🧹 improve user resource handling in Microsoft 365 (#4518)

* 🧹 improve user handling in ms 365

- new init for `microsoft.user`
- `micosoft.group.members` returns human users
- `microsoft.application.owner` returns all application owner

* Update providers/ms365/resources/ms365.lr.manifest.yaml

Co-authored-by: Tim Smith <[email protected]>

* Apply suggestions from code review

Co-authored-by: Preslav Gerchev <[email protected]>

* 🧹 apply changes from code review

---------

Co-authored-by: Tim Smith <[email protected]>
Co-authored-by: Preslav Gerchev <[email protected]>

providers/ms365/resources/applications.go

@@ -27,7 +27,12 @@ func (a *mqlMicrosoft) applications() ([]interface{}, error) {
 		return nil, err
 	}
 	ctx := context.Background()
-	resp, err := graphClient.Applications().Get(ctx, &applications.ApplicationsRequestBuilderGetRequestConfiguration{})
+	top := int32(999)
+	resp, err := graphClient.Applications().Get(ctx, &applications.ApplicationsRequestBuilderGetRequestConfiguration{
+		QueryParameters: &applications.ApplicationsRequestBuilderGetQueryParameters{
+			Top: &top,
+		},
+	})
 	if err != nil {
 		return nil, transformError(err)
 	}
@@ -46,7 +51,7 @@ func (a *mqlMicrosoft) applications() ([]interface{}, error) {
 }
 
 func initMicrosoftApplication(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error) {
-	// we only look up the package, if we have been supplied by its name and nothing else
+	// we only look up the application if we have been supplied by its name and nothing else
 	raw, ok := args["name"]
 	if !ok || len(args) != 1 {
 		return args, nil, nil
@@ -114,6 +119,57 @@ func (a *mqlMicrosoftApplication) hasExpiredCredentials() (bool, error) {
 	return false, nil
 }
 
+func (a *mqlMicrosoftApplication) owners() ([]interface{}, error) {
+	conn := a.MqlRuntime.Connection.(*connection.Ms365Connection)
+
+	msResource, err := a.MqlRuntime.CreateResource(a.MqlRuntime, "microsoft", map[string]*llx.RawData{})
+	if err != nil {
+		return nil, err
+	}
+	mqlMicrsoftResource := msResource.(*mqlMicrosoft)
+
+	graphClient, err := conn.GraphClient()
+	if err != nil {
+		return nil, err
+	}
+
+	ctx := context.Background()
+	resp, err := graphClient.Applications().ByApplicationId(a.GetId().Data).Owners().Get(ctx, &applications.ItemOwnersRequestBuilderGetRequestConfiguration{
+		QueryParameters: &applications.ItemOwnersRequestBuilderGetQueryParameters{
+			Select: []string{"id"},
+		},
+	})
+	if err != nil {
+		return nil, transformError(err)
+	}
+
+	res := []interface{}{}
+	for i := range resp.GetValue() {
+		ownerId := resp.GetValue()[i].GetId()
+		if ownerId == nil {
+			continue
+		}
+
+		// if the user is already indexed, we can reuse it
+		userResource, ok := mqlMicrsoftResource.userById(*ownerId)
+		if ok {
+			res = append(res, userResource)
+			continue
+		}
+
+		// otherwise we create a new user resource
+		newUserResource, err := a.MqlRuntime.NewResource(a.MqlRuntime, "microsoft.user", map[string]*llx.RawData{
+			"id": llx.StringDataPtr(ownerId),
+		})
+		if err != nil {
+			return nil, err
+		}
+		mqlMicrsoftResource.index(newUserResource.(*mqlMicrosoftUser))
+		res = append(res, newUserResource)
+	}
+	return res, nil
+}
+
 // newMqlMicrosoftApplication creates a new mqlMicrosoftApplication resource
 func newMqlMicrosoftApplication(runtime *plugin.Runtime, app models.Applicationable) (*mqlMicrosoftApplication, error) {
 	info, _ := convert.JsonToDictSlice(app.GetInfo())

providers/ms365/resources/groups.go

@@ -5,11 +5,8 @@ package resources
 
 import (
 	"context"
-	"errors"
-
 	"github.com/microsoftgraph/msgraph-sdk-go/groups"
 	"github.com/microsoftgraph/msgraph-sdk-go/models"
-
 	"go.mondoo.com/cnquery/v11/llx"
 	"go.mondoo.com/cnquery/v11/providers/ms365/connection"
 	"go.mondoo.com/cnquery/v11/types"
@@ -20,7 +17,59 @@ func (m *mqlMicrosoftGroup) id() (string, error) {
 }
 
 func (a *mqlMicrosoftGroup) members() ([]interface{}, error) {
-	return nil, errors.New("not implemented")
+	msResource, err := a.MqlRuntime.CreateResource(a.MqlRuntime, "microsoft", map[string]*llx.RawData{})
+	if err != nil {
+		return nil, err
+	}
+	mqlMicrosoftResource := msResource.(*mqlMicrosoft)
+
+	groupId := a.Id.Data
+	conn := a.MqlRuntime.Connection.(*connection.Ms365Connection)
+	graphClient, err := conn.GraphClient()
+	if err != nil {
+		return nil, err
+	}
+	top := int32(200)
+
+	queryParams := &groups.ItemMembersRequestBuilderGetQueryParameters{
+		Top: &top,
+	}
+	ctx := context.Background()
+	resp, err := graphClient.Groups().ByGroupId(groupId).Members().Get(ctx, &groups.ItemMembersRequestBuilderGetRequestConfiguration{
+		QueryParameters: queryParams,
+	})
+	if err != nil {
+		return nil, transformError(err)
+	}
+
+	res := []interface{}{}
+	for _, member := range resp.GetValue() {
+		memberId := member.GetId()
+		if memberId == nil {
+			continue
+		}
+
+		if member.GetOdataType() != nil && *member.GetOdataType() != "#microsoft.graph.user" {
+			continue
+		}
+
+		// if the user is already indexed, we can reuse it
+		userResource, ok := mqlMicrosoftResource.userById(*memberId)
+		if ok {
+			res = append(res, userResource)
+			continue
+		}
+
+		newUserResource, err := a.MqlRuntime.NewResource(a.MqlRuntime, "microsoft.user", map[string]*llx.RawData{
+			"id": llx.StringDataPtr(memberId),
+		})
+		if err != nil {
+			return nil, err
+		}
+		mqlMicrosoftResource.index(newUserResource.(*mqlMicrosoftUser))
+		res = append(res, newUserResource)
+	}
+	return res, nil
 }
 
 func (a *mqlMicrosoft) groups() ([]interface{}, error) {

providers/ms365/resources/microsoft.go

@@ -10,6 +10,35 @@ import (
 	"go.mondoo.com/cnquery/v11/providers/ms365/connection"
 )
 
+type mqlMicrosoftInternal struct {
+	// index users by id
+	idxUsersById map[string]*mqlMicrosoftUser
+}
+
+// initIndex ensures the user indexes are initialized,
+// can be called multiple times without side effects
+func (a *mqlMicrosoft) initIndex() {
+	if a.idxUsersById == nil {
+		a.idxUsersById = make(map[string]*mqlMicrosoftUser)
+	}
+}
+
+// index adds a user to the internal indexes
+func (a *mqlMicrosoft) index(user *mqlMicrosoftUser) {
+	a.initIndex()
+	a.idxUsersById[user.Id.Data] = user
+}
+
+// userById returns a user by id if it exists in the index
+func (a *mqlMicrosoft) userById(id string) (*mqlMicrosoftUser, bool) {
+	if a.idxUsersById == nil {
+		return nil, false
+	}
+
+	res, ok := a.idxUsersById[id]
+	return res, ok
+}
+
 func (a *mqlMicrosoft) tenantDomainName() (string, error) {
 	conn := a.MqlRuntime.Connection.(*connection.Ms365Connection)
 	graphClient, err := conn.GraphClient()

providers/ms365/resources/ms365.lr

@@ -42,8 +42,8 @@ private microsoft.organization @defaults("displayName") {
   onPremisesSyncEnabled bool
 }
 
-// Microsoft user
-private microsoft.user @defaults("id displayName mail") {
+// Microsoft Entra ID user
+private microsoft.user @defaults("id displayName userPrincipalName") {
   // User ID
   id string
   // Whether the user account is enabled
@@ -197,6 +197,8 @@ microsoft.application @defaults("id displayName hasExpiredCredentials") {
   certificates []microsoft.keyCredential
   // Whether the credentials have expired
   hasExpiredCredentials() bool
+  // Application owner
+  owners() []microsoft.user
 }
 
 // Microsoft Entra AD Application certificate

providers/ms365/resources/ms365.lr.manifest.yaml

@@ -37,6 +37,8 @@ resources:
         min_mondoo_version: 9.0.0
       notes:
         min_mondoo_version: 9.0.0
+      owners:
+        min_mondoo_version: 9.0.0
       publisherDomain: {}
       secrets:
         min_mondoo_version: 9.0.0