feat(microsoft_ad): licensing, security, audit, role, and device operations - #6742
feat(microsoft_ad): licensing, security, audit, role, and device operations#6742waleedlatif1 wants to merge 3 commits into
Conversation
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 36185505 | Triggered | Generic Password | abc14c2 | apps/sim/tools/microsoft_ad/reset_password.ts | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryHigh Risk Overview New capabilities include license assign/list and tenant SKUs; password set/reset, auth-method listing, and sign-in session revocation; sign-in and directory audit log reads; app role grant/revoke and service-principal/application assignment listing; directory role member add/remove; device list/get and per-user device reads; and read-only conditional access policy list/get. Descriptions now stress identities, licenses, roles, and access; device writes are explicitly not supported. The block adds operation-specific sub-blocks (license SKUs, password/MFA flags, per-endpoint OData filters with wand helpers for sign-ins and audits, role/device/policy IDs) and canvas sentences for each new operation. Paging is centralized via shared OAuth for Docs refresh create-user output fields (e.g. Reviewed by Cursor Bugbot for commit 08b8ff1. Configure here. |
Greptile SummaryThe PR expands the Microsoft Entra ID integration with licensing, password and session management, audit-log access, role assignments, service-principal discovery, device reads, and conditional-access reads.
Confidence Score: 5/5The PR appears safe to merge because no blocking failure remains from the prior review threads. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| apps/sim/blocks/blocks/microsoft_ad.ts | Expands the block operation catalog and maps operation-specific inputs, filters, searches, pagination, and password options. |
| apps/sim/lib/oauth/oauth.ts | Adds delegated Microsoft Graph scopes required by the newly exposed operations. |
| apps/sim/tools/microsoft_ad/reset_password.ts | Implements asynchronous password reset and correctly reads a generated password from the response root. |
| apps/sim/tools/microsoft_ad/revoke_sign_in_sessions.ts | Implements delegated session revocation using an already-requested qualifying permission. |
| apps/sim/tools/registry.ts | Registers the new Microsoft AD tools for runtime dispatch. |
| apps/docs/content/docs/en/integrations/microsoft_ad.mdx | Documents the expanded operation set, inputs, outputs, privilege implications, and read-only device support. |
Sequence Diagram
sequenceDiagram
participant Workflow
participant Block as Microsoft AD Block
participant Tool as Selected Microsoft AD Tool
participant Graph as Microsoft Graph v1.0
Workflow->>Block: Execute configured operation
Block->>Block: Map operation-specific parameters
Block->>Tool: Dispatch registered tool
Tool->>Graph: Send OAuth-authenticated request
Graph-->>Tool: Return operation response
Tool-->>Workflow: Return normalized workflow output
Reviews (4): Last reviewed commit: "fix(microsoft_ad): clear non-owning filt..." | Re-trigger Greptile
…ations Deepens the Microsoft Entra ID block from 12 to 36 tools against the Microsoft Graph v1.0 reference: license assignment and tenant SKUs, password set/reset, sign-in session revocation, authentication methods, sign-in and directory audit logs, app role and directory role assignments, service principals, device reads, and conditional access policy reads. Device write (device-update, device-delete) is deliberately excluded. Both document Directory.AccessAsUser.All as their only delegated scope, with the higher-privileged read documented as unavailable, so supporting them would mean requesting tenant-wide act-as-the-user directory access for two operations that additionally require the caller to hold Intune Administrator. Also drops an undocumented ?$select= from create_user that was silently nulling department and accountEnabled in the response.
21f891a to
abc14c2
Compare
|
@cursor review |
The params mapper assigned result.filter from each filter subBlock in turn, so the last non-empty one won regardless of the selected operation. Because a subBlock keeps its value after the operation changes, a filter written for one endpoint was sent to every other collection operation — invalid OData against a different Graph resource, or a silently wrong page. Resolves the filter and search terms from an explicit operation-to-field map instead, so each operation reads only the field it owns.
|
@cursor review |
…nputs
The executor merges { ...inputs, ...transformedParams }, so declining to copy a
stale filter is not enough — the serialized value survives the merge and still
reaches the tool. Advanced-mode subBlocks are serialized on non-emptiness alone
and never have their condition evaluated, so the value is present even when the
field is hidden.
Write filter and search on every operation, as undefined when the operation owns
neither, so the merge clears them.
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 08b8ff1. Configure here.
Summary
Deepens the Microsoft Entra ID (Azure AD) block from 12 to 36 tools, adding licensing, password/session management, sign-in and directory audit logs, app and directory role assignments, service principals, device reads, and conditional access policy reads.
Two things need a maintainer decision before merge:
1. Device write was dropped, deliberately
device-updateanddevice-deletedocumentDirectory.AccessAsUser.Allas the only delegated scope — the higher-privileged read is literally documented as "Not available", andDevice.ReadWrite.Allis application-only, so it is not reachable from a delegated connection. The operation additionally requires the signed-in user to hold Intune Administrator.Rather than take act-as-the-signed-in-user directory access across the whole tenant for two operations that would still fail for most admins, both tools were removed. That took the count from 38 to 36, and
Directory.AccessAsUser.Allis not requested anywhere. Device support is read-only (Device.Read.All).This is a one-commit revert if the team would rather ship them.
2. The new scopes force re-consent on every existing connection
Every existing
microsoft-adconnection will need to re-consent to pick up the added scopes. That is a migration and comms question, not an engineering one — flagging it rather than deciding it.Scopes added:
LicenseAssignment.ReadWrite.All,UserAuthenticationMethod.ReadWrite.All,AuditLog.Read.All,Application.Read.All,AppRoleAssignment.ReadWrite.All,RoleManagement.ReadWrite.Directory,Device.Read.All,Policy.Read.All.Also worth noting
create_userno longer sends an undocumented?$select=, which was silently nullingdepartmentandaccountEnabledin the response.GitGuardian finding — needs a dashboard dismissal
The scan flags
28c10230-6103-485e-b985-444c60001490inreset_password.ts. That is Microsoft's fixed, publicly documented object id for a user's password authentication method — identical for every user in every tenant, and required as a literal route segment to build theresetPasswordURL. It is a path component, not a credential. It's inlined at its single call site with a doc reference so the context is visible where it's read; someone with dashboard access will need to mark it as a false positive.Type of Change
Testing
Validated against the Microsoft Graph v1.0 REST reference — endpoints, methods, required/optional params, response shapes, and the delegated permission listed per operation. Repo audits pass:
tool-metadata:check,integration-catalog:check,check:canvas-sentences,check:api-validation:strict, lint, and typecheck. Not exercised against a live tenant.Checklist