Microsoft 365 Inspector - Add role members to the inspector query
needs review
s
stephon.jones@overviewts.com
The Microsoft 365 inspector can grab many details about an environment such as roles and users, but I cannot write which roles users have into my metric or alerting.I'm trying to set up an alert that notifies us when privileged users don't have MFA enabled (this part is easy). Additionally, I want to be able to write out which role a flagged user has. This way we can re-evaluate permissions for that user to best match a least-privilege principal AND ensure that MFA is enabled. (For service-based accounts, this will allow us to revaluate permissions as well)Roles are shown as a category from the query results. Users are too, however there is no section for Assigned Roles ('assignedRoles') or Role Membership ('roleMembership') for the roles or users categories.To set up this alert, I need the role members for each role to be query-able by Roar. I have this working in Powershell, which will spit out a .CSV. However, I'll need to log into each tenant to set this up. It'd be far easier to integrate this into our ticketing and documentation with this small feature change.