Block Entra ID user - Incident
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Content Index
For each account entity included in the incident, this playbook will disable the user in Microsoft Entra ID, add a comment to the incident that contains this alert and notify manager if available. Note: This playbook will not disable admin user!
Logic App Connectors
This playbook uses 5 Logic App connectors / built-in actions:
Action parameters (URLs, paths, function IDs)
| Action |
Method |
Endpoint |
Other |
| Get_user_-_details |
get |
/v1.0/users/@{encodeURIComponent(concat(items('For_each')?['Name'], '@', items('for_each')?['UPNSuffix']))} |
— |
| Action |
Method |
Endpoint |
Other |
| Entities_-_Get_Accounts |
post |
/entities/account |
— |
| Add_comment_to_incident_-with_manager-_no_admin |
post |
/Incidents/Comment |
— |
| Add_comment_to_incident_-no_manager-_no_admin |
post |
/Incidents/Comment |
— |
| Add_comment_to_incident_-_error_details |
post |
/Incidents/Comment |
— |
| Action |
Method |
Endpoint |
Other |
| Send_an_email_-to_manager-_no_admin |
post |
/v2/Mail |
— |
http (Built-in)
| Action |
Method |
Endpoint |
Other |
| HTTP_-_get_user_manager |
GET |
https://graph.microsoft.com/v1.0/users/@{concat(items('For_each')?['Name'], '@', items('for_each')?['UPNSuffix'])}/manager |
— |
| Update_user_-_disable_user |
PATCH |
https://graph.microsoft.com/v1.0/users/@{concat(items('For_each')?['Name'], '@', items('for_each')?['UPNSuffix'])} |
— |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Playbooks · Back to Microsoft Entra ID