Security Copilot + Microsoft Entra — Vollständige Referenz Security Copilot + Microsoft Entra — Complete Reference

# Riskante Benutzer via Microsoft Graph abrufen (Copilot-Äquivalent)
# Get risky users via Microsoft Graph (Copilot equivalent)
Connect-MgGraph -Scopes "IdentityRiskEvent.Read.All", "IdentityRiskyUser.ReadWrite.All"

# Alle Hochrisikobenutzer
# All high-risk users
Get-MgRiskyUser -Filter "riskLevel eq 'high'" | `
  Select-Object UserDisplayName, UserPrincipalName, RiskLevel, RiskState, RiskLastUpdatedDateTime

# Risikoerkennungen für spezifischen Benutzer
# Risk detections for specific user
Get-MgRiskDetection -Filter "userPrincipalName eq 'user@contoso.com'" | `
  Select-Object DetectionTimingType, RiskEventType, RiskLevel, Activity, IpAddress | Format-List

# Benutzerrisiko zurücksetzen (nach Untersuchung)
# Dismiss user risk (after investigation)
Invoke-MgGraphRequest -Method POST `
  -Uri "https://graph.microsoft.com/v1.0/identityProtection/riskyUsers/dismiss" `
  -Body (@{ userIds = @("user-objectid-here") } | ConvertTo-Json) `
  -ContentType "application/json"

# Benutzerrisiko bestätigen als kompromittiert
# Confirm user is compromised
Invoke-MgGraphRequest -Method POST `
  -Uri "https://graph.microsoft.com/v1.0/identityProtection/riskyUsers/confirmCompromised" `
  -Body (@{ userIds = @("user-objectid-here") } | ConvertTo-Json) `
  -ContentType "application/json"

// KQL: Fehlgeschlagene Anmeldungen der letzten 24 Stunden analysieren
// KQL: Analyze failed sign-ins from the last 24 hours
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType != 0
| summarize
    FailureCount = count(),
    Users = make_set(UserPrincipalName),
    ErrorCodes = make_set(ResultType),
    Countries = make_set(Location)
  by ResultDescription, AppDisplayName
| sort by FailureCount desc
| take 20

// KQL: Conditional Access Policy Details pro Anmeldung
// KQL: Conditional Access Policy Details per sign-in
SigninLogs
| where TimeGenerated > ago(7d)
| where UserPrincipalName == "user@contoso.com"
| mv-expand ConditionalAccessPolicies
| extend
    PolicyName = tostring(ConditionalAccessPolicies.displayName),
    PolicyResult = tostring(ConditionalAccessPolicies.result),
    PolicyId = tostring(ConditionalAccessPolicies.id)
| where PolicyResult in ("failure", "reportOnlyFailure")
| project TimeGenerated, PolicyName, PolicyResult, AppDisplayName, ResultDescription

# Alle CA-Policies als JSON abrufen (für Copilot-Import oder eigene Analyse)
# Retrieve all CA policies as JSON (for Copilot import or own analysis)
Connect-MgGraph -Scopes "Policy.Read.All"

$policies = Get-MgIdentityConditionalAccessPolicy -All
$policies | Select-Object DisplayName, State, CreatedDateTime | Format-Table -AutoSize

# Detaillierte Policy-Analyse: Alle Ausschlüsse anzeigen
# Detailed policy analysis: Show all exclusions
foreach ($policy in $policies) {
    if ($policy.Conditions.Users.ExcludeUsers -or $policy.Conditions.Users.ExcludeGroups) {
        Write-Host "`nPolicy: $($policy.DisplayName)" -ForegroundColor Yellow
        Write-Host "  Excluded Users: $($policy.Conditions.Users.ExcludeUsers -join ', ')"
        Write-Host "  Excluded Groups: $($policy.Conditions.Users.ExcludeGroups -join ', ')"
    }
}

# CA What-If Simulation via Graph API
# CA What-If Simulation via Graph API
$whatIfBody = @{
    conditionalAccessWhatIfSubject = @{
        "@odata.type" = "#microsoft.graph.conditionalAccessWhatIfUser"
        userId = "user-object-id"
    }
    conditionalAccessContext = @{
        "@odata.type" = "#microsoft.graph.conditionalAccessContext"
        servicePrincipalId = "app-object-id"
        ipAddress = "203.0.113.42"
        country = "DE"
        devicePlatform = "windows"
        clientAppType = "browser"
    }
} | ConvertTo-Json -Depth 5

Invoke-MgGraphRequest -Method POST `
  -Uri "https://graph.microsoft.com/beta/identity/conditionalAccess/evaluate" `
  -Body $whatIfBody -ContentType "application/json"

# Vollständiges Benutzerprofil abrufen (alle relevanten Sicherheitsinformationen)
# Get complete user profile (all relevant security information)
Connect-MgGraph -Scopes "User.Read.All","Directory.Read.All","AuditLog.Read.All"

$upn = "max.mustermann@contoso.com"
$user = Get-MgUser -UserId $upn -Property `
  "id,displayName,userPrincipalName,accountEnabled,assignedLicenses,
   assignedRoles,signInActivity,onPremisesSyncEnabled,lastPasswordChangeDateTime,
   createdDateTime,userType"

# Rollenzuweisungen
# Role assignments
$roles = Get-MgUserMemberOf -UserId $user.Id | `
  Where-Object { $_."@odata.type" -eq "#microsoft.graph.directoryRole" } | `
  Select-Object DisplayName

# Gruppenmigtliedschaft
# Group membership
$groups = Get-MgUserMemberOf -UserId $user.Id | `
  Where-Object { $_."@odata.type" -eq "#microsoft.graph.group" } | `
  Select-Object DisplayName, Id

# Letzte Anmeldung
# Last sign-in
$signInActivity = $user.SignInActivity
Write-Host "Letzter interaktiver Sign-In / Last interactive sign-in: $($signInActivity.LastSignInDateTime)"
Write-Host "Letzte non-interaktive Aktivität / Last non-interactive: $($signInActivity.LastNonInteractiveSignInDateTime)"

# Lizenzstatus
# License status
$licenses = Get-MgUserLicenseDetail -UserId $user.Id | Select-Object SkuPartNumber, ServicePlans

# PIM Aktivierungshistorie der letzten 30 Tage
# PIM activation history for the last 30 days
Connect-MgGraph -Scopes "RoleManagement.Read.Directory", "AuditLog.Read.All"

$activations = Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?`$filter=loggedByService eq 'PIM' and activityDateTime ge $((Get-Date).AddDays(-30).ToString('yyyy-MM-ddTHH:mm:ssZ'))&`$top=100"

$activations.value | ForEach-Object {
    [PSCustomObject]@{
        ActivityDateTime = $_.activityDateTime
        Activity         = $_.activityDisplayName
        Initiator        = $_.initiatedBy.user.userPrincipalName
        TargetRole       = ($_.targetResources | Where-Object type -eq "Role").displayName
        Result           = $_.result
    }
} | Format-Table -AutoSize

# Access Reviews Status
# Access Review Status
$reviews = Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions?`$filter=status eq 'InProgress'"
$reviews.value | Select-Object displayName, status, startDateTime, endDateTime | Format-Table -AutoSize

// KQL: Verdächtige App-Consent-Grants erkennen
// KQL: Detect suspicious app consent grants
AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName in ("Consent to application", "Add delegated permission grant")
| extend
    ConsentedBy    = tostring(InitiatedBy.user.userPrincipalName),
    AppName        = tostring(TargetResources[0].displayName),
    GrantedScopes  = tostring(AdditionalDetails)
| project TimeGenerated, ConsentedBy, AppName, GrantedScopes, Result
| sort by TimeGenerated desc

// KQL: Rollenzuweisungsänderungen der letzten 24 Stunden
// KQL: Role assignment changes in the last 24 hours
AuditLogs
| where TimeGenerated > ago(24h)
| where Category == "RoleManagement"
| where OperationName in ("Add member to role", "Remove member from role")
| extend
    Actor      = tostring(InitiatedBy.user.userPrincipalName),
    TargetUser = tostring(TargetResources[0].displayName),
    RoleName   = tostring(TargetResources[1].displayName)
| project TimeGenerated, Actor, OperationName, TargetUser, RoleName
| sort by TimeGenerated desc

// KQL: CA-Policy-Änderungen erkennen
// KQL: Detect CA policy changes
AuditLogs
| where TimeGenerated > ago(30d)
| where Category == "Policy"
| where OperationName startswith "Update conditional access policy" 
     or OperationName startswith "Delete conditional access policy"
| extend
    Actor      = tostring(InitiatedBy.user.userPrincipalName),
    PolicyName = tostring(TargetResources[0].displayName)
| project TimeGenerated, Actor, OperationName, PolicyName, Result

# Security Copilot für Entra einrichten
# Set up Security Copilot for Entra

# 1. Security Copilot SCU provisionieren (Azure Portal: Security Copilot)
# 1. Provision Security Copilot SCU (Azure Portal: Security Copilot)
# Navigiere zu: portal.azure.com → Microsoft Security Copilot → Neue Kapazität erstellen
# Navigate to: portal.azure.com → Microsoft Security Copilot → Create new capacity

# 2. Entra-Plugin in Security Copilot aktivieren
# 2. Enable Entra plugin in Security Copilot
# Im Security Copilot Portal → Einstellungen → Plugins → Microsoft Entra → Aktivieren
# In Security Copilot Portal → Settings → Plugins → Microsoft Entra → Enable

# 3. Capacity Units prüfen (via Az PowerShell)
# 3. Check Capacity Units (via Az PowerShell)
Connect-AzAccount
Get-AzResource -ResourceType "Microsoft.SecurityCopilot/capacities" | `
  Select-Object ResourceGroupName, Name, Location, Sku

# 4. Rollenzuweisung für Security Copilot Analysten
# 4. Role assignment for Security Copilot analysts
$analysts = @("analyst1@contoso.com", "analyst2@contoso.com")
foreach ($analyst in $analysts) {
    New-MgRoleManagementDirectoryRoleAssignment `
      -PrincipalId (Get-MgUser -UserId $analyst).Id `
      -RoleDefinitionId "5d6b6bb7-de71-4623-b4af-96380a352509" ` # Security Reader
      -DirectoryScopeId "/"
}

{
  "definition": {
    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
    "triggers": {
      "When_Sentinel_alert_fires": {
        "type": "ApiConnection",
        "inputs": {
          "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } },
          "method": "post",
          "path": "/subscribe"
        }
      }
    },
    "actions": {
      "Run_Security_Copilot_Prompt": {
        "type": "Http",
        "inputs": {
          "method": "POST",
          "uri": "https://api.securitycopilot.microsoft.com/geo/us/sessions/[sessionId]/prompt",
          "headers": { "Authorization": "Bearer @{variables('copilotToken')}" },
          "body": {
            "prompt": "Investigate the risky user @{triggerBody()?['entities']?[0]?['properties']?['userPrincipalName']}. Summarize the risk level, last sign-ins, and recommend actions."
          }
        }
      },
      "Post_to_Teams": {
        "type": "ApiConnection",
        "inputs": {
          "host": { "connection": { "name": "@parameters('$connections')['teams']['connectionId']" } },
          "method": "post",
          "path": "/v3/beta/teams/@{encodeURIComponent('SOC-Team-ID')}/channels/@{encodeURIComponent('Alerts-Channel-ID')}/messages",
          "body": {
            "body": { "content": "@{body('Run_Security_Copilot_Prompt')?['output']}" }
          }
        }
      }
    }
  }
}

# Vollständiges Security Copilot + Entra Diagnose-Skript
# Complete Security Copilot + Entra Diagnostics Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns

param(
    [Parameter(Mandatory=$false)]
    [string]$UserUPN,
    [Parameter(Mandatory=$false)]
    [int]$DaysBack = 7
)

Connect-MgGraph -Scopes @(
    "AuditLog.Read.All",
    "IdentityRiskyUser.ReadWrite.All",
    "IdentityRiskEvent.Read.All",
    "Directory.Read.All",
    "Policy.Read.All"
) -ErrorAction Stop

Write-Host "=== SECURITY COPILOT + ENTRA DIAGNOSTICS ===" -ForegroundColor Cyan

if ($UserUPN) {
    Write-Host "`n[BENUTZER / USER] $UserUPN" -ForegroundColor Yellow

    # Riskoprofil
    $riskUser = Get-MgRiskyUser -Filter "userPrincipalName eq '$UserUPN'"
    if ($riskUser) {
        Write-Host "  Risikoniveau / Risk Level: $($riskUser.RiskLevel)" -ForegroundColor $(if($riskUser.RiskLevel -eq 'high'){'Red'} else {'Yellow'})
        Write-Host "  Risikostatus / Risk State: $($riskUser.RiskState)"
        Write-Host "  Letzte Risikoaktualisierung / Last Updated: $($riskUser.RiskLastUpdatedDateTime)"
    } else {
        Write-Host "  Kein Risiko erkannt / No risk detected." -ForegroundColor Green
    }

    # Letzte Anmeldungen
    Write-Host "`n  Letzte Anmeldungen / Recent Sign-ins:" -ForegroundColor Yellow
    Get-MgAuditLogSignIn -Filter "userPrincipalName eq '$UserUPN'" -Top 5 | `
        Select-Object CreatedDateTime, AppDisplayName, ResultType, IpAddress, Location | `
        Format-Table -AutoSize
}

# Alle Hochrisikobenutzer
Write-Host "`n[ALLE HOCHRISIKO-BENUTZER / ALL HIGH-RISK USERS]" -ForegroundColor Yellow
Get-MgRiskyUser -Filter "riskLevel eq 'high' and riskState eq 'atRisk'" | `
    Select-Object UserDisplayName, UserPrincipalName, RiskLevel, RiskLastUpdatedDateTime | `
    Format-Table -AutoSize

# CA-Policies ohne MFA-Enforcement für alle Benutzer
Write-Host "`n[CA POLICIES OHNE MFA / CA POLICIES WITHOUT MFA]" -ForegroundColor Yellow
$policies = Get-MgIdentityConditionalAccessPolicy -All
$policies | Where-Object {
    $_.GrantControls.BuiltInControls -notcontains "mfa" -and
    $_.State -eq "enabled"
} | Select-Object DisplayName, State | Format-Table -AutoSize