feat(microsoft_ad): licensing, security, audit, role, and device operations - #6742
Conversation
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 36185505 | Triggered | Generic Password | 4377fb0 | apps/sim/tools/microsoft_ad/reset_password.ts | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryHigh Risk Overview New capabilities include license assign/list and tenant SKUs; revoke sign-in sessions; set/reset passwords and list auth methods; sign-in and directory audit logs; app role grant/revoke and service principal/application assignment reads; directory role member management; device and user-device reads; and conditional access policy reads (no device writes). Block UX adds operation-specific sub-blocks (filters, paging, license SKUs, role IDs, etc.), canvas sentences for each operation, and stricter param mapping: OData filter/search are resolved per operation so switching operations does not leak stale OAuth adds eight delegated scopes ( Docs refresh the create-user output fields and broaden the integration description to match the new surface. Reviewed by Cursor Bugbot for commit 8957e72. Configure here. |
Greptile SummaryThe PR expands the Microsoft Entra ID integration with licensing, password and session management, audit-log access, application and directory-role operations, service-principal queries, device reads, and conditional-access policy reads.
Confidence Score: 5/5The PR appears safe to merge because no blocking failure remains. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| apps/sim/blocks/blocks/microsoft_ad.ts | Expands operation selection, conditional inputs, pagination fields, and operation-specific parameter normalization for the new tools. |
| apps/sim/lib/oauth/oauth.ts | Adds the delegated Microsoft Graph scopes required by the expanded integration. |
| apps/sim/tools/microsoft_ad/reset_password.ts | Implements password reset using Graph’s password authentication method endpoint and correctly parses the root-level generated password. |
| apps/sim/tools/microsoft_ad/revoke_sign_in_sessions.ts | Adds session revocation through an endpoint authorized by the provider’s requested User.ReadWrite.All scope. |
| apps/sim/tools/microsoft_ad/index.ts | Registers and exports the expanded Microsoft AD tool set. |
| apps/docs/content/docs/en/integrations/microsoft_ad.mdx | Documents the expanded operation catalog, read-only device support, and generated-password output behavior. |
Sequence Diagram
sequenceDiagram
participant Workflow
participant Block as Microsoft AD Block
participant Tool as Selected Graph Tool
participant Graph as Microsoft Graph v1.0
Workflow->>Block: Operation and parameters
Block->>Tool: Map operation-specific inputs
Tool->>Graph: OAuth-authenticated request
Graph-->>Tool: Resource or operation response
Tool-->>Block: Normalized tool output
Block-->>Workflow: Workflow result
Reviews (9): Last reviewed commit: "fix(microsoft_ad): reject a continuation..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
21f891a to
abc14c2
Compare
|
@cursor review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
@cursor review |
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 08b8ff1. Configure here.
08b8ff1 to
b4bf17f
Compare
|
@cursor review |
b4bf17f to
612de81
Compare
|
@cursor review |
612de81 to
c6e351e
Compare
|
@cursor review |
…ations Deepens the Microsoft Entra ID block from 12 to 36 tools against the Microsoft Graph v1.0 reference: license assignment and tenant SKUs, password set/reset, sign-in session revocation, authentication methods, sign-in and directory audit logs, app role and directory role assignments, service principals, device reads, and conditional access policy reads. Device write (device-update, device-delete) is deliberately excluded. Both document Directory.AccessAsUser.All as their only delegated scope, with the higher-privileged read documented as unavailable, so supporting them would mean requesting tenant-wide act-as-the-user directory access for two operations that additionally require the caller to hold Intune Administrator. Also drops an undocumented ?$select= from create_user that was silently nulling department and accountEnabled in the response.
The params mapper assigned result.filter from each filter subBlock in turn, so the last non-empty one won regardless of the selected operation. Because a subBlock keeps its value after the operation changes, a filter written for one endpoint was sent to every other collection operation — invalid OData against a different Graph resource, or a silently wrong page. Resolves the filter and search terms from an explicit operation-to-field map instead, so each operation reads only the field it owns.
