scalio-m365 0.1.0__tar.gz

scalio_m365-0.1.0/PKG-INFO

@@ -0,0 +1,65 @@
+Metadata-Version: 2.4
+Name: scalio-m365
+Version: 0.1.0
+Summary: Scalio: write Microsoft 365 settings (Entra, SharePoint, Intune, Exchange) to a live tenant, shared by Foundry and Citadel
+License: Proprietary
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+
+# scalio-m365
+
+Shared code that writes Microsoft 365 settings to a live tenant («Scalio Schreiben»): one writer per
+Microsoft365DSC resource type (Entra ID, SharePoint, Intune, Exchange Online / Defender for Office 365), with the
+property names of the governance catalog (scalio-catalog). Foundry rolls baselines out with it, Citadel heals
+deviations. Decision: scalio-docs `concepts/m365-schreibpaket.md` (`m365pkg/P1`–`P4`), ADR 0089.
+
+Nothing in this package is secret and it holds no content: the baselines stay in the private repo
+`scalio_blueprint`, tokens and certificates stay in the app (scalio-tenant).
+
+## Use in an app
+
+```python
+import scalio_m365 as m365
+
+g = m365.Graph(call, exo, create=True)        # Foundry; Citadel: create=False (keeps existing objects only)
+reason = m365.why_not(type_, desired)          # Citadel: why_not(type_, desired, change_only=True)
+actual = await m365.read_one(g, type_, match)  # catalog names
+after = m365.fields(type_, {**(actual or {}), **desired})
+if not m365.same(actual, after):
+    await m365.kind(type_).write(g, actual, after)
+```
+
+- `call(method, path, body) -> dict`: one Microsoft Graph call (`path` relative to `/v1.0`, or a full
+  `@odata.nextLink`); raise on an error. `exo(cmdlet, parameters) -> list[dict]`: one cmdlet through the Exchange
+  admin API (`InvokeCommand`, app-only token). The app brings token, HTTP client and logging.
+- `WriteError`: the step cannot be written as asked (missing group, empty break-glass group, object missing,
+  no reviewer, no notification address); the text says what to do.
+- `SCOPES` (Graph permissions), `exchange.SCOPES`, `DIRECTORY_ROLES`, `READ_ALONG` and `needs(type_)`: what the
+  «Scalio Schreiben» registration needs.
+- Exchange in a fresh tenant: `exchange.prepare(g, is_dehydrated=..., customised_at=...)` runs
+  `Enable-OrganizationCustomization` once and says when to wait; the app stores the time.
+- `scalio_m365.mapping`: pure name mappings (Graph answer -> catalog names) for the apps' readers.
+- `scalio_m365.testing.FakeMicrosoft`: fake Graph and Exchange for the apps' tests.
+
+## Modes
+
+| | Foundry (`create=True`) | Citadel (`create=False`, `change_only=True`) |
+| --- | --- | --- |
+| Entra, SharePoint | creates or changes | creates or changes |
+| Intune policy missing | creates (compliance with a block action) | refuses: create it with its assignments first |
+| Exchange policy missing | Defender policies with a rule per accepted domain, DKIM | refuses |
+| Names of Intune/Exchange objects | set on create | never changed (`why_not` says so) |
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest && ruff check .
+```
+
+Release: bump `pyproject.toml` and `__version__`, reserve the version in scalio-docs `REGISTER.md`, run
+`tools/changelog.py --repo scalio-m365 release <version>` there, then «Freigeben» in the cockpit (workflow
+`publish.yml`, PyPI trusted publishing, environment `pypi`). Tags without `v`.

scalio_m365-0.1.0/README.md

@@ -0,0 +1,54 @@
+# scalio-m365
+
+Shared code that writes Microsoft 365 settings to a live tenant («Scalio Schreiben»): one writer per
+Microsoft365DSC resource type (Entra ID, SharePoint, Intune, Exchange Online / Defender for Office 365), with the
+property names of the governance catalog (scalio-catalog). Foundry rolls baselines out with it, Citadel heals
+deviations. Decision: scalio-docs `concepts/m365-schreibpaket.md` (`m365pkg/P1`–`P4`), ADR 0089.
+
+Nothing in this package is secret and it holds no content: the baselines stay in the private repo
+`scalio_blueprint`, tokens and certificates stay in the app (scalio-tenant).
+
+## Use in an app
+
+```python
+import scalio_m365 as m365
+
+g = m365.Graph(call, exo, create=True)        # Foundry; Citadel: create=False (keeps existing objects only)
+reason = m365.why_not(type_, desired)          # Citadel: why_not(type_, desired, change_only=True)
+actual = await m365.read_one(g, type_, match)  # catalog names
+after = m365.fields(type_, {**(actual or {}), **desired})
+if not m365.same(actual, after):
+    await m365.kind(type_).write(g, actual, after)
+```
+
+- `call(method, path, body) -> dict`: one Microsoft Graph call (`path` relative to `/v1.0`, or a full
+  `@odata.nextLink`); raise on an error. `exo(cmdlet, parameters) -> list[dict]`: one cmdlet through the Exchange
+  admin API (`InvokeCommand`, app-only token). The app brings token, HTTP client and logging.
+- `WriteError`: the step cannot be written as asked (missing group, empty break-glass group, object missing,
+  no reviewer, no notification address); the text says what to do.
+- `SCOPES` (Graph permissions), `exchange.SCOPES`, `DIRECTORY_ROLES`, `READ_ALONG` and `needs(type_)`: what the
+  «Scalio Schreiben» registration needs.
+- Exchange in a fresh tenant: `exchange.prepare(g, is_dehydrated=..., customised_at=...)` runs
+  `Enable-OrganizationCustomization` once and says when to wait; the app stores the time.
+- `scalio_m365.mapping`: pure name mappings (Graph answer -> catalog names) for the apps' readers.
+- `scalio_m365.testing.FakeMicrosoft`: fake Graph and Exchange for the apps' tests.
+
+## Modes
+
+| | Foundry (`create=True`) | Citadel (`create=False`, `change_only=True`) |
+| --- | --- | --- |
+| Entra, SharePoint | creates or changes | creates or changes |
+| Intune policy missing | creates (compliance with a block action) | refuses: create it with its assignments first |
+| Exchange policy missing | Defender policies with a rule per accepted domain, DKIM | refuses |
+| Names of Intune/Exchange objects | set on create | never changed (`why_not` says so) |
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest && ruff check .
+```
+
+Release: bump `pyproject.toml` and `__version__`, reserve the version in scalio-docs `REGISTER.md`, run
+`tools/changelog.py --repo scalio-m365 release <version>` there, then «Freigeben» in the cockpit (workflow
+`publish.yml`, PyPI trusted publishing, environment `pypi`). Tags without `v`.

scalio_m365-0.1.0/pyproject.toml

@@ -0,0 +1,28 @@
+[build-system]
+requires = ["setuptools>=69"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "scalio-m365"
+version = "0.1.0"
+description = "Scalio: write Microsoft 365 settings (Entra, SharePoint, Intune, Exchange) to a live tenant, shared by Foundry and Citadel"
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "Proprietary" }
+dependencies = []
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "ruff>=0.6"]
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+
+[tool.ruff]
+line-length = 120
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "B"]

scalio_m365-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

scalio_m365-0.1.0/src/scalio_m365/__init__.py

@@ -0,0 +1,34 @@
+"""Writing Microsoft 365 settings to a live tenant («Scalio Schreiben»), shared by Foundry and Citadel.
+
+One writer per Microsoft365DSC resource type, with the catalog's property names (scalio-catalog). Foundry rolls
+baselines out (`Graph(create=True)`), Citadel heals deviations of existing objects (`Graph(create=False)` and
+`why_not(..., change_only=True)`). The apps bring the transport and keep their shells (rollout, healing, log).
+Decision: scalio-docs concepts/m365-schreibpaket.md (m365pkg/P1-P4), ADR 0089.
+"""
+from . import entra, exchange, intune, mapping, sharepoint
+from .graph import Graph, WriteError
+from .table import (
+                    ALL_SCOPES,
+                    DIRECTORY_ROLES,
+                    READ_ALONG,
+                    SCOPES,
+                    WRITERS,
+                    Kind,
+                    creates,
+                    fields,
+                    is_exchange,
+                    kind,
+                    matches,
+                    needs,
+                    read_one,
+                    same,
+                    why_not,
+)
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "ALL_SCOPES", "DIRECTORY_ROLES", "READ_ALONG", "SCOPES", "WRITERS", "Graph", "Kind", "WriteError", "creates",
+    "entra", "exchange", "fields", "intune", "is_exchange", "kind", "mapping", "matches", "needs", "read_one", "same",
+    "sharepoint", "why_not",
+]

scