This connector facilitates the management of groups and collaboration settings within Microsoft 365 through the Microsoft Graph API, enabling automated workflows for group administration and user collaboration.

Microsoft Graph API is a unified gateway to data and intelligence in Microsoft 365, providing access to rich, people-centric data and insights exposed as resources in Microsoft Graph. The Groups and Collaboration connector allows Swimlane Turbine users to automate group management and collaboration workflows. It enables the addition of members to groups, management of rejected senders, and streamlines collaboration across Microsoft services. This integration empowers security teams to maintain group integrity and manage collaboration settings efficiently, enhancing organizational security posture with minimal manual intervention.

To utilize the Microsoft Graph API Groups and Collaboration connector, ensure you have the following prerequisites:

The Microsoft Graph API connector gives the ability to get and update security alerts, and modify user licenses and sessions.

Authentication uses Azure application OAuth2. You will need an admin account in Azure to create the application.

Recommended Application Permissions (feel free use custom permissions if you only use certain actions):

In order to set up the asset, you need the following:

Steps to create the Azure app:

The Client ID, Tenant ID, and Client Secret described in the steps above are the credentials you need for the asset.

Administrators who want to limit app access to specific mailboxes can create an application access policy by using the New-ApplicationAccessPolicy PowerShell cmdlet. For more information please see the article Limiting application permissions to specific Exchange Online mailboxes.

Information on the filter input formatting can be found here.

Keep in mind that not specifying a folder as an input will result in the query affecting all possible folders. Example: If we want to ingest only unread emails, and we don't set the input "folder", we will ingest all unread emails from all folders, including "Deleted Items", "Junk", etc.

Well known folders can be used instead of Folder IDs for email actions. All well known folder names can be found here.

All the Sites actions require the site ID to be executed. The site ID can be obtained using the action Sites Get Site, in order to run the action the site_hostname and site_name are needed. This two values can be found in a site URL:

For example if our site URL is https://swimlaneintegrations.sharepoint.com/sites/IntegrationsSite we should use:

After the action execution you can find the Site ID on the ID output field.

In order to create a list with its columns, use the input Columns. You can find all the possible values with its configuration on the following table.

For a complete version of this table please see the official column definition table.

Refer to the above table to get the Type properties and Column type input. The Type properties are documented within the links in the Type column.

In order to use the filter input please refer to the OData filters section.

The column used to filter the output must be indexed, see the Microsoft documentation to add an index to a list.

When using $filter and $orderby in the same query to get messages, make sure to specify properties in the following ways:

Failing to do this results in the following error:

The Assign/Remove User License requires either the disabled plans and accompanying SKU IDs to assign licenses or the SKU ID of the license you want to remove.

The Get Security Alert has additional information it can return. There are a large number of fields that don't relate to many alerts, so they are not mapped; you can add them if desired.

Authenticates using Client Credentials and Tenant ID

Authenticates on behalf of a user using oauth 2.0 credentials

Authenticates using oauth 2.0 client credentials

Authenticates using refresh token.

Adds a new member to a group using the 'group-id' and member's '@odata.id' in Microsoft Graph API.

{"json_body":{"@odata.id":"https://graph.microsoft.com/v1.0/directoryObjects/{id}"},"path_parameters":{"group-id":"f0b2d6f5-097d-4177-91af-a24e530b53cc"}}

{}

Add a user or group to the rejected sender list in Microsoft Graph API using their unique ID.

{"json_body":{"@odata.id":"https://graph.microsoft.com/v1.0/users/[email protected]"},"path_parameters":{"id":"732227b1-1927-49d4-bba9-cc30e6baf602"}}

{"response_text":"string"}