Microsoft Graph API for Incident Response: Top Actions and Safe Usage Patterns

// Check if user is protected before action
async function canAutomate(userId: string): Promise<boolean> {
  const user = await graphClient.api(`/users/${userId}`)
    .select('displayName,jobTitle,memberOf')
    .expand('memberOf')
    .get();
  
  // Check against protected groups
  const protectedGroups = [
    'VIP-Executives',
    'Service-Accounts',
    'Break-Glass-Admins'
  ];
  
  const userGroups = user.memberOf
    .filter(m => m['@odata.type'] === '#microsoft.graph.group')
    .map(g => g.displayName);
  
  const isProtected = protectedGroups.some(pg => 
    userGroups.includes(pg)
  );
  
  if (isProtected) {
    // Route to manual approval queue
    await createApprovalRequest(userId, 'protected-user');
    return false;
  }
  
  return true;
}

interface ActionAuditLog {
  timestamp: string;
  action: string;
  targetUserId: string;
  targetUserPrincipalName: string;
  triggeredBy: 'automation' | 'analyst';
  triggerSource: string;        // Alert ID, playbook name
  previousState: object;        // For rollback
  newState: object;
  graphRequestId: string;       // Graph API request ID
  correlationId: string;        // Incident correlation
  approvalId?: string;          // If approval was required
}

// Always capture previous state before modification
async function disableUserWithAudit(userId: string, trigger: string) {
  const previousState = await graphClient.api(`/users/${userId}`)
    .select('accountEnabled,signInSessionsValidFromDateTime')
    .get();
  
  const response = await graphClient.api(`/users/${userId}`)
    .patch({ accountEnabled: false });
  
  await auditLog.write({
    timestamp: new Date().toISOString(),
    action: 'user.disable',
    targetUserId: userId,
    previousState: { accountEnabled: previousState.accountEnabled },
    newState: { accountEnabled: false },
    graphRequestId: response.headers['request-id'],
    triggerSource: trigger,
    // ... other fields
  });
}