{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "e59f0f7f-fd05-4ec8-9f59-e4d9c3b589f2", "cellValue": "selected", "linkTarget": "parameter", "linkLabel": "Current RBAC Delegation", "subTarget": "RBACDelegation", "preText": "RBAC Delegation", "postText": "", "style": "link" }, { "id": "26056188-7abf-4913-a927-806099e616eb", "cellValue": "selected", "linkTarget": "parameter", "linkLabel": "Custom Roles", "subTarget": "CustomRole", "style": "link" }, { "id": "5eeebe10-be67-4f8a-9d91-4bc6c70c3e16", "cellValue": "selected", "linkTarget": "parameter", "linkLabel": "Workbook Help", "subTarget": "start", "style": "link" } ] }, "name": "links - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9ae328d6-99c8-4c44-8d59-42ca4d999098", "version": "KqlParameterItem/1.0", "name": "EnvironmentList", "label": "Environment", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "ExchangeEnvironmentList(Target=\"Online\") | where ESIEnvironment != \"\"", "typeSettings": { "limitSelectTo": 1, "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "a88b4e41-eb2f-41bf-92d8-27c83650a4b8", "version": "KqlParameterItem/1.0", "name": "DateOfConfiguration", "label": "Collection time", "type": 2, "isRequired": true, "query": "let _configurationEnv = split(iff(isnull({EnvironmentList}) or isempty({EnvironmentList}) or tolower({EnvironmentList}) == \"all\",\"All\",tostring({EnvironmentList})),',');\r\nESIExchangeOnlineConfig_CL\r\n| extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n| where ScopedEnvironment in (_configurationEnv)\r\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n| summarize Collection = max(Collection)\r\n| project Collection = \"lastdate\", Selected = true\r\n| join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | summarize by Collection \r\n | join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm ')\r\n | summarize by PreciseCollection, Collection \r\n | join kind=leftouter (\r\n ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm')\r\n | summarize by PreciseCollection, Collection \r\n | summarize count() by Collection\r\n ) on Collection\r\n ) on Collection\r\n) on Collection\r\n| project Value = iif(Selected,Collection,iif(count_ > 1,PreciseCollection,Collection1)), Label = iif(Selected,\"Last Known date\",iif(count_ > 1,PreciseCollection,Collection1)), Selected\r\n| sort by Selected, Value desc", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "8ac96eb3-918b-4a36-bcc4-df50d8f46175", "version": "KqlParameterItem/1.0", "name": "Help", "label": "Show Help", "type": 10, "isRequired": true, "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\\r\\n\"}\r\n", "timeContext": { "durationMs": 2592000000 }, "queryType": 8 } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "TimeRange" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Custom Delegation", "items": [ { "type": 1, "content": { "json": "The current delegation are compared to an export of default delegation available on Exchange Online.\r\n\r\nTo find which is used for the comparaison please follow this link.\r\nThe export is located on the public GitHub of the project.\r\n\r\ncheck this link : https://aka.ms/esiwatchlist\r\n\r\nIt will be updated by the team project.", "style": "info" }, "name": "text - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Custom Delegation on User Accounts", "items": [ { "type": 1, "content": { "json": " Custom Delegation on User Accounts" }, "name": "text - 2 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "d9d4e0a2-b75d-4825-9f4e-7606516500e1", "version": "KqlParameterItem/1.0", "name": "RoleAssignee", "type": 2, "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"User\"\r\n| project CmdletResultValue\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| distinct RoleAssigneeName\r\n", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null }, { "id": "cf5959fa-a833-4bb2-90bd-d4c90dca5506", "version": "KqlParameterItem/1.0", "name": "Role", "type": 2, "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"User\"\r\n| project CmdletResultValue\r\n| extend Role=tostring (CmdletResultValue.Role)\r\n| distinct Role\r\n| sort by Role asc", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.RoleAssigneeName endswith \"{RoleAssignee}\" \r\n| where CmdletResultValue.Role contains \"{Role}\"\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"User\" and CmdletResultValue.Name !contains \"Deleg\"\r\n| project CmdletResultValue\r\n| extend Name = tostring(CmdletResultValue.Name)\r\n| extend Role = tostring(CmdletResultValue.Role)\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\r\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\r\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\r\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\r\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\r\n| extend Status= tostring(CmdletResultValue.Enabled)\r\n| project Name, Role, RoleAssigneeName,Status,CustomRecipientWriteScope,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope\r\n| sort by RoleAssigneeName asc\r\n", "size": 3, "showAnalytics": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "CmdletName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "31.5ch" } }, { "columnMatch": "Total", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "9.3ch" } }, { "columnMatch": "Count", "formatter": 21, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "330px" } }, { "columnMatch": "Anomalies", "formatter": 10, "formatOptions": { "palette": "redBright", "customColumnWidthSetting": "330px" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "RoleAssigneeName", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "RoleAssigneeName", "sortOrder": 1 } ] }, "name": "query - 2", "styleSettings": { "showBorder": true } } ] }, "name": "Custom Delegation on User Accounts" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Explanations", "items": [ { "type": 1, "content": { "json": "This section displays all the nonstandard delegations done directly to a user account.\r\n\r\nDetailed information for the user accounts will be displayed.\r\n\r\nThis status is done by comparing current delegation with the default delegation for Exchange 2019 CU11.\r\n\r\nThese types of delegations are not available on the Exchange Admin Center.\r\n\r\nUsual results :\r\n\r\n - Delegations done directly to service account. Being able to see this delegation will help to sanityze the environment as some delegations may be no more necessary\r\n\r\n - Delegation done by mistake directly to Administrator Accounts\r\n\r\n - Suspicious delegations\r\n\r\n\r\nDetailed information for the user accounts will be displayed in below sections\r\n" }, "name": "text - 0" } ] }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Custom Delegation on Groups", "items": [ { "type": 1, "content": { "json": "Custom Delegation on Groups" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c548eb09-54e3-41bf-a99d-be3534f7018b", "version": "KqlParameterItem/1.0", "name": "RoleAssignee", "type": 2, "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"RoleGroup\" and CmdletResultValue.RoleAssigneeName !contains \"RIM-MailboxAdmins\"\r\n| project CmdletResultValue\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| distinct RoleAssigneeName", "typeSettings": { "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null }, { "id": "f5511a2b-9bf6-48ae-a968-2d1f879c8bfa", "version": "KqlParameterItem/1.0", "name": "Role", "type": 2, "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"RoleGroup\" and CmdletResultValue.RoleAssigneeName !contains \"RIM-MailboxAdmins\"\r\n| project CmdletResultValue\r\n| extend Role=tostring (CmdletResultValue.Role)\r\n| distinct Role\r\n| sort by Role asc", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "MR-CustMailRecipients" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nlet RoleG = ExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n | project RoleAssigneeName=tostring(CmdletResultValue.Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.RoleAssigneeName endswith \"{RoleAssignee}\" \r\n| where CmdletResultValue.Role contains \"{Role}\"\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"RoleGroup\" and CmdletResultValue.RoleAssigneeName !contains \"RIM-MailboxAdmins\" and CmdletResultValue.Name !contains \"Deleg\"\r\n| project CmdletResultValue\r\n| extend ManagementRoleAssignment = tostring(CmdletResultValue.Name)\r\n| extend Role = tostring(CmdletResultValue.Role)\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| extend Status= tostring(CmdletResultValue.Enabled)\r\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\r\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\r\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\r\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\r\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\r\n|lookup RoleG on RoleAssigneeName \r\n| project-away CmdletResultValue\r\n| sort by RoleAssigneeName asc", "size": 3, "showAnalytics": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "RoleAssigneeName", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "RoleAssigneeName", "sortOrder": 1 } ] }, "name": "query - 1", "styleSettings": { "showBorder": true } } ] }, "name": "Custom Delegation on Groups" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Explanations", "items": [ { "type": 1, "content": { "json": "This section displays all the nonstandard delegations done for standard and non standard groups. Indeed, default groups have a list of default delegations but an Exchange administrators can add also new roles to the default groups.\r\n\r\nThis status is done by comparing current delegation with the default delegation for Exchange 2019 CU11.\r\n\r\nUsual results :\r\n\r\n - Delegations done for Organization Management to role like Mailbox Import Export or Mailbox Search\r\n\r\n - Delegation done by mistake\r\n\r\n - Suspicious delegations\r\n\r\nDetailed information for the user accounts present in the groups will be displayed in below sections\r\n" }, "name": "text - 0" } ] }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "group - 4" } ] }, "conditionalVisibility": { "parameterName": "selected", "comparison": "isEqualTo", "value": "RBACDelegation" }, "name": "Custom Delegation", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### How to user this tab\r\n**1 - Select an account** : All the Cmdlet launched by the account during the selected time frame will be displayer.