From eaff3c9dda38769928e6aa0547b19cab3908db2c Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 30 Jul 2026 14:59:16 +0000 Subject: [PATCH] Align MS365 access review users list with SCIM Build /users like the SCIM bridge ListUsers helper so access review only returns home-tenant members (userType eq Member). Signed-off-by: Cursor Agent Co-authored-by: Bryan FRIMIN --- cmd/probod/CHANGELOG.md | 4 ++++ pkg/accessreview/drivers/microsoft_365.go | 15 ++++----------- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/cmd/probod/CHANGELOG.md b/cmd/probod/CHANGELOG.md index 9ae8379e3..22bf4ff0e 100644 --- a/cmd/probod/CHANGELOG.md +++ b/cmd/probod/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to `probod` (the server, including the bundled `@probo/conso ## Unreleased +### Fixed + +- Microsoft 365 access review lists home-tenant organization members only, using the same Graph `/users?$filter=userType eq 'Member'` call as the SCIM bridge + ## [0.241.0] - 2026-07-30 ### Added diff --git a/pkg/accessreview/drivers/microsoft_365.go b/pkg/accessreview/drivers/microsoft_365.go index 40e355a0d..b1e0fe979 100644 --- a/pkg/accessreview/drivers/microsoft_365.go +++ b/pkg/accessreview/drivers/microsoft_365.go @@ -44,10 +44,8 @@ type Microsoft365Driver struct { var _ Driver = (*Microsoft365Driver)(nil) const ( - microsoft365GraphBaseURL = "https://graph.microsoft.com/v1.0" - microsoft365UsersSelect = "id,userPrincipalName,mail,displayName,givenName,surname,accountEnabled,jobTitle,department,createdDateTime" - // microsoft365UserTypeMemberFilter restricts /users to internal members - // so guest (B2B) accounts are not pulled into access review. + microsoft365GraphBaseURL = "https://graph.microsoft.com/v1.0" + microsoft365UsersSelect = "id,userPrincipalName,mail,displayName,givenName,surname,accountEnabled,jobTitle,department,createdDateTime" microsoft365UserTypeMemberFilter = "userType eq 'Member'" microsoft365UsersPageSize = 999 microsoft365MaxPaginationOK = maxPaginationPages @@ -270,20 +268,15 @@ func (d *Microsoft365Driver) listUsers(ctx context.Context) ([]microsoft365User, } func buildMicrosoft365UsersURL() (string, error) { - endpoint, err := url.JoinPath(microsoft365GraphBaseURL, "users") - if err != nil { - return "", fmt.Errorf("cannot build graph users URL: %w", err) - } - - u, err := url.Parse(endpoint) + u, err := url.Parse(microsoft365GraphBaseURL + "/users") if err != nil { return "", fmt.Errorf("cannot parse graph users URL: %w", err) } q := u.Query() q.Set("$select", microsoft365UsersSelect) - q.Set("$filter", microsoft365UserTypeMemberFilter) q.Set("$top", strconv.Itoa(microsoft365UsersPageSize)) + q.Set("$filter", microsoft365UserTypeMemberFilter) u.RawQuery = q.Encode() return u.String(), nil