…nputs
The executor merges { ...inputs, ...transformedParams }, so declining to copy a
stale filter is not enough — the serialized value survives the merge and still
reaches the tool. Advanced-mode subBlocks are serialized on non-emptiness alone
and never have their condition evaluated, so the value is present even when the
field is hidden.
Write filter and search on every operation, as undefined when the operation owns
neither, so the merge clears them.
…ontinue without a User ID
The set_password MFA dropdown only wrote its key when non-empty, so the "No Change"
empty string survived `{ ...inputs, ...transformedParams }` and reached Graph in place
of a boolean. Assign it explicitly, including as `undefined`, the same way `filter` and
`search` are handled.
`list_user_app_role_assignments` and `list_user_devices` page by `@odata.nextLink`, and
both tools already treat `userId` as optional once a continuation URL is supplied. Drop
them from the required set when Next Page is filled in so pagination-only runs pass block
validation.
Also note on the reset_password output that a generated password reaches workflow outputs,
run history, and the model, matching how other tools that return secrets document exposure.
… page Every other single-resource ID field pairs its condition with a matching required rule; servicePrincipalId had none, so a first-page run could pass block validation with an empty ID and fail inside the tool instead. Require it unless a continuation URL is supplied, matching the paged per-user operations.
c6e351e to
f83165b
Compare
|
@cursor review |
Every paged operation reads the one shared Next Page field, and a subBlock keeps its value after the operation changes. Paging /users and then switching the block to /devices short-circuited back to the user page, silently returning the previous collection instead of the selected one. Assert the continuation URL's terminal path segment against the collection the tool actually reads, which also rejects a nextLink pasted from an unrelated response.
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 8957e72. Configure here.
1 participant
Summary
Deepens the Microsoft Entra ID (Azure AD) block from 12 to 36 tools, adding licensing, password/session management, sign-in and directory audit logs, app and directory role assignments, service principals, device reads, and conditional access policy reads.
Two things need a maintainer decision before merge:
1. Device write was dropped, deliberately
device-updateanddevice-deletedocumentDirectory.AccessAsUser.Allas the only delegated scope — the higher-privileged read is literally documented as "Not available", andDevice.ReadWrite.Allis application-only, so it is not reachable from a delegated connection. The operation additionally requires the signed-in user to hold Intune Administrator.Rather than take act-as-the-signed-in-user directory access across the whole tenant for two operations that would still fail for most admins, both tools were removed. That took the count from 38 to 36, and
Directory.AccessAsUser.Allis not requested anywhere. Device support is read-only (Device.Read.All).This is a one-commit revert if the team would rather ship them.
2. The new scopes force re-consent on every existing connection
Every existing
microsoft-adconnection will need to re-consent to pick up the added scopes. That is a migration and comms question, not an engineering one — flagging it rather than deciding it.Scopes added:
LicenseAssignment.ReadWrite.All,UserAuthenticationMethod.ReadWrite.All,AuditLog.Read.All,Application.Read.All,AppRoleAssignment.ReadWrite.All,RoleManagement.ReadWrite.Directory,Device.Read.All,Policy.Read.All.Also worth noting
create_userno longer sends an undocumented?$select=, which was silently nullingdepartmentandaccountEnabledin the response.GitGuardian finding — needs a dashboard dismissal
The scan flags
28c10230-6103-485e-b985-444c60001490inreset_password.ts. That is Microsoft's fixed, publicly documented object id for a user's password authentication method — identical for every user in every tenant, and required as a literal route segment to build theresetPasswordURL. It is a path component, not a credential. It's inlined at its single call site with a doc reference so the context is visible where it's read; someone with dashboard access will need to mark it as a false positive.Type of Change
Testing
Validated against the Microsoft Graph v1.0 REST reference — endpoints, methods, required/optional params, response shapes, and the delegated permission listed per operation. Repo audits pass:
tool-metadata:check,integration-catalog:check,check:canvas-sentences,check:api-validation:strict, lint, and typecheck. Not exercised against a live tenant.Checklist