Compartir a través de

Enumerar alertDefinitions

  • Artículo

Espacio de nombres: microsoft.graph

Importante

Las API de la versión /beta de Microsoft Graph están sujetas a cambios. No se admite el uso de estas API en aplicaciones de producción. Para determinar si una API está disponible en la versión 1.0, use el selector de Versión.

Obtenga una lista de los objetos unifiedRoleManagementAlertDefinition y sus propiedades.

Esta API está disponible en las siguientes implementaciones nacionales de nube.

Servicio global Gobierno de EE. UU. L4 Us Government L5 (DOD) China operada por 21Vianet
✅ ✅ ✅ ❌

Permissions

Elija el permiso o los permisos marcados como con privilegios mínimos para esta API. Use un permiso o permisos con privilegios superiores solo si la aplicación lo requiere. Para obtener más información sobre los permisos delegados y de aplicación, consulte Tipos de permisos. Para obtener más información sobre estos permisos, consulte la referencia de permisos.

Tipo de permiso Permisos con privilegios mínimos Permisos con privilegios más altos
Delegado (cuenta profesional o educativa) RoleManagementAlert.Read.Directory RoleManagementAlert.ReadWrite.Directory
Delegado (cuenta personal de Microsoft) No admitida. No admitida.
Aplicación RoleManagementAlert.Read.Directory RoleManagementAlert.ReadWrite.Directory

Importante

En escenarios delegados con cuentas profesionales o educativas, al usuario que ha iniciado sesión se le debe asignar un rol de Microsoft Entra compatible o un rol personalizado con un permiso de rol admitido. Se admiten los siguientes roles con privilegios mínimos para esta operación.

  • Administrador de roles con privilegios
  • Lector global
  • Administrador de seguridad
  • Lector de seguridad

Solicitud HTTP

GET /identityGovernance/roleManagementAlerts/alertDefinitions?$filter=scopeId eq 'scopeId' and scopeType eq 'scopeType'

Parámetros de consulta opcionales

Este método admite los $selectparámetros de consulta , $filtery $expand OData para ayudar a personalizar la respuesta. Para obtener información general, vea Parámetros de consulta OData.

Encabezados de solicitud

Nombre Descripción
Authorization {token} de portador. Obligatorio. Obtenga más información sobre la autenticación y la autorización.

Cuerpo de la solicitud

No proporcione un cuerpo de solicitud para este método.

Respuesta

Si se ejecuta correctamente, este método devuelve un 200 OK código de respuesta y una colección de objeto unifiedRoleManagementAlertDefinition en el cuerpo de la respuesta.

Ejemplos

Solicitud

En el ejemplo siguiente se muestra la solicitud.

GET https://graph.microsoft.com/beta/identityGovernance/roleManagementAlerts/alertDefinitions?$filter=scopeId eq '/' and scopeType eq 'DirectoryRole'

Respuesta

En el ejemplo siguiente se muestra la respuesta.

Nota: Se puede acortar el objeto de respuesta que se muestra aquí para mejorar la legibilidad.

