Update-VIPUsers-Watchlist-from-AzureAD-Group cannot retrieve the full user list

[pixel559]

This refers to the playbook that can be found below:
https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Update-VIPUsers-Watchlist-from-AzureAD-Group
https://techcommunity.microsoft.com/blog/microsoftsentinelblog/update-microsoft-sentinel-vip-users-watchlist-from-azure-ad-group-using-playbook/3100184

This playbook is not working correctly for the Entra ID group with more than 100 users.
The VIP users list is not being updated correctly. The VIP group has over 300 members and on the logic app step for 'HTTP - Get VIP Azure AD Group Members' only 100 users is returned.

It looks like the API is returning only 100 results due to paging.
https://learn.microsoft.com/en-us/graph/paging?tabs=http
There is a '@odata.nextLink' in the result of the initial call and the API call needs to keep on being repeated as long as nextlink is available to retrieve all users from the group.

Please update the template to overcome the paging problem that leads to incomplete VIP User List.

[v-rusraut]

Hi @pixel559 , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

[v-shukore]

Hi @pixel559, we are working on this issue will update on this soon. Thanks!!

[v-shukore]

Hi @pixel559, could you please provide more information regarding this issue? Clarifying more details will help us to resolve it more effectively. Thanks!!

[v-shukore]

Hi @pixel559, we are waiting for your valuable feedback. Please Provide update on the same. Thanks!!

[pixel559]

Hi @v-shukore , could you please elaborate as to which details you need?
The playbook does not retrieve all the group members if there are more than 100 users. This is how the API works and there is a link to documentation in original description.

"HTTP_-Get_VIP_Azure_AD_Group_Members": {
"runAfter": {
"HTTP-_Get_Group_details": [
"Succeeded"
]
},
"type": "Http",
"inputs": {
"authentication": {
"audience": "https://graph.microsoft.com/",
"type": "ManagedServiceIdentity"
},
"method": "GET",
"uri": "https://graph.microsoft.com/v1.0/groups/@{variables('VIP Group ID')}/members"
}
}
This step, would only retrieve 100 results due to paging, therefore the watchlist would not be complete (if there are more than 100 members in the group).
In order to get the complete results, the step needs to keep on repeating as long as response returns '@odata.nextLink' with the link for the next batch of users that members of the group.

This and later steps need to be updated for the logic app to work correctly.

Please note, this request is open for over 2 month now, and only at this point the additional information is requested.

[v-shukore]

Hi @pixel559,
Thanks for your response.
We will investigate this issue and get back to you ASAP. Thanks!!

[pixel559]

Hello @v-shukore ,
Are there any updates?