rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Align MS365 access review users list with SCIM

Browse Source 
Build /users like the SCIM bridge ListUsers helper so access
review only returns home-tenant members (userType eq Member).

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
This commit is contained in:
Cursor Agent
2026-07-30 14:59:16 +00:00
parent 7bce67454c
commit eaff3c9dda
2 changed files with 8 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/probod/CHANGELOG.md
View File

@@ -4,6 +4,10 @@ All notable changes to `probod` (the server, including the bundled `@probo/conso
## Unreleased
### Fixed
- Microsoft 365 access review lists home-tenant organization members only, using the same Graph `/users?$filter=userType eq 'Member'` call as the SCIM bridge
## [0.241.0] - 2026-07-30
### Added

15
pkg/accessreview/drivers/microsoft_365.go
View File

@@ -44,10 +44,8 @@ type Microsoft365Driver struct {
var _ Driver = (*Microsoft365Driver)(nil)
const (
microsoft365GraphBaseURL = "https://graph.microsoft.com/v1.0"
microsoft365UsersSelect = "id,userPrincipalName,mail,displayName,givenName,surname,accountEnabled,jobTitle,department,createdDateTime"
// microsoft365UserTypeMemberFilter restricts /users to internal members
// so guest (B2B) accounts are not pulled into access review.
microsoft365GraphBaseURL = "https://graph.microsoft.com/v1.0"
microsoft365UsersSelect = "id,userPrincipalName,mail,displayName,givenName,surname,accountEnabled,jobTitle,department,createdDateTime"
microsoft365UserTypeMemberFilter = "userType eq 'Member'"
microsoft365UsersPageSize = 999
microsoft365MaxPaginationOK = maxPaginationPages
@@ -270,20 +268,15 @@ func (d *Microsoft365Driver) listUsers(ctx context.Context) ([]microsoft365User,
}
func buildMicrosoft365UsersURL() (string, error) {
endpoint, err := url.JoinPath(microsoft365GraphBaseURL, "users")
if err != nil {
return "", fmt.Errorf("cannot build graph users URL: %w", err)
}
u, err := url.Parse(endpoint)
u, err := url.Parse(microsoft365GraphBaseURL + "/users")
if err != nil {
return "", fmt.Errorf("cannot parse graph users URL: %w", err)
}
q := u.Query()
q.Set("$select", microsoft365UsersSelect)
q.Set("$filter", microsoft365UserTypeMemberFilter)
q.Set("$top", strconv.Itoa(microsoft365UsersPageSize))
q.Set("$filter", microsoft365UserTypeMemberFilter)
u.RawQuery = q.Encode()
return u.String(), nil