SCENARIO 06 OAuth2 Graph API Python

OAuth2 API Integration

Manual identity risk reporting was consuming 4–6 hours per week and producing inconsistent results. Three automated Graph API reports were built using the OAuth2 client credentials flow — reducing reporting time from hours to under 5 minutes and surfacing 1,096 users without MFA registration.

OAuth2 Client Credentials Graph API Python Postman App Registration Entra ID

Business Problem

IDSentinel Solutions' security team needed automated, scheduled reporting on the organization's identity risk posture. Manual reviews of Entra ID sign-in logs, MFA registration status, and guest account inventory were taking 4–6 hours per week and producing inconsistent results depending on who ran them.

The IAM team was tasked with building a programmatic solution using the Microsoft Graph API to automate identity risk reporting — replacing manual portal reviews with scheduled, consistent, exportable reports.

Risk

  • Manual reporting creates inconsistency and human error
  • No audit trail for when reports were run or who reviewed them
  • 4–6 hours per week of analyst time wasted on repeatable tasks
  • Delayed detection of MFA gaps and stale guest accounts
  • No programmatic access to identity data for downstream SIEM integration

Scope — Reports Automated

#ReportGraph API Endpoint
1MFA Registration Reportbeta/reports/credentialUserRegistrationDetails
2Guest Account Inventoryv1.0/users?$filter=userType eq 'Guest'
3Sign-in Risk Reportv1.0/identityProtection/riskyUsers

Solution Design

Authentication uses the OAuth2 Client Credentials flow — a service principal authenticates directly to Entra ID without user interaction, making it suitable for automated/scheduled execution.

  • Step 1App registration created in Entra ID with least-privilege API permissions
  • Step 2Client credentials (Client ID + Secret) used to obtain access token from token endpoint
  • Step 3Bearer token passed in Authorization header for all Graph API requests
  • Step 4Reports exported as timestamped CSV files for downstream consumption and compliance documentation

Implementation

  • 01

    Create App Registration in Entra ID

    App registration created with least-privilege API permissions: Reports.Read.All, User.Read.All, IdentityRiskyUser.Read.All. Client secret generated for service principal authentication.

  • 02

    Test OAuth2 Token Request in Postman

    Token request validated in Postman against the Entra token endpoint using client_id, client_secret, and grant_type=client_credentials. Access token returned and confirmed valid.

  • 03

    Call Graph API Endpoints in Postman

    All three report endpoints tested individually with the Bearer access token before scripting:

    MFA Registration Report
    GET https://graph.microsoft.com/beta/reports/credentialUserRegistrationDetails
    Guest Account Inventory
    GET https://graph.microsoft.com/v1.0/users?$filter=userType eq 'Guest'
    Risky Users Report
    GET https://graph.microsoft.com/v1.0/identityProtection/riskyUsers
  • 04

    Python Automation Script

    Python script built to authenticate via client credentials, call all three Graph API endpoints, and export results as timestamped CSV files. Solution is schedulable via Task Scheduler for fully automated execution.

Outcome

App registration created with least-privilege API permissions — no over-privileged service account
OAuth2 client credentials flow validated end-to-end in Postman before scripting
3 identity risk reports automated — MFA gaps, guest inventory, risky users
Reporting time reduced from 4–6 hours to under 5 minutes
1,096 users without MFA detected — finding directly informed the Zero Trust Rollout in Scenario 04
Timestamped CSV exports provide consistent audit trail for compliance documentation

Files

  • scripts/Get-IdentityRiskReport.pyPython script — OAuth2 auth + all three Graph API reports + CSV export
  • postman/IDSentinel-GraphAPI.postman_collection.jsonPostman collection with 4 API requests (token + 3 reports)
  • diagrams/oauth2-flow.pngOAuth2 client credentials flow diagram
  • screenshots/Evidence of implementation — app registration, Postman token/report responses, Python output, CSV exports