Recover deleted Users/Devices/ServicePrincipals. Closes #9

Author: EmilienCourt

DFIR-O365RC/Get-AADApps.ps1

@@ -94,13 +94,23 @@
     $servicePrincipalsOutputFile = $folderToProcess + "\AADApps_" + $tenant + "_service_principals_raw.json"
     $allServicePrincipals | ConvertTo-Json -Depth 99 | Out-File $servicePrincipalsOutputFile -Encoding UTF8
 
+    # Get all deleted service principals
+    "Getting all deleted service principals" | Write-Log -LogPath $logFile
+    $deletedServicePrincipals = Get-MgDirectoryDeletedItemAsServicePrincipal -All -ErrorAction Stop
+    if ($deletedServicePrincipals -ne $null){$deletedServicePrincipals = $deletedServicePrincipals.ToJsonString() | ConvertFrom-Json}
+    $deletedServicePrincipalsOutputFile = $folderToProcess + "\AADApps_" + $tenant + "_deleted_service_principals_raw.json"
+    $deletedServicePrincipals | ConvertTo-Json -Depth 99 | Out-File $deletedServicePrincipalsOutputFile -Encoding UTF8
+
     $enrichedServicePrincipalEvents = @()
     $uniqueServicePrincipals = $servicePrincipalEvents | Select-Object -ExpandProperty targetResources | Group-Object -Property Id
 
     # Loop through Service Principals seen in Audit Log
     foreach ($uniqueServicePrincipal in $uniqueServicePrincipals){
         # Get Service Principal object
         $servicePrincipalObject = $allServicePrincipals | Where-Object {$_.Id -eq $uniqueServicePrincipal.Name}
+        if ($null -eq $servicePrincipalObject){
+            $servicePrincipalObject = $deletedServicePrincipals | Where-Object {$_.Id -eq $uniqueServicePrincipal.Name}
+        }
         $eventsPerServicePrincipal = $servicePrincipalEvents | Where-Object { $_.targetResources.Id -eq $uniqueServicePrincipal.Name}
 
         if ($servicePrincipalObject){

DFIR-O365RC/Get-AADDevices.ps1

@@ -107,7 +107,14 @@
     $devicesOutputFile = $folderToProcess + "\AADDevices_" + $tenant + "_devices_raw.json"
     $allDevices | ConvertTo-Json -Depth 99 | Out-File $devicesOutputFile -Encoding UTF8
     $countDevices = ($allDevices | Measure-Object).Count
-    "Total number of devices in the tenant is $($countDevices)" | Write-Log -LogPath $logFile
+    "Total number of non-deleted devices in the tenant is $($countDevices)" | Write-Log -LogPath $logFile
+
+    # Get all deleted devices
+    "Getting all deleted devices" | Write-Log -LogPath $logFile
+    $deletedDevices = Get-MgDirectoryDeletedItemAsDevice -All -ErrorAction Stop
+    if ($deletedDevices -ne $null){$deletedDevices = $deletedDevices.ToJsonString() | ConvertFrom-Json}
+    $deletedDevicesOutputFile = $folderToProcess + "\AADDevices_" + $tenant + "_deleted_devices_raw.json"
+    $deletedDevices | ConvertTo-Json -Depth 99 | Out-File $deletedDevicesOutputFile -Encoding UTF8
 
     $enrichedDeviceEvents = @()
     $uniqueDevices = $deviceEvents | Select-Object -ExpandProperty targetResources | Group-Object -Property Id
@@ -116,6 +123,9 @@
     foreach ($uniqueDevice in $uniqueDevices){
         # Get Device object
         $deviceObject = $allDevices | Where-Object {$_.Id -eq $uniqueDevice.Name}
+        if ($null -eq $deviceObject){
+            $deviceObject = $deletedDevices | Where-Object {$_.Id -eq $uniqueDevice.Name}
+        }
         $eventsPerDevice = $deviceEvents | Where-Object { $_.targetResources.Id -eq $uniqueDevice.Name}
 
         if ($deviceObject){

DFIR-O365RC/Get-AADUsers.ps1

@@ -52,7 +52,14 @@ function Get-AADUsers {
     $usersOutputFile = $folderToProcess + "\AADUsers_" + $tenant + "_users_raw.json"
     $allUsers | ConvertTo-Json -Depth 99 | Out-File $usersOutputFile -Encoding UTF8
     $countUsers = ($allUsers | Measure-Object).Count
-    "Total number of users in the tenant is $($countUsers)" | Write-Log -LogPath $logFile
+    "Total number of non-deleted users in the tenant is $($countUsers)" | Write-Log -LogPath $logFile
+
+    # Get all deleted users
+    "Getting all deleted users" | Write-Log -LogPath $logFile
+    $deletedUsers = Get-MgDirectoryDeletedItemAsUser -All -ErrorAction Stop
+    if ($deletedUsers -ne $null){$deletedUsers = $deletedUsers.ToJsonString() | ConvertFrom-Json}
+    $deletedUsersOutputFile = $folderToProcess + "\AADUsers_" + $tenant + "_deleted_users_raw.json"
+    $deletedUsers | ConvertTo-Json -Depth 99 | Out-File $deletedUsersOutputFile -Encoding UTF8
 
     # Get all users settings
     "Getting all users settings" | Write-Log -LogPath $logFile