Block AAD user or admin - Alert
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Content Index
For each account entity included in the alert, this playbook will disable the user in Azure Active Directoy, add a comment to the incident that contains this alert and notify manager if available. Note: This playbook will disable admin users as well!
| Attribute |
Value |
| Type |
Playbook |
| Solution |
Standalone Content |
| Source |
View on GitHub |
Logic App Connectors
This playbook uses 5 Logic App connectors / built-in actions:
Action parameters (URLs, paths, function IDs)
| Action |
Method |
Endpoint |
Other |
| Get_user_-_details |
get |
/v1.0/users/@{encodeURIComponent(concat(items('For_each')?['Name'], '@', items('for_each')?['UPNSuffix']))} |
— |
| Get_user_-_admin_details |
get |
/v1.0/users/@{encodeURIComponent(concat(items('For_each')?['Name'], '@', items('for_each')?['UPNSuffix']))} |
— |
| Action |
Method |
Endpoint |
Other |
| Alert_-_Get_incident |
get |
/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])} |
— |
| Entities_-_Get_Accounts |
post |
/entities/account |
— |
| Add_comment_to_incident_-with_manager-_no_admin |
post |
/Incidents/Comment |
— |
| Add_comment_to_incident_-no_manager-_no_admin |
post |
/Incidents/Comment |
— |
| Add_comment_to_incident_-_admin_sign_in_block_is_rejected |
post |
/Incidents/Comment |
— |
| Add_comment_to_incident_-with_manager-_admin_user |
post |
/Incidents/Comment |
— |
| Add_comment_to_incident_-no_manager-_admin_user |
post |
/Incidents/Comment |
— |
| Action |
Method |
Endpoint |
Other |
| Send_an_email_-to_manager-_no_admin |
post |
/v2/Mail |
— |
| Send_an_email_-to_manager-_admin_user |
post |
/v2/Mail |
— |
| Send_an_email_-no_manager-_admin_user |
post |
/v2/Mail |
— |
http (Built-in)
| Action |
Method |
Endpoint |
Other |
| HTTP |
PATCH |
https://graph.microsoft.com/beta/users/@{concat(items('For_each')?['Name'], '@', items('for_each')?['UPNSuffix'])} |
— |
| HTTP_-_get_user_manager |
GET |
https://graph.microsoft.com/v1.0/users/@{concat(items('For_each')?['Name'], '@', items('for_each')?['UPNSuffix'])}/manager |
— |
| HTTP_-_re-enable_admin_user |
PATCH |
https://graph.microsoft.com/beta/users/@{concat(items('For_each')?['Name'], '@', items('for_each')?['UPNSuffix'])} |
— |
| HTTP_-_get_admin_manager |
GET |
https://graph.microsoft.com/v1.0/users/@{concat(items('For_each')?['Name'], '@', items('for_each')?['UPNSuffix'])}/manager |
— |
| HTTP_-_Block_admin_user |
PATCH |
https://graph.microsoft.com/beta/users/@{concat(items('For_each')?['Name'], '@', items('for_each')?['UPNSuffix'])} |
— |
| HTTP_-_get_admin_roles |
GET |
https://graph.microsoft.com/v1.0/users/@{concat(items('For_each')?['Name'], '@', items('for_each')?['UPNSuffix'])}/memberOf/microsoft.graph.directoryRole |
— |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Playbooks