\r\n\r\n**2 - Select a cmdlet** : All the roles that contain will be displayed\r\n\r\n**3 - Review the list of roles** : This table contains all the roles that contain the selected Cmdlet\r\n\r\n", "style": "info" }, "name": "text - 1" }, { "type": 1, "content": { "json": "### How to undertand the \"List of Roles with this CmdLet\" table ? \r\n\r\n**WeightRole :** Display the wieight of this role based on its importance in terms of security risk\r\n\r\n**SumRole :** Among all the Cmdlet launched by the account during the defined time frame, this role available for x cmdlet. This role include x cmdlet run by the user.\r\n\r\n**OrgMgmtRole :** This role is really in the scope of Organization Management group. If the selected Cmdlet is not included is any other role, it make sense that this user is member of the Organization Management group\r\n\r\n ", "style": "upsell" }, "name": "text - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CounUserCmdlet = (ExchangeAdminAuditLogs\r\n| where Status == \"Success\"\r\n| extend Caller = tostring(split(Caller,\"/\")[countof(Caller,\"/\")])\r\n| summarize Count=count() by Caller);\r\nExchangeConfiguration(SpecificSectionList=\"ExGroup\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| search CmdletResultValue.Parentgroup == \"Organization Management\"\r\n| where CmdletResultValue.Level != 0\r\n| where CmdletResultValue.ObjectClass == \"user\"\r\n//| project CmdletResultValue,Count\r\n| extend Account = tostring(CmdletResultValue.SamAccountName)\r\n| join kind=leftouter (CounUserCmdlet) on $left.Account == $right.Caller\r\n| project Account,Count\r\n//| project-away CmdletResultValue\r\n| sort by Account asc", "size": 3, "title": "Organization Management Members", "exportFieldName": "Account", "exportParameterName": "Account", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true, "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "purple" } } ] } }, "customWidth": "20", "name": "query - 1", "styleSettings": { "maxWidth": "100%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExchangeAdminAuditLogs\r\n| where Caller contains \"{Account}\"\r\n| where Status == \"Success\"\r\n| distinct CmdletName\r\n| sort by CmdletName asc", "size": 3, "title": "List of CmdLet run by the account", "exportFieldName": "CmdletName", "exportParameterName": "CmdletName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "CmdletName", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "CmdletName", "sortOrder": 1 } ] }, "customWidth": "33", "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let RBACRoleCmdlet = _GetWatchlist('RBACRoleCmdlet');\r\nlet UserRoleList = ExchangeAdminAuditLogs | where Caller contains \"{Account}\" | where Status == \"Success\" | distinct CmdletName;\r\nlet countRole = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize SumRole = count()by Role);\r\nlet RolevsCmdlet = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize make_set(Name) by Role);\r\nRolevsCmdlet\r\n| join kind=leftouter ( countRole ) on Role\r\n| project Role,CmdletList=set_Name,SumRole\r\n| join kind=leftouter ( RBACRoleCmdlet ) on Role\r\n| where Name has \"{CmdletName}\"\r\n| extend PossibleRoles = Role\r\n| extend OrgMgmtRole = OrgM\r\n| extend RoleWeight = Priority\r\n|distinct PossibleRoles,RoleWeight,tostring(SumRole),OrgMgmtRole,tostring(CmdletList)\r\n|sort by SumRole,RoleWeight\r\n", "size": 3, "title": "List of Roles with this CmdLet", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "PossibleRoles", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "PossibleRoles", "sortOrder": 1 } ] }, "customWidth": "40", "name": "query - 3", "styleSettings": { "margin": "0", "maxWidth": "100%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let RBACRoleCmdlet = _GetWatchlist('RBACRoleCmdlet');\r\nlet UserRoleList = ExchangeAdminAuditLogs | where TimeGenerated {TimeRange} | where Caller contains \"{Account}\" | where Status == \"Success\" | distinct CmdletName;\r\nlet countRole = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize SumRole = count()by Role);\r\nlet RolevsCmdlet = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize make_set(Name) by Role);\r\nRolevsCmdlet\r\n| join kind=leftouter ( countRole ) on Role\r\n| project Role,CmdletList=set_Name,SumRole\r\n| join kind=leftouter ( RBACRoleCmdlet ) on Role\r\n| extend Roles = Role\r\n| extend OrgMgmtRole = OrgM\r\n| extend RoleWeight = Priority\r\n| extend CmdletList=tostring(CmdletList)\r\n| summarize by Roles,CmdletList,RoleWeight,tostring(SumRole),OrgMgmtRole\r\n| distinct Roles,RoleWeight,tostring(SumRole),OrgMgmtRole,tostring(CmdletList)\r\n|sort by Roles asc", "size": 0, "title": "Recommended Roles for selected users", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Roles", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Roles", "sortOrder": 1 } ] }, "name": "query - 3" } ] }, "name": "group - 0" } ] }, "conditionalVisibility": { "parameterName": "selected", "comparison": "isEqualTo", "value": "Leastprivileges" }, "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Custom Role details", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "List of Custom Roles", "items": [ { "type": 1, "content": { "json": "List of existing custom Roles" }, "customWidth": "50", "name": "text - 3" }, { "type": 1, "content": { "json": "List of Custom with a Management Role Assignement (associated with a group or a user). Display the target account and scope if set" }, "customWidth": "50", "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExchangeConfiguration(SpecificSectionList=\"MRCustom\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| extend Identity = CmdletResultValue.Name\r\n| extend