@pnp/cli-microsoft365 6.9.0-beta.289ab69 → 6.9.0-beta.3158148

package/docs/docs/cmd/tenant/security/security-alerts-list.mdx

@@ -0,0 +1,172 @@
+import Global from '/docs/cmd/_global.mdx';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# tenant security alerts list
+
+Gets the security alerts for a tenant
+
+## Usage
+
+```sh
+m365 tenant security alerts list [options]
+```
+
+## Options
+
+```md definition-list
+`--vendor [vendor]`
+: The vendor to return alerts for. Possible values `Azure Advanced Threat Protection`, `Azure Security Center`, `Microsoft Cloud App Security`, `Azure Active Directory Identity Protection`, `Azure Sentinel`, `Microsoft Defender ATP`. If omitted, all alerts are returned
+```
+
+<Global />
+
+## Examples
+
+Get all security alerts for a tenant
+
+```sh
+m365 tenant security alerts list
+```
+
+Get security alerts for a vendor with name _Azure Sentinel_
+
+```sh
+m365 tenant security alerts list --vendor "Azure Sentinel"
+```
+
+## Response
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  [
+    {
+        "id": "2517536653831539999_658fa695-a5e6-4b60-ac7c-b2c1396df384",
+        "azureTenantId": "b8e1599d-b418-4be9-8f39-df03c3abe27a",
+        "azureSubscriptionId": "ee390228-e284-4e54-a464-d693a1d55540",
+        "riskScore": null,
+        "tags": [],
+        "activityGroupName": null,
+        "assignedTo": null,
+        "category": "Storage.Blob_GeoAnomaly",
+        "closedDateTime": null,
+        "comments": [],
+        "confidence": null,
+        "createdDateTime": "2022-03-30T13:19:15.8039138Z",
+        "description": "Someone has accessed your Azure Storage account 'westeuropegivcekj' from an unusual location.",
+        "detectionIds": [],
+        "eventDateTime": "2022-03-30T10:16:56.846Z",
+        "feedback": null,
+        "incidentIds": [],
+        "lastEventDateTime": null,
+        "lastModifiedDateTime": "2022-03-30T13:19:48.5196488Z",
+        "recommendedActions": [
+          "• Limit access to your storage account, following the 'least privilege' principle: https://go.microsoft.com/fwlink/?linkid=2187303.• Consider using identity-based authentication: https://go.microsoft.com/fwlink/?linkid=2187202.• Consider rotating the storage account access keys and ensure that your access tokens are only shared with authorized users.• Ensure that storage access tokens are stored in a secured location such as Azure Key Vault. Avoid storing or sharing storage access tokens in source code, documentation, and email."
+        ],
+        "severity": "low",
+        "sourceMaterials": [
+          "https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517536653831539999_658fa695-a5e6-4b60-ac7c-b2c1396df384/subscriptionId/bbdf91d0-d75b-430e-b738-2c525452144f/resourceGroup/managed-rg-purview-mip-poc/referencedFrom/alertDeepLink/location/westeurope"
+        ],
+        "status": "newAlert",
+        "title": "Access from an unusual location to a storage blob container",
+        "CustomProperties": "[\"{\\\"Alert Id\\\":\\\"658fa695-a5e6-4b60-ac7c-b2c1396df384\\\",\\\"Azure AD user\\\":\\\"N/A (Azure AD user authentication was not used)\\\",\\\"User agent\\\":\\\"Azure-Storage/9.3.0 (.NET Core)\\\",\\\"API type\\\":\\\"Blob\\\",\\\"Client location\\\":\\\"Dublin, Ireland\\\",\\\"Authentication type\\\":\\\"Shared access signature (SAS)\\\",\\\"Investigation steps\\\":\\\"{\\\\\\\"displayValue\\\\\\\":\\\\\\\"View related storage activity using Storage Analytics Logging. See how to configure Storage Analytics logging and more information\\\\\\\",\\\\\\\"kind\\\\\\\":\\\\\\\"Link\\\\\\\",\\\\\\\"value\\\\\\\":\\\\\\\"https:\\\\\\\\/\\\\\\\\/go.microsoft.com\\\\\\\\/fwlink\\\\\\\\/?linkid=2075734\\\\\\\"}\\\",\\\"Operations types\\\":\\\"GetBlob\\\",\\\"Service type\\\":\\\"Azure Blobs\\\",\\\"Container\\\":\\\"temporary\\\",\\\"Potential causes\\\":\\\"This alert indicates that this account has been accessed successfully from an IP address that is unfamiliar and unexpected compared to recent access pattern on this account.\\\\\\Potential causes:\\\\\\• An attacker has accessed your storage account.\\\\\\• A legitimate user has accessed your storage account from a new location.\\\",\\\"resourceType\\\":\\\"Storage\\\",\\\"ReportingSystem\\\":\\\"Azure\\\"}\",\"\\\"InitialAccess\\\"\"]",
+        "vendorInformation": {
+          "provider": "ASC",
+          "providerVersion": null,
+          "subProvider": "StorageThreatDetection",
+          "vendor": "Microsoft"
+        },
+        "alertDetections": [],
+        "cloudAppStates": [],
+        "fileStates": [],
+        "hostStates": [],
+        "historyStates": [],
+        "investigationSecurityStates": [],
+        "malwareStates": [],
+        "messageSecurityStates": [],
+        "networkConnections": [
+          {
+            "applicationName": null,
+            "destinationAddress": null,
+            "destinationDomain": null,
+            "destinationLocation": null,
+            "destinationPort": null,
+            "destinationUrl": null,
+            "direction": null,
+            "domainRegisteredDateTime": null,
+            "localDnsName": null,
+            "natDestinationAddress": null,
+            "natDestinationPort": null,
+            "natSourceAddress": null,
+            "natSourcePort": null,
+            "protocol": "tcp",
+            "riskScore": null,
+            "sourceAddress": "52.214.204.49",
+            "sourceLocation": "Dublin, Dublin, IE",
+            "sourcePort": null,
+            "status": null,
+            "urlParameters": null
+          }
+        ],
+        "processes": [],
+        "registryKeyStates": [],
+        "securityResources": [
+          {
+            "resource": "/subscriptions/bbdf91d0-d75b-430e-b738-2c525452144f/resourceGroups/managed-rg-purview-mip-poc/providers/Microsoft.Storage/storageAccounts/scanwesteuropegivcebj",
+            "resourceType": "attacked"
+          }
+        ],
+        "triggers": [],
+        "userStates": [],
+        "uriClickSecurityStates": [],
+        "vulnerabilityStates": []
+      }
+  ]
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  id                                   title                      severity
+  ------------------------------------ -------------------------- --------
+  4ece2cf8-cbc0-5a42-92c3-e23f96006907 SharePoint Bulk Edit Items medium
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  id,title,severity
+  4ece2cf8-cbc0-5a42-92c3-e23f96006907,SharePoint Bulk Edit Items,medium
+  ```
+
+  </TabItem>
+  <TabItem value="Markdown">
+
+  ```md
+  # tenant security alerts list
+
+  Date: 3/20/2022
+
+  ## Unfamiliar sign-in properties (2517536653831539999_658fa695-a5e6-4b60-ac7c-b2c1396df384)
+
+  Property | Value
+  ---------|-------
+  id | 2517536653831539999_658fa695-a5e6-4b60-ac7c-b2c1396df384
+  azureTenantId | b8e1599d-b418-4be9-8f39-df03c3abe27a
+  category | Storage.Blob_GeoAnomaly
+  createdDateTime | 2022-03-30T13:19:15.8039138Z
+  description | The following properties of this sign-in are unfamiliar for the given user: ASN, Browser, Device, IP, Location, EASId, TenantIPsubnet
+  eventDateTime | 2022-03-30T10:16:56.846Z
+  lastModifiedDateTime | 2022-03-30T13:19:48.5196488Z
+  severity | low
+  status | newAlert
+  title | Access from an unusual location to a storage blob container
+  ```
+
+  </TabItem>
+</Tabs>
+

package/docs/docs/cmd/tenant/serviceannouncement/serviceannouncement-health-get.mdx

@@ -0,0 +1,173 @@
+import Global from '/docs/cmd/_global.mdx';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# tenant serviceannouncement health get
+
+Get the health report of a specified service for a tenant
+
+## Usage
+
+```sh
+m365 tenant serviceannouncement health get [options]
+```
+
+## Options
+
+```md definition-list
+`-s, --serviceName <serviceName>`
+: The service name to retrieve the health report for.
+
+`-i, --issues`
+: Return the collection of issues that happened on the service, with detailed information for each issue. Is only returned in JSON output mode.
+```
+
+<Global />
+
+## Examples
+
+Get the health report for the service _Exchange Online_
+
+```sh
+m365 tenant serviceannouncement health get --serviceName "Exchange Online"
+```
+
+Get the health report for the service _Exchange Online_ including the issues of the service
+
+```sh
+m365 tenant serviceannouncement health get --serviceName "Exchange Online" --issues
+```
+
+## Response
+
+### Standard response
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  {
+    "service": "Exchange Online",
+    "status": "serviceDegradation",
+    "id": "Exchange"
+  }
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  id     : Exchange
+  service: Exchange Online
+  status : serviceDegradation
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  id,status,service
+  Exchange,serviceDegradation,Exchange Online
+  ```
+
+  </TabItem>
+  <TabItem value="Markdown">
+
+  ```md
+  # tenant serviceannouncement health get --serviceName "Exchange Online"
+
+  Date: 4/19/2023
+
+  ## Exchange
+
+  Property | Value
+  ---------|-------
+  service | Exchange Online
+  status | serviceDegradation
+  id | Exchange
+  ```
+
+  </TabItem>
+</Tabs>
+
+### `issues` response
+
+When we make use of the option `issues` the response will differ.
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  {
+    "service": "Exchange Online",
+    "status": "serviceDegradation",
+    "id": "Exchange",
+    "issues": [
+      {
+        "startDateTime": "2022-08-17T18:27:00Z",
+        "endDateTime": "2022-08-18T16:06:18Z",
+        "lastModifiedDateTime": "2022-08-18T16:46:04.133Z",
+        "title": "AdminsÔÇÖ downloaded CSV mailbox usage reports via Microsoft 365 admin center donÔÇÖt contain data prior to August 1, 2022",
+        "id": "EX415080",
+        "impactDescription": "AdminsÔÇÖ downloaded CSV mailbox usage reports via Microsoft 365 admin center didn't contain data prior to August 1, 2022.",
+        "classification": "advisory",
+        "origin": "microsoft",
+        "status": "serviceRestored",
+        "service": "Exchange Online",
+        "feature": "Windows Live sign-in issue",
+        "featureGroup": "Sign-in",
+        "isResolved": true,
+        "highImpact": null,
+        "details": [],
+        "posts": [
+          {
+            "createdDateTime": "2022-08-17T18:34:54.95Z",
+            "postType": "regular",
+            "description": {
+              "contentType": "html",
+              "content": "Title: AdminsÔÇÖ downloaded CSV mailbox usage reports via Microsoft 365 admin center donÔÇÖt contain data prior to August 1, 2022\\\n\nUser impact: AdminsÔÇÖ downloaded CSV mailbox usage reports via Microsoft 365 admin center donÔÇÖt contain data prior to August 1, 2022.\\\n\nCurrent status: We're investigating a potential issue and checking for impact to your organization. We'll provide an update within 30 minutes."
+            }
+          }
+        ]
+      }
+    ]
+  }
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  id          status              service
+  ----------  ------------------  -----------------
+  Exchange    serviceDegradation  Exchange Online
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  id,status,service
+  Exchange,serviceDegradation,Exchange Online
+  ```
+
+  </TabItem>
+  <TabItem value="Markdown">
+
+  ```md
+  # tenant serviceannouncement health get --serviceName "Exchange Online" --issues "true"
+
+  Date: 4/19/2023
+
+  ## Exchange
+
+  Property | Value
+  ---------|-------
+  service | Exchange Online
+  status | serviceDegradation
+  id | Exchange
+  ```
+
+  </TabItem>
+</Tabs>
+

package/docs/docs/cmd/tenant/serviceannouncement/serviceannouncement-health-list.mdx

@@ -0,0 +1,174 @@
+import Global from '/docs/cmd/_global.mdx';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# tenant serviceannouncement health list
+
+Gets the health report of all subscribed services for a tenant
+
+## Usage
+
+```sh
+m365 tenant serviceannouncement health list [options]
+```
+
+## Options
+
+```md definition-list
+`-i, --issues`
+: Return the collection of issues that happened on the service, with detailed information for each issue. Is only returned in JSON output mode.
+```
+
+<Global />
+
+## Examples
+
+Get the health report of all subscribed services for a tenant
+
+```sh
+m365 tenant serviceannouncement health list
+```
+
+Get the health report of all subscribed services for a tenant including the issues that happend on each service
+
+```sh
+m365 tenant serviceannouncement health list --issues
+```
+
+## Response
+
+### Standard response
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  [
+    {
+      "service": "Exchange Online",
+      "status": "serviceDegradation",
+      "id": "Exchange"
+    }
+  ]
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  id          status              service
+  ----------  ------------------  -----------------
+  Exchange    serviceDegradation  Exchange Online
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  id,status,service
+  Exchange,serviceDegradation,Exchange Online
+  ```
+
+  </TabItem>
+  <TabItem value="Markdown">
+
+  ```md
+  # tenant serviceannouncement health list
+
+  Date: 4/19/2023
+
+  ## Exchange
+
+  Property | Value
+  ---------|-------
+  service | Exchange Online
+  status | serviceDegradation
+  id | Exchange
+  ```
+
+  </TabItem>
+</Tabs>
+
+### `issues` response
+
+When we make use of the option `issues` the response will differ.
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  [
+    {
+      "service": "Microsoft Defender for Cloud Apps",
+      "status": "serviceOperational",
+      "id": "cloudappsecurity",
+      "issues": [
+        {
+          "startDateTime": "2022-05-13T00:00:00Z",
+          "endDateTime": "2022-05-16T13:10:00Z",
+          "lastModifiedDateTime": "2022-05-17T11:00:42.2Z",
+          "title": "Microsoft Defender for Cloud Apps admin panel changes not propagating to Microsoft Defender for Endpoint",
+          "id": "CS381143",
+          "impactDescription": "Admins may notice that Microsoft Defender for Cloud Apps admin panel changes did not propagate to Microsoft Defender for",
+          "classification": "advisory",
+          "origin": "microsoft",
+          "status": "serviceRestored",
+          "service": "Microsoft Defender for Cloud Apps",
+          "feature": "Cloud App Security",
+          "featureGroup": "Cloud App Security",
+          "isResolved": true,
+          "highImpact": null,
+          "details": [],
+          "posts": [
+            {
+              "createdDateTime": "2022-05-17T08:31:31.113Z",
+              "postType": "regular",
+              "description": {
+                "contentType": "html",
+                "content": "Title: Microsoft Defender for Cloud Apps admin panel changes not propagating to Microsoft Defender for Endpoint\\\n\nUser Impact: Admins may notice that Microsoft Defender for Cloud Apps admin panel changes do not propagate to Microsoft Defender for Endpoint.\\\n\nCurrent status: We're analyzing system logs to determine the source of the issue.\\\n\nScope of impact: Impact is specific to users who are served through the affected infrastructure.\\\n\nNext update by: Tuesday, May 17, 2022, at 10:30 AM UTC"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  id          status              service
+  ----------  ------------------  -----------------
+  Exchange    serviceDegradation  Exchange Online
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  id,status,service
+  Exchange,serviceDegradation,Exchange Online
+  ```
+
+  </TabItem>
+  <TabItem value="Markdown">
+
+  ```md
+  # tenant serviceannouncement health list --issues "true"
+
+  Date: 4/19/2023
+
+  ## Exchange
+
+  Property | Value
+  ---------|-------
+  service | Exchange Online
+  status | serviceDegradation
+  id | Exchange
+  ```
+
+  </TabItem>
+</Tabs>
+

package/docs/docs/cmd/tenant/serviceannouncement/serviceannouncement-healthissue-get.mdx

@@ -0,0 +1,126 @@
+import Global from '/docs/cmd/_global.mdx';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# tenant serviceannouncement healthissue get
+
+Gets a specified service health issue for tenant.
