@@ -2,46 +2,45 @@ param($Context)
22# $Context does not allow itself to be cast to a pscustomobject for some reason, so we convert
33$context = $Context | ConvertTo-Json | ConvertFrom-Json
44$APIName = $TriggerMetadata.FunctionName
5- Write-LogMessage - user $request.headers .' x-ms-client-principal' - API $APINAME - message " Accessed this API" - Sev " Debug"
5+ Write-LogMessage - user $request.headers .' x-ms-client-principal' - API $APINAME - message ' Accessed this API' - Sev ' Debug'
66$TenantFilter = $Context.input.tenantfilter
77$SuspectUser = $Context.input.userid
88$UserName = $Context.input.username
99Write-Host " Working on $UserName "
1010try {
1111 $startDate = (Get-Date ).AddDays(-7 )
1212 $endDate = (Get-Date )
13- $auditLog = (New-ExoRequest - tenantid $Tenantfilter - cmdlet " Get-AdminAuditLogConfig"
13+ $auditLog = (New-ExoRequest - tenantid $Tenantfilter - cmdlet ' Get-AdminAuditLogConfig'
1414 $7dayslog = if ($auditLog -eq $false ) {
15- $ExtractResult = " AuditLog is disabled. Cannot perform full analysis"
16- }
17- else {
15+ $ExtractResult = ' AuditLog is disabled. Cannot perform full analysis'
16+ } else {
1817 $sessionid = Get-Random - Minimum 10000 - Maximum 99999
1918 $operations = @ (
20- " New-InboxRule" ,
21- " Set-InboxRule" ,
22- " UpdateInboxRules" ,
23- " Remove-MailboxPermission" ,
24- " Add-MailboxPermission" ,
25- " UpdateCalendarDelegation" ,
26- " AddFolderPermissions" ,
27- " MailboxLogin" ,
28- " UserLoggedIn"
19+ ' New-InboxRule' ,
20+ ' Set-InboxRule' ,
21+ ' UpdateInboxRules' ,
22+ ' Remove-MailboxPermission' ,
23+ ' Add-MailboxPermission' ,
24+ ' UpdateCalendarDelegation' ,
25+ ' AddFolderPermissions' ,
26+ ' MailboxLogin' ,
27+ ' UserLoggedIn'
2928 )
3029 $startDate = (Get-Date ).AddDays(-7 )
3130 $endDate = (Get-Date )
3231 $SearchParam = @ {
33- SessionCommand = " ReturnLargeSet"
32+ SessionCommand = ' ReturnLargeSet'
3433 Operations = $operations
3534 sessionid = $sessionid
3635 startDate = $startDate
3736 endDate = $endDate
3837 }
3938 do {
40- New-ExoRequest - tenantid $Tenantfilter - cmdlet " Search-unifiedAuditLog" - cmdParams $SearchParam - Anchor $Username
39+ New-ExoRequest - tenantid $Tenantfilter - cmdlet ' Search-unifiedAuditLog' - cmdParams $SearchParam - Anchor $Username
4140 Write-Host " Retrieved $ ( $logsTenant.count ) logs" - ForegroundColor Yellow
4241 $logsTenant
4342 } while ($LogsTenant.count % 5000 -eq 0 -and $LogsTenant.count -ne 0 )
44- $ExtractResult = " Succesfully extracted logs from auditlog"
43+ $ExtractResult = ' Succesfully extracted logs from auditlog'
4544 }
4645 Try {
4746 $URI = " https://graph.microsoft.com/beta/auditLogs/signIns?`$ filter=(userId eq '$SuspectUser ')&`$ top=1&`$ orderby=createdDateTime desc"
@@ -50,29 +49,26 @@ try {
5049 @ { Name = ' AppDisplayName' Expression = { $_.resourceDisplayName } },
5150 @ { Name = ' Status' Expression = { if (($_.conditionalAccessStatus -eq ' Success' -or ' Not Applied' -and $_.status.errorCode -eq 0 ) { ' Success' else { ' Failed' ,
5251 @ { Name = ' IPAddress' Expression = { $_.ipAddress } }
