"
      isArray: true
    - name: exclude_applications
      description: "List of application IDs to be excluded from the policy.\n"
      isArray: true
    - name: include_user_actions
      description: "List of user actions to be included in the policy. Options: `vrn:user:registersecurityinfo`, `urn:user:registerdevice`.\n"
      auto: PREDEFINED
      predefined:
      - vrn:user:registersecurityinfo
      - urn:user:registerdevice
      isArray: true
    - name: include_users
      description: "List of user IDs to be included in the policy. Options: None, All, GuestsOrExternalUsers.\n"
      isArray: true
    - name: exclude_users
      description: "List of user IDs to be excluded from the policy.\n"
      isArray: true
    - name: include_groups
      description: "List of group IDs to be included in the policy.\n"
      isArray: true
    - name: exclude_groups
      description: "List of group IDs to be excluded from the policy.\n"
      isArray: true
    - name: include_roles
      description: "List of role IDs to be included in the policy.\n"
      isArray: true
    - name: exclude_roles
      description: "List of role IDs to be excluded from the policy.\n"
      isArray: true
    - name: include_platforms
      description: "List of platforms to be included in the policy. Options: `Android`, `iOS`, `Windows`, `windowsPhone`, `macOS`, `Linux`, `all`.\n"
      isArray: true
    - name: exclude_platforms
      description: "List of platforms to be excluded from the policy.\n"
      isArray: true
    - name: include_locations
      description: "List of location IDs to be included in the policy. Options: `All`, `AllTrusted`, or a list of specific location IDs.\n"
      isArray: true
    - name: exclude_locations
      description: "List of location IDs to be excluded from the policy.\n"
      isArray: true
    - name: grant_control_operator
      description: "The operator for grant control.\n"
      auto: PREDEFINED
      predefined:
      - AND
      - OR
    - name: grant_control_enforcement
      description: "List of built-in controls for the policy. Options: `block`, `mfa`, `compliantDevice`, `domainJoinedDevice`, `approvedApplication`, `compliantApplication`, `passwordChange`.\nSpecial considerations when using `passwordChange`: \n- `passwordChange` must be accompanied by `mfa` using an `AND` operator.\n- `passwordChange` must be used with `userRiskLevels`.\n- The policy should target all applications and not exclude any.\n"
      isArray: true
    - name: update_action
      description: "Defines how to update fields in the policy.\n- `override` (default): Replaces existing values.\n- `append`: Adds new values to existing ones without removing them.\n"
      auto: PREDEFINED
      predefined:
      - override
      - append
  isfetch: true
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/crypto:1.0.0.10120494
fromversion: 5.0.0
defaultmapperin: Microsoft Graph Identity and Access Incoming Mapper
defaultclassifier: Microsoft Graph Identity and Access Classifier
tests:
- Identity & Access test playbook