Align MS365 access review users list with SCIM

Build /users like the SCIM bridge ListUsers helper so access
review only returns home-tenant members (userType eq Member).

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

cmd/probod/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to `probod` (the server, including the bundled `@probo/conso
 
 ## Unreleased
 
+### Fixed
+
+- Microsoft 365 access review lists home-tenant organization members only, using the same Graph `/users?$filter=userType eq 'Member'` call as the SCIM bridge
+
 ## [0.241.0] - 2026-07-30
 
 ### Added

pkg/accessreview/drivers/microsoft_365.go

@@ -46,8 +46,6 @@ var _ Driver = (*Microsoft365Driver)(nil)
 const (
 	microsoft365GraphBaseURL         = "https://graph.microsoft.com/v1.0"
 	microsoft365UsersSelect          = "id,userPrincipalName,mail,displayName,givenName,surname,accountEnabled,jobTitle,department,createdDateTime"
-	// microsoft365UserTypeMemberFilter restricts /users to internal members
-	// so guest (B2B) accounts are not pulled into access review.
 	microsoft365UserTypeMemberFilter = "userType eq 'Member'"
 	microsoft365UsersPageSize        = 999
 	microsoft365MaxPaginationOK      = maxPaginationPages
@@ -270,20 +268,15 @@ func (d *Microsoft365Driver) listUsers(ctx context.Context) ([]microsoft365User,
 }
 
 func buildMicrosoft365UsersURL() (string, error) {
-	endpoint, err := url.JoinPath(microsoft365GraphBaseURL, "users")
+	u, err := url.Parse(microsoft365GraphBaseURL + "/users")
-	if err != nil {
-		return "", fmt.Errorf("cannot build graph users URL: %w", err)
-	}
-
-	u, err := url.Parse(endpoint)
 	if err != nil {
 		return "", fmt.Errorf("cannot parse graph users URL: %w", err)
 	}
 
 	q := u.Query()
 	q.Set("$select", microsoft365UsersSelect)
-	q.Set("$filter", microsoft365UserTypeMemberFilter)
 	q.Set("$top", strconv.Itoa(microsoft365UsersPageSize))
+	q.Set("$filter", microsoft365UserTypeMemberFilter)
 	u.RawQuery = q.Encode()
 
 	return u.String(), nil