53- }
54- catch {
52+ } catch {
5553 $LastSignIn = [PSCustomObject ]@ {
56- AppDisplayName = " Unknown - could not retrieve information. No access to sign-in logs"
57- CreatedDateTime = " Unknown"
58- Id = " 0 "
59- Status = " Could not retrieve additional details"
54+ AppDisplayName = ' Unknown - could not retrieve information. No access to sign-in logs'
55+ CreatedDateTime = ' Unknown'
56+ Id = ' 0 '
57+ Status = ' Could not retrieve additional details'
6058 }
6159 }
6260 # List all users devices
6361 $Bytes = [System.Text.Encoding ]::UTF8.GetBytes($SuspectUser )
6462 $base64IdentityParam = [Convert ]::ToBase64String($Bytes )
6563 Try {
6664 $Devices = New-GraphGetRequest - uri " https://outlook.office365.com:443/adminapi/beta/$ ( $TenantFilter ) /mailbox('$ ( $base64IdentityParam ) ')/MobileDevice/Exchange.GetMobileDeviceStatistics()/?IsEncoded=True" - Tenantid $tenantfilter - scope ExchangeOnline
67- }
68- catch {
65+ } catch {
6966 $Devices = $null
7067 }
71- $PermissionsLog = ($7dayslog | Where-Object - Property Operations -In " Remove-MailboxPermission" , " Add-MailboxPermission" , " UpdateCalendarDelegation" , " AddFolderPermissions" | ConvertFrom-Json - Depth 100 | ForEach-Object {
68+ $PermissionsLog = ($7dayslog | Where-Object - Property Operations -In ' Remove-MailboxPermission' , ' Add-MailboxPermission' , ' UpdateCalendarDelegation' , ' AddFolderPermissions' | ConvertFrom-Json - Depth 100 | ForEach-Object {
7269 $perms = if ($_.Parameters ) {
73- $_.Parameters | ForEach-Object { if ($_.Name -eq " AccessRights" $_.Value } }
74- }
75- else
70+ $_.Parameters | ForEach-Object { if ($_.Name -eq ' AccessRights' $_.Value } }
71+ } else
7672 { $_.item.ParentFolder.MemberRights }
7773 $objectID = if ($_.ObjectID ) { $_.ObjectID } else { $ ($_.MailboxOwnerUPN ) + $_.item.ParentFolder.Path }
7874 [pscustomobject ]@ {
@@ -83,43 +79,42 @@ try {
8379 }
8480 }
8581
86- $RulesLog = @ (($7dayslog | Where-Object - Property Operations -In " New-InboxRule" , " Set-InboxRule" , " UpdateInboxRules" | ConvertFrom-Json ) | ForEach-Object {
82+ $RulesLog = @ (($7dayslog | Where-Object - Property Operations -In ' New-InboxRule' , ' Set-InboxRule' , ' UpdateInboxRules' | ConvertFrom-Json ) | ForEach-Object {
8783 Write-Host ($_ | ConvertTo-Json )
8884 [pscustomobject ]@ {
8985 ClientIP = $_.ClientIP
9086 CreationTime = $_.CreationTime
9187 UserId = $_.UserId
92- RuleName = ($_.OperationProperties | ForEach-Object { if ($_.Name -eq " RuleName" $_.Value } })
93- RuleCondition = ($_.OperationProperties | ForEach-Object { if ($_.Name -eq " RuleCondition" $_.Value } })
88+ RuleName = ($_.OperationProperties | ForEach-Object { if ($_.Name -eq ' RuleName' $_.Value } })
89+ RuleCondition = ($_.OperationProperties | ForEach-Object { if ($_.Name -eq ' RuleCondition' $_.Value } })
9490 }
9591 }
9692 $PasswordChanges = New-GraphGetRequest - uri " https://graph.microsoft.com/beta/users?`select=lastPasswordChangeDateTime,displayname,UserPrincipalName" - Tenantid $tenantfilter | Where-Object { $_.lastPasswordChangeDateTime -gt $startDate }
97- $NewUsers = New-GraphGetRequest - uri " https://graph.microsoft.com/v1.0/users?`$ select=displayname,UserPrincipalName,CreatedDateTime" - Tenantid $tenantfilter | Where-Object { $_.CreatedDateTime -gt $startDate }
93+ $NewUsers = New-GraphGetRequest - uri " https://graph.microsoft.com/v1.0/users?`$ select=displayname,UserPrincipalName,CreatedDateTime" - Tenantid $tenantfilter | Where-Object { $_.CreatedDateTime -gt $startDate }
9894 $MFADevices = New-GraphGetRequest - uri " https://graph.microsoft.com/beta/users/$ ( $SuspectUser ) /authentication/methods" - Tenantid $tenantfilter
9995 $NewSPs = New-GraphGetRequest - uri " https://graph.microsoft.com/v1.0/servicePrincipals?`$ select=displayName,createdDateTime,id,AppDisplayName&`$ filter=createdDateTime ge $ ( $startDate.ToString (' yyyy-MM-ddTHH:mm:ssZ' ) " - Tenantid $tenantfilter
100- $Last50Logons = New-GraphGetRequest - uri " https://graph.microsoft.com/beta/auditLogs/signIns?`$ top=50&`$ orderby=createdDateTime desc" - tenantid $TenantFilter - noPagination $true - verbose | Select-Object @ { Name = ' CreatedDateTime' Expression = { $ (($_.createdDateTime | Out-String ) -replace ' \r\n' ,
96+ $Last50Logons = New-GraphGetRequest - uri " https://graph.microsoft.com/beta/auditLogs/signIns?`$ top=50&`$ orderby=createdDateTime desc" - tenantid $TenantFilter - noPagination $true - verbose | Select-Object @ { Name = ' CreatedDateTime' Expression = { $ (($_.createdDateTime | Out-String ) -replace ' \r\n' ,
10197 id,
10298 @ { Name = ' AppDisplayName' Expression = { $_.resourceDisplayName } },
10399 @ { Name = ' Status' Expression = { if (($_.conditionalAccessStatus -eq ' Success' -or ' Not Applied' -and $_.status.errorCode -eq 0 ) { ' Success' else { ' Failed' ,
104100 @ { Name = ' IPAddress' Expression = { $_.ipAddress } }, UserPrincipalName
105101 $Results = [PSCustomObject ]@ {
106- AddedApps = $NewSPs
107- SuspectUserMailboxLogons = $Last50Logons
102+ AddedApps = @ ( $NewSPs )
103+ SuspectUserMailboxLogons = @ ( $Last50Logons )
108104 LastSuspectUserLogon = @ ($LastSignIn )
109105 SuspectUserDevices = @ ($Devices )
110106 NewRules = @ ($RulesLog )
111107 MailboxPermissionChanges = @ ($PermissionsLog )
112108 NewUsers = @ ($NewUsers )
113- MFADevices = $MFADevices
114- ChangedPasswords = $PasswordChanges
109+ MFADevices = @ ( $MFADevices )
110+ ChangedPasswords = @ ( $PasswordChanges )
115111 ExtractedAt = (Get-Date ).ToString(' s'
116112 ExtractResult = $ExtractResult
117113 }
118114
119- }
120- catch {
115+ } catch {
121116 $errMessage = Get-NormalizedError - message $_.Exception.Message
122- $results = [pscustomobject ]@ {" Results" = " $errMessage "
117+ $results = [pscustomobject ]@ {' Results' = " $errMessage "
123118}
124119
125120$Table = Get-CippTable - tablename ' cachebec'
@@ -128,5 +123,5 @@ Add-CIPPAzDataTableEntity @Table -Entity @{
128123 UserId = $Context.input.userid
129124 Results = " $ ( $results | ConvertTo-Json - Depth 10 ) "
130125 RowKey = $Context.input.userid
131- PartitionKey = " bec"
126+ PartitionKey = ' bec'
132127}
0 commit comments