HTTP/1.1 200 OK
Content-Type: application/json

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#identityGovernance/roleManagementAlerts/alertDefinitions",
    "value": [
        {
            "id": "DirectoryRole_19356be4-7e93-4ed6-a7c6-0ae28454d125_InvalidLicenseAlert",
            "displayName": "The organization doesn't have Azure AD Premium P2",
            "scopeType": "DirectoryRole",
            "scopeId": "/",
            "description": "Azure AD Privileged Identity Management requires a license, but the tenant either doesn't have an Azure AD Premium P2 license, or a trial license has expired.  If you do not obtain a license, Azure AD Privileged Identity Management and its configuration will be removed from the tenant.",
            "severityLevel": "high",
            "securityImpact": "Administrators in the tenant will not be able to use Azure AD Privileged Identity Management for role activation, access reviews or other management tasks unless a license is present.",
            "mitigationSteps": "Purchase a license plan which includes Azure AD Premium P2 for all users who will be interacting with Azure AD PIM or with Azure AD Identity Protection.  More information on pricing and purchase options is at https://azure.microsoft.com/en-us/pricing/details/active-directory/",
            "howToPrevent": "To dismiss this alert, ensure there is a license on the tenant for Azure AD Premium P2.",
            "isRemediatable": false,
            "isConfigurable": false
        },
        {
            "id": "DirectoryRole_19356be4-7e93-4ed6-a7c6-0ae28454d125_NoMfaOnRoleActivationAlert",
            "displayName": "Roles don't require multi-factor authentication for activation",
            "scopeType": "DirectoryRole",
            "scopeId": "/",
            "description": "Roles are configured for activation without requiring multifactor authentication. This is highly discouraged.",
            "severityLevel": "medium",
            "securityImpact": "Without multi-factor authentication, compromised users can activate privileged roles.",
            "mitigationSteps": "Review the list of roles and require multi-factor authentication for every role.",
            "howToPrevent": "Every privileged role should be configured to require MFA for activation.",
            "isRemediatable": true,
            "isConfigurable": false
        },
        {
            "id": "DirectoryRole_19356be4-7e93-4ed6-a7c6-0ae28454d125_RedundantAssignmentAlert",
            "displayName": "Eligible administrators aren't activating their privileged role",
            "scopeType": "DirectoryRole",
            "scopeId": "/",
            "description": "{0} user(s) haven't activated their privileged roles in the past {1} days",
            "severityLevel": "low",
            "securityImpact": "Users that have been assigned privileged roles they don't need increases the chance of an attack. It is also easier for attackers to remain unnoticed in accounts that are not actively being used.",
            "mitigationSteps": "Review the users in the list and remove them from privileged roles they do not need.",
            "howToPrevent": "·Assign privileged roles to users that have a business justification.·Schedule regular access reviews to verify that users still need their access.",
            "isRemediatable": true,
            "isConfigurable": true
        },
        {
            "id": "DirectoryRole_19356be4-7e93-4ed6-a7c6-0ae28454d125_RolesAssignedOutsidePimAlert",
            "displayName": "Roles are being assigned outside of Privileged Identity Management",
            "scopeType": "DirectoryRole",
            "scopeId": "/",
            "description": "{0} privileged assignment(s) were made outisde of Azure AD PIM",
            "severityLevel": "high",
            "securityImpact": "Privileged role assignments made outside of Privileged Identity Management are not properly monitored and may indicate an active attack.",
            "mitigationSteps": "Review the users in the list and remove them from privileged roles assigned outside of Privileged Identity Management.",
            "howToPrevent": "Investigate where users are being assigned privileged roles outside of Privileged Identity Management and prohibit future assignments from there.",
            "isRemediatable": true,
            "isConfigurable": false
        },
        {
            "id": "DirectoryRole_19356be4-7e93-4ed6-a7c6-0ae28454d125_SequentialActivationRenewalsAlert",
            "displayName": "Roles are being activated too frequently",
            "scopeType": "DirectoryRole",
            "scopeId": "/",
            "description": "{0} multiple activations for a privileged role were made by the same user",
            "severityLevel": "medium",
            "securityImpact": "Multiple activations to the same privileged role by the same user is a sign of an attack.",
            "mitigationSteps": "Review the users in the list and ensure that the activation duration for their privileged role is set long enough for them to perform their tasks.",
            "howToPrevent": "·Ensure that the activation duration for privileged roles is set long enough for users to perform their tasks.·Require multi-factor authentication for privileged roles that have accounts shared by multiple administrators.",
            "isRemediatable": false,
            "isConfigurable": true
        },
        {
            "id": "DirectoryRole_19356be4-7e93-4ed6-a7c6-0ae28454d125_StaleSignInAlert",
            "displayName": "Potential stale accounts in a privileged role",
            "scopeType": "DirectoryRole",
            "scopeId": "/",
            "description": "{0} account(s) in privileged roles that have not signed in to Azure AD in the past {1} day(s)",
            "severityLevel": "medium",
            "securityImpact": "Accounts in a privileged role have not signed in recently. These accounts might be service or shared accounts that aren't being maintained and are vulnerable to attackers.",
            "mitigationSteps": "Review the accounts in the list. If they no longer need access, remove them from their privileged roles.",
            "howToPrevent": "Regularly review accounts with privileged roles using <a href=\"https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview\" target=\"_blank\" >access reviews</a> and remove role assignments which are no longer needed.",
            "isRemediatable": true,
            "isConfigurable": true
        },
        {
            "id": "DirectoryRole_19356be4-7e93-4ed6-a7c6-0ae28454d125_TooManyGlobalAdminsAssignedToTenantAlert",
            "displayName": "There are too many global administrators",
            "scopeType": "DirectoryRole",
            "scopeId": "/",
            "description": "The percentage of global administrators is high, relative to other privileged roles. It is recommended to use least privileged roles, with just enough privileges to perform the required tasks.",
            "severityLevel": "low",
            "securityImpact": "Global administrator is the highest privileged role. If a Global Administrator is compromised, the attacker gains access to all of their permissions, which puts your whole system at risk.",
            "mitigationSteps": "·Review the users in the list and remove any that do not absolutely need the Global Administrator role.·Assign lower privileged roles to these users instead.",
            "howToPrevent": "Assign users the least privileged role they need.",
            "isRemediatable": true,
            "isConfigurable": true
        }
    ]
}