Blog Post

Microsoft Sentinel Blog
6 MIN READ

Automatically disable On-prem AD User using a Playbook triggered in Azure

Inwafula's avatar
Inwafula
Icon for Microsoft rankMicrosoft
Feb 09, 2021
Many organizations have an on-premises Active Directory infrastructure that is synced to Azure AD in the cloud. However, given that the on-prem side is the authoritative source of truth, any changes,...
Updated Nov 01, 2021
Version 3.0
AndyITech's avatar
AndyITech
Copper Contributor
Apr 29, 2021

Dhaval ShastriIn our case we used this:

 

{
    "properties": {
        "$id": {
            "type": "string"
        },
        "AadUserId": {
            "type": "string"
        },
        "DisplayName": {
            "type": "string"
        },
        "Name": {
            "type": "string"
        },
        "Type": {
            "type": "string"
        }
    },
    "type": "object"
}
 
I recommend you to deploy it using the code provided in GitHub since there are some steps missing in this article. Then you can modify the Playbook at your convenience. That is how I did it and it works great!