ParentRole =split(tostring(CmdletResultValue.Parent),\"\\\\\")[1]\r\n| project Identity, ParentRole, WhenCreated, WhenChanged", "size": 3, "showAnalytics": true, "timeContext": { "durationMs": 86400000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\"MRCustom\", SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| project Role = tostring(CmdletResultValue.Name));\r\nExchangeConfiguration(SpecificSectionList=\"MRA\", SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| extend Role = tostring(CmdletResultValue.Role)\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| extend Scope = tostring(CmdletResultValue.CustomRecipientWriteScope)\r\n| project Role, Scope, RoleAssigneeName\r\n| join kind=inner (MRcustomRoles) on Role\r\n| project Role,RoleAssigneeName,Scope", "size": 1, "showAnalytics": true, "timeContext": { "durationMs": 86400000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\"MRCustom\", SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| project Role = tostring(CmdletResultValue.Name));\r\nExchangeConfiguration(SpecificSectionList=\"MRA\", SpecificConfigurationDate=\"lastdate\", SpecificConfigurationEnv='ITSY', Target = \"Online\")\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| extend Scope = tostring(CmdletResultValue.CustomRecipientWriteScope)\r\n| project Role= tostring(CmdletResultValue.Role), Scope, RoleAssigneeName\r\n| join kind=rightouter (MRcustomRoles) on Role\r\n| project Role = Role1, Scope, RoleAssigneeName,Comment = iff(Role == \"\", \"⚠️ No existing delegation for this role\", \"✅ This role is delegated with a Management Role Assignment\")", "size": 0, "showAnalytics": true, "timeContext": { "durationMs": 86400000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\"MRCustom\", SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| project Role = tostring(CmdletResultValue.Name));\r\nExchangeConfiguration(SpecificSectionList=\"MRA\", SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| project Role = tostring(CmdletResultValue.Role)\r\n| join kind=rightouter (MRcustomRoles) on Role\r\n| summarize acount = count() by iff( Role==\"\",\"Number of non assigned roles\", Role)", "size": 0, "showAnalytics": true, "timeContext": { "durationMs": 86400000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "query - 5" } ] }, "name": "List of Custom Roles" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Custom Roles delegation on group", "items": [ { "type": 1, "content": { "json": "This section shows delegation associated with the Custom Roles" }, "name": "text - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\"MRCustom\", SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| project Role = tostring(CmdletResultValue.Name));\r\nExchangeConfiguration(SpecificSectionList=\"MRA\", SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| extend Role = tostring(CmdletResultValue.Role)\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| extend Status= tostring(CmdletResultValue.Enabled)\r\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\r\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\r\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\r\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\r\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\r\n| project RoleAssigneeName, Role, Status,CustomRecipientWriteScope, CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,WhenCreated, WhenChanged\r\n| join kind=inner (MRcustomRoles) on Role\r\n| project RoleAssigneeName, Role, Status,CustomRecipientWriteScope, CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,WhenCreated, WhenChanged", "size": 3, "showAnalytics": true, "timeContext": { "durationMs": 86400000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 1" } ] }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Details for Custom Roles Cmdlets ", "items": [ { "type": 1, "content": { "json": "This section displays for the chosen custom management roles all Cmdlets and their parameters associated with this custom role.\r\nRemember that for a cmdlet, some parameters can be removed." }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "07c8ac83-371d-4702-ab66-72aeb2a20053", "version": "KqlParameterItem/1.0", "name": "CustomRole", "type": 2, "isRequired": true, "query": "ExchangeConfiguration(SpecificSectionList=\"MRCustom\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| extend Identity = CmdletResultValue.Name\r\n| project Identity", "typeSettings": { "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "MR-CustPF" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExchangeConfiguration(SpecificSectionList=\"MRCustomDetails\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Role contains \"{CustomRole}\"\r\n| extend CmdletName = CmdletResultValue.Name\r\n| extend Parameters = CmdletResultValue.Parameters\r\n| project CmdletName,Parameters", "size": 1, "showAnalytics": true, "timeContext": { "durationMs": 86400000 }, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 1", "styleSettings": { "showBorder": true } } ] }, "name": "Details for Custom Roles Cmdlets " } ] }, "conditionalVisibility": { "parameterName": "selected", "comparison": "isEqualTo", "value": "CustomRole" }, "name": "Custom Role" } ], "fromTemplateId": "sentinel-MicrosoftExchangeLeastPrivilegewithRBAC-Online", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }