Home

AzureAD group membership as a condition

%3CLINGO-SUB%20id%3D%22lingo-sub-482721%22%20slang%3D%22en-US%22%3EAzureAD%20group%20membership%20as%20a%20condition%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-482721%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20trying%20to%20create%20a%20playbook%20that%20checks%20a%20user%20against%20an%20AzureAD%20group.%26nbsp%3B%20If%20the%20user%20is%20a%20member%20of%20the%20group%20it%20will%20perform%20one%20action%20(open%20ticket%20in%20service%20now)%20and%20if%20they%20are%20not%20a%20member%20it%20will%20perform%20a%20different%20one%20(create%20a%20powershell%20script%20to%20reset%20the%20password).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20create%20the%20check%20AzureAD%20group%20membership%20action%20and%20then%20create%20a%20condition%20based%20off%20that%20action.%26nbsp%3B%20when%20I%20add%20the%20check%20AzureAD%20group%20result%20to%20the%20condition%2C%20it%20automatically%20places%20it%20within%20a%20for%20each%20loop.%26nbsp%3B%20The%20result%20is%2C%20if%20the%20user%20is%20a%20member%20of%20the%20group%20it%20will%20successfully%20execute%20the%20True%20branch%20of%20the%20condition.%26nbsp%3B%20But%20if%20the%20user%20is%20not%20a%20member%20of%20the%20group%2C%20the%20check%20AzureAD%20group%20action%20returns%20a%20null%20value%2C%20so%20the%20for%20each%20action%20never%20fires%20and%20the%20false%20branch%20of%20the%20condition%20never%20fires.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20tried%20to%20work%20around%20this%20by%20using%20the%20list%20AzureAD%20group%20members%20action%20instead.%26nbsp%3B%20In%20this%20case%2C%20each%20member%20of%20the%20group%20is%20listed%20as%20a%20result.%26nbsp%3B%20If%20the%20user%20is%20a%20member%20of%20the%20group%2C%20it%20will%20execute%20the%20true%20branch%20once%20and%20then%20the%20false%20branch%20one%20time%20for%20each%20other%20member%20of%20the%20group.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20workaround%20for%20this%20use%20case%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-486495%22%20slang%3D%22en-US%22%3ERe%3A%20AzureAD%20group%20membership%20as%20a%20condition%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-486495%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F306179%22%20target%3D%22_blank%22%3E%40andrew_bryant%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F89690%22%20target%3D%22_blank%22%3E%40Chris%20Boehm%3C%2FA%3E%3A%20Is%20this%20something%20you%20can%20help%20with%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-499463%22%20slang%3D%22en-US%22%3ERe%3A%20AzureAD%20group%20membership%20as%20a%20condition%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-499463%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F306179%22%20target%3D%22_blank%22%3E%40andrew_bryant%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20you're%20setting%20up%20the%20actions%20in%20the%20playbooks%2C%20are%20you%20setting%20up%20a%20condition%20based%20on%20the%20previous%20data%3F%20My%20example%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E1.%20When%20Azure%20Sentinel%20alert%20is%20triggered%20do%20the%20following%3A%3C%2FP%3E%0A%3CP%3E2.%20Check%20group%20Membership%20with%20entities%20from%20the%20alert%20based%20on%20X%20group%20name.%3C%2FP%3E%0A%3CP%3E3.%20Used%20the%20For%20Each%20template%3A%20If%20the%20Body%20of%20the%20message%20is%20%22True%22%20do%20the%20following%2C%20if%20it's%20%22False%22%20do%20the%20following.%20I'm%20using%20the%20connectors%20within%20the%20body.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F110945i39C40F8FFAD77C3D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Annotation%202019-04-29%20095230.png%22%20title%3D%22Annotation%202019-04-29%20095230.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHope%20this%20helps%2C%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-505118%22%20slang%3D%22en-US%22%3ERe%3A%20AzureAD%20group%20membership%20as%20a%20condition%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-505118%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F89690%22%20target%3D%22_blank%22%3E%40Chris%20Boehm%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20Chris%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThat%20is%20how%20I%20set%20it%20up%2C%20with%20one%20exception.%26nbsp%3B%20I%20run%20a%20log%20query%20against%20the%20sentinel%20alert%20to%20get%20the%20username.%26nbsp%3B%20Then%20I%20use%20the%20username%20in%20the%20check%20group%20membership%20step.%26nbsp%3B%20Otherwise%20it%20is%20set%20up%20like%20you%20show.%26nbsp%3B%20When%20I%20run%20against%20a%20user%20not%20in%20the%20group%20the%20false%20branch%20does%20not%20run.%26nbsp%3B%20I%20think%20it%20is%20because%20the%20output%20body%20of%20the%20check%20membership%20step%20shows%20as%20%22%5B%5D%22.%26nbsp%3B%20So%20since%20it%20is%20null%20it%20does%20not%20execute%20the%20next%20for%20each%20step.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-529410%22%20slang%3D%22en-US%22%3ERe%3A%20AzureAD%20group%20membership%20as%20a%20condition%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-529410%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F89690%22%20target%3D%22_blank%22%3E%40Chris%20Boehm%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EChris%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20other%20suggestions%20on%20how%20to%20try%20this%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAndrew%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-532090%22%20slang%3D%22en-US%22%3ERe%3A%20AzureAD%20group%20membership%20as%20a%20condition%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-532090%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F306179%22%20target%3D%22_blank%22%3E%40andrew_bryant%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFirst%2C%20as%20discussed%20in%20another%20thread%20(and%20for%20the%20benefit%20of%20others)%2C%20you%20don't%20need%20to%20query%20the%20Workspace%20but%20can%20rather%20extract%20the%20user%20names%20for%20an%20alert%20using%20the%20Sentinel%20connector%20actions.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20613px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F112158iF3DF8EA3DFF0A1F1%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019-05-05%2003_57_19-Clipboard.png%22%20title%3D%222019-05-05%2003_57_19-Clipboard.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20to%20your%20question%2C%20did%20you%20try%20to%20use%20an%20expression%20on%20the%20returned%20value%20rather%20than%20using%20it%20directly%3F%20I%20didn't%20try%2C%20but%20Length%20below%20looks%20promising.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20578px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F112159i1062D8D61E0977BD%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019-05-05%2003_59_47-Logic%20Apps%20Designer%20-%20Microsoft%20Azure%20-%20portal.azure.com.png%22%20title%3D%222019-05-05%2003_59_47-Logic%20Apps%20Designer%20-%20Microsoft%20Azure%20-%20portal.azure.com.png%22%20%2F%3E%3C%2FSPAN%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-558327%22%20slang%3D%22en-US%22%3ERe%3A%20AzureAD%20group%20membership%20as%20a%20condition%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-558327%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F293879%22%20target%3D%22_blank%22%3E%40Ofer_Shezaf%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EInterestingly%2C%20when%20I%20switched%20the%20action%20from%20querying%20the%20alert%20ID%20with%20log%20analytics%20to%20getting%20the%20account%20name%20from%20the%20sentinel%20alert%20it%20allowed%20me%20to%20create%20the%20condition%20under%20check%20group%20membership%20without%20putting%20it%20in%20its%20own%20for%20each%20loop.%26nbsp%3B%20It%20wasn't%20allowing%20me%20to%20do%20that%20before.%26nbsp%3B%20So%20now%20I%20can%20just%20create%20the%20condition%20to%20check%20whether%20the%20body%20equals%20the%20group%20ID.%26nbsp%3B%20Tested%20it%20out%20and%20it%20works.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-561421%22%20slang%3D%22en-US%22%3ERe%3A%20AzureAD%20group%20membership%20as%20a%20condition%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-561421%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F306179%22%20target%3D%22_blank%22%3E%40andrew_bryant%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EGood%20to%20know.%20My%20guess%20is%20that%20the%20challenge%20is%20all%20JSON%20transformation.%20We%20need%20to%20learn%20more%20about%20Logic%20App%20JSON%20handling.%20We%20will%20share%20our%20findings.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E~%20Ofer%3C%2FP%3E%3C%2FLINGO-BODY%3E
andrew_bryant
Contributor