+
+## Usage
+
+```sh
+m365 tenant serviceannouncement healthissue get [options]
+```
+
+## Options
+
+```md definition-list
+`-i, --id <id>`
+: The issue id to get details for
+```
+
+<Global />
+
+## Examples
+
+Gets information about issue with ID _MO226784_
+
+```sh
+m365 tenant serviceannouncement healthissue get --id MO226784
+```
+
+## Response
+
+<Tabs>
+  <TabItem value="JSON">
+
+  ```json
+  {
+    "startDateTime": "2022-05-24T16:00:00Z",
+    "endDateTime": "2022-05-24T22:20:00Z",
+    "lastModifiedDateTime": "2022-05-24T22:27:18.63Z",
+    "title": "Installation delays within the Power Platform admin center",
+    "id": "CR384241",
+    "impactDescription": "Users may have experienced delays when installing applications within the Power Platform admin center.",
+    "classification": "advisory",
+    "origin": "microsoft",
+    "status": "serviceRestored",
+    "service": "Dynamics 365 Apps",
+    "feature": "Other",
+    "featureGroup": "Other",
+    "isResolved": true,
+    "highImpact": null,
+    "details": [],
+    "posts": [
+      {
+        "createdDateTime": "2022-05-24T21:22:56.817Z",
+        "postType": "regular",
+        "description": {
+          "contentType": "html",
+          "content": "Title: Installation delays within the Power Platform admin center\\\n\nUser Impact: Users may experience delays when installing applications within the Power Platform admin center.\\\n\nWe are aware of an emerging issue where users are experiencing delays when installing applications through the Power Platform admin center. We are investigating the issue and will provide another update within the next 30 minutes.\\\n\nThis information is preliminary and may be subject to changes, corrections, and updates."
+        }
+      }
+    ]
+  }
+  ```
+
+  </TabItem>
+  <TabItem value="Text">
+
+  ```text
+  classification      : advisory
+  details             : []
+  endDateTime         : 2022-05-24T22:20:00Z
+  feature             : Other
+  featureGroup        : Other
+  highImpact          : null
+  id                  : CR384241
+  impactDescription   : Users may have experienced delays when installing applications within the Power Platform admin center.
+  isResolved          : true
+  lastModifiedDateTime: 2022-05-24T22:27:18.63Z
+  origin              : microsoft
+  posts               : [{"createdDateTime":"2022-05-24T21:22:56.817Z","postType":"regular","description":{"contentType":"html","content":"Title: Installation delays within the Power Platform admin center\n\nUser Impact: Users may experience delays when installing applications within the Power Platform admin center.\n\nWe are aware of an emerging issue where users are experiencing delays when installing applications through the Power Platform admin center. We are investigating the issue and will provide another update within the next 30 minutes.\n\nThis information is preliminary and may be subject to changes, corrections, and updates."}}]
+  service             : Dynamics 365 Apps
+  startDateTime       : 2022-05-24T16:00:00Z
+  status              : serviceRestored
+  title               : Installation delays within the Power Platform admin center
+  ```
+
+  </TabItem>
+  <TabItem value="CSV">
+
+  ```csv
+  startDateTime,endDateTime,lastModifiedDateTime,title,id,impactDescription,classification,origin,status,service,feature,featureGroup,isResolved,highImpact,details,posts
+  2022-05-24T16:00:00Z,2022-05-24T22:20:00Z,2022-05-24T22:27:18.63Z,Installation delays within the Power Platform admin center,CR384241,Users may have experienced delays when installing applications within the Power Platform admin center.,advisory,microsoft,serviceRestored,Dynamics 365 Apps,Other,Other,1,,[],"[{""createdDateTime"":""2022-05-24T21:22:56.817Z"",""postType"":""regular"",""description"":{""contentType"":""html"",""content"":""Title: Installation delays within the Power Platform admin center\n\nUser Impact: Users may experience delays when installing applications within the Power Platform admin center.\n\nWe are aware of an emerging issue where users are experiencing delays when installing applications through the Power Platform admin center. We are investigating the issue and will provide another update within the next 30 minutes.\n\nThis information is preliminary and may be subject to changes, corrections, and updates.""}}]"
+  ```
+
+  </TabItem>
+  <TabItem value="Markdown">
+
+  ```md
+  # tenant serviceannouncement healthissue get --id "MO226784"
+
+  Date: 5/24/2022
+
+  ## Installation delays within the Power Platform admin center (MO226784)
+
+  Property | Value
+  ---------|-------
+  startDateTime | 2022-05-24T16:00:00Z
+  endDateTime | 2022-05-24T22:20:00Z
+  lastModifiedDateTime | 2022-05-24T22:27:18.63Z
+  title | Installation delays within the Power Platform admin center
+  id | CR384241
+  impactDescription | Users may have experienced delays when installing applications within the Power Platform admin center.
+  classification | advisory
+  origin | microsoft
+  status | serviceRestored
+  service | Dynamics 365 Apps
+  feature | Other
+  featureGroup | Other
+  isResolved | true
+  ```
+
+  </TabItem>
+</Tabs>
+