Idea ID: 2870425

Update azure collector to support the Microsoft Graph API AND be also able to support the /beta additional API’s

Darren Thompson

Status: New Idea

over 3 years ago

The current collector uses the Azure AD Graph API.

The new Microsoft Graph API includes additional user attribute that are highly valuable, in particular the last login time

            "signInActivity": {
                "lastSignInDateTime": "2020-12-07T04:40:59Z",
                "lastSignInRequestId": "2047c4cf-31a1-4383-8576-1588578a2301"
            }

To be able to collect this attribute required BOTH the collector be updated to support Azure AD Graph API but also (presently) it's only available under the /beta branch.

Being able to collect login times for accounts is invaluable from a governance perspective as it allows tracking of stale account and also provides valuable information on account being accessed when believed to be disabled (du to the account being detached from whatever directory sync tool is being used to provision the account).

Tags:

Identity and Entitlement Data Management

Azure AD

Microsoft Graph API

Supported Platforms

signInActivity

Analytics & Governance Insights and Reporting

lastSignInDateTime

Identity Lifecycle Management

Identity Intelligence

Identity Tracking

Parents

issaqua over 3 years ago

This is required for stale account detection in Azure.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
Red_Baron over 3 years ago in reply to issaqua

This will be required period soon

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/update-your-applications-to-use-microsoft-authentication-library/ba-p/1257363

“Starting June 30^th, 2022, we will end support for ADAL and Azure AD Graph and will no longer provide technical support or security updates. Apps using Azure AD Graph after this time will no longer receive responses from the Azure AD Graph endpoint. Apps using ADAL on existing OS versions will continue to work after this time but will not get any technical support or security updates.”
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
Darren Thompson over 2 years ago in reply to Red_Baron

OK this is now getting some degree of urgency based on the End Of Life for the old API that @Red_Baron posted above...
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Comment

Darren Thompson over 2 years ago in reply to Red_Baron

OK this is now getting some degree of urgency based on the End Of Life for the old API that @Red_Baron posted above...
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Children

Oystein78 over 2 years ago in reply to Darren Thompson

Also in Azure it is not possible to select Azure AD Graph for new app registrations anymore, it is greyed out. So creating a new identity or application source that collects from Azure, it already needs support for Microsoft Graph. From request API permissions, its not possible to select.

This needs to be fixed yesterday
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Menu

Identity Governance Ideas

Labels

Update azure collector to support the Microsoft Graph API AND be also able to support the /beta additional API’s

Tags:

Resources