I am trying to create a playbook that checks a user against an AzureAD group.  If the user is a member of the group it will perform one action (open ticket in service now) and if they are not a member it will perform a different one (create a powershell script to reset the password).

 

I create the check AzureAD group membership action and then create a condition based off that action.  when I add the check AzureAD group result to the condition, it automatically places it within a for each loop.  The result is, if the user is a member of the group it will successfully execute the True branch of the condition.  But if the user is not a member of the group, the check AzureAD group action returns a null value, so the for each action never fires and the false branch of the condition never fires.

 

I tried to work around this by using the list AzureAD group members action instead.  In this case, each member of the group is listed as a result.  If the user is a member of the group, it will execute the true branch once and then the false branch one time for each other member of the group.

 

Is there a workaround for this use case?

7 Replies

@andrew_bryant 

 

@Chris Boehm: Is this something you can help with? 

@andrew_bryant 

 

When you're setting up the actions in the playbooks, are you setting up a condition based on the previous data? My example:

 

1. When Azure Sentinel alert is triggered do the following:

2. Check group Membership with entities from the alert based on X group name.

3. Used the For Each template: If the Body of the message is "True" do the following, if it's "False" do the following. I'm using the connectors within the body. 

 

 

Annotation 2019-04-29 095230.png

 

Hope this helps,

@Chris Boehm 

 

Hi Chris,

 

That is how I set it up, with one exception.  I run a log query against the sentinel alert to get the username.  Then I use the username in the check group membership step.  Otherwise it is set up like you show.  When I run against a user not in the group the false branch does not run.  I think it is because the output body of the check membership step shows as "[]".  So since it is null it does not execute the next for each step.

@Chris Boehm 

 

Chris,

 

Any other suggestions on how to try this?

 

Thanks,

 

Andrew

Hi @andrew_bryant 

 

First, as discussed in another thread (and for the benefit of others), you don't need to query the Workspace but can rather extract the user names for an alert using the Sentinel connector actions. 

 

2019-05-05 03_57_19-Clipboard.png

 

As to your question, did you try to use an expression on the returned value rather than using it directly? I didn't try, but Length below looks promising.

 

2019-05-05 03_59_47-Logic Apps Designer - Microsoft Azure - portal.azure.com.png 

@Ofer_Shezaf 

 

Interestingly, when I switched the action from querying the alert ID with log analytics to getting the account name from the sentinel alert it allowed me to create the condition under check group membership without putting it in its own for each loop.  It wasn't allowing me to do that before.  So now I can just create the condition to check whether the body equals the group ID.  Tested it out and it works.

 

Thanks,

@andrew_bryant 

 

Good to know. My guess is that the challenge is all JSON transformation. We need to learn more about Logic App JSON handling. We will share our findings.

 

~ Ofer

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
30 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies