⭐️ Microsoft 365 risky users resource

[chris-rock]

This PR adds the new microsoft.security.riskyUsers resource.

List of risky users

You can easily query for Entra risky users:

Note this requires an Microsoft Entra ID P2. See Entra ID License requirements for more details

cnquery> microsoft.security.riskyUsers
microsoft.security.riskyUsers: [
  0: microsoft.security.riskyUser principalName="ben@example.onmicrosoft.com" riskLevel="high" riskState="atRisk" lastUpdatedAt=2024-06-26 13:41:57.1498281 +0200 CEST
]

Or if you want to see all details:

cnquery> microsoft.security.riskyUsers { * }
microsoft.security.riskyUsers: [
  0: {
    id: "346de954-64f8-40db-bc19-aef1001858c0"
    principalName: "ben@example.onmicrosoft.com"
    user: microsoft.user id="346de954-64f8-40db-bc19-aef1001858c0" displayName="Soo Choi" userPrincipalName="ben@example.onmicrosoft.com"
    riskLevel: "high"
    riskDetail: "none"
    name: "Ben Rockwood"
    riskState: "atRisk"
    lastUpdatedAt: 2024-06-26 13:41:57.1498281 +0200 CEST
  }
]

Check that no risky user exists

To verify that no risk user exist, you can just use MQL's none() function:

microsoft.security.riskyUsers.none(riskState == "atRisk")
[failed] [].none()
  actual:   [
    0: microsoft.security.riskyUser riskState="atRisk" lastUpdatedAt=2024-06-26 13:41:57.1498281 +0200 CEST principalName="ben@example.onmicrosoft.com" riskLevel="high"
  ]

[github-actions]

Test Results

3 097 tests  ±0   3 096 ✅ ±0   1m 28s ⏱️ +12s
  370 suites ±0       1 💤 ±0 
   28 files   ±0       0 ❌ ±0 

Results for commit 0be8a5d. ± Comparison against base commit 6e02adf.

♻️ This comment has been updated with latest results.

[preslavgerchev]

nit: is there any way we can check for the p2 license here so we can show a nice err msg or will the API itself throw such an err if the tenant is not p2?

[chris-rock]

I think we need a better concept in general to check for permissions in Azure. Not just this one.

[preslavgerchev]

nit: maybe we can use the microsoft..user resource here? or can a risky user also be a service app?

[chris-rock]

Yeah, lets remove it for now and stick with user reference. Great idea.

[chris-rock]

Ok. I reviewed the code. I think we should keep principalName for now. Otherwise we always need to create all user objects. I would like to avoid that right now.