Customer wants a report for when group membership changes would impact their Purview policies.

Output:

• Defender for Cloud Apps
• Entra Groups
• Purview
• Entra Application
• Defender XDR - Advanced Hunting

---

1. Navigate to Defender XDR > System > Settings > Cloud Apps > Connected Apps > App Connectors
2. Check Microsoft 365 then click Edit Settings

3. Check off all the boxes to get the data from Entra.

---

1. Navigate to Entra > App registrations > All Applications > New registration

Note: You want to use a pre-existing registered application, you will need to add/check the API permissions, Client Secret, Certificates

2. Copy Client ID and Tenant ID

3. Navigate to Cerificates & secrets > New Client Secret

4. Enter a description that is applicable to your organization and expiration per your customer requirements.

5. Copy Value

6. Navigate to Certificates > upload certificate

Note: I am using a certificate I generated off my laptop previously

7. Copy the Thumbprint

8. Navigate to API Permissions > Add a permission
9. Here are the permissions needed

Note: all permissions are application based not delegated

• Graph > Directory.Read.All
• Graph > ThreatHunting.Read.All
• Office 365 Exchange Online > Exchange.ManageAsAppV2

10. Grant Admin consent for your environment

1. Run the following command: Connect-ExchangeOnline

2. Run the following command: Get-MgServicePrincipal -Filter "appId eq '<APP_ID>'"

Replace APP_ID with Client ID from step 2 of Entra Application Requirements

3. Copy ID value
4. Run the following command: `New-ServicePrincipal -AppId "<APP_ID>" -ObjectId "<OBJECT_ID>" -DisplayName "Purview Automation App"'

Replace APP_ID with Client ID from step 2 of Entra Application Requirements and OBJECT_ID from step 3(ID Value).

5. Run the following command: Add-RoleGroupMember -Identity "Compliance Administrator" -Member "Purview Automation App"

---

1. Download PurviewPolicyImpactedbyGroupChanges
2. Open PurviewPolicyImpactedbyGroupChanges with your favorite script editor.

Note: I just use Notepad

3. At the top of the script you will see the Config section, change the values accordingly:

• $TenantId = Step 2 of Entra Application Requirements
• $ClientId = Step 2 of Entra Application Requirements
• $ClientSecret = Step 5 of Entra Application Requirements
• $Thumbprint = Step 7 of Entra Application Requirements
• $Organization = Navigate to Entra > Domain Names > Custom domain names > Find the domain name that looks like .onmicrosoft.com

4. Save script

You probably want to delete the word Template from the script.

5. Open a PowerShell window.
6. Run the script and your output should look like this:

You CSV should look like this:

Final note: since we are using certificate-based authentication, please remember to have the private key on the machine you are running this from.