Monitor one on-premise group and alert one user.

LeifDavisson 41 Reputation points
2023-10-03T21:59:55.05+00:00

I have an on-premises group that is sensitive and needs to be monitored not just by IT but also the Devs that manage the project. So, when a user gets dropped into the group they want to be notified. I set up a custom rule in D4ID but it only goes to IT, and we added the Devs, but they get every D4ID alert and only want it for just their groups. Any help would be appreciated.

Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
165 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Fiona Matu 86 Reputation points Microsoft Employee
    2024-02-13T14:36:11.64+00:00

    Hi @LeifDavisson,

    you could write a script that utilizes MS Graph API by periodically getting a list of the group members (polling), and if there is a change, it sends an email to the additional memebers. Here is a high level flow of how this might work:

    1. Use the the following endpoint in Microsoft Graph API: GET /groups/{id}/members
    2. Store the list of users in a database or a file.
    3. Periodically (e.g., every hour or every day, depending on your needs), get the current list of users in the group.
    4. Compare the current list of users with the list stored in the database/file. If there is a new user, trigger an email to the developers.
    5. Update the list in the database/file with the current list of users.

    This method will give you the greatest level of flexibility depending on your needs. Another way to achieve the same result would be to use Power Automate to monitor the group and send an email when a new member is added. This does not require any code and can be setup directly in the Power Automate UI. Read more on how to create a flow in Power Automate from this page.

    0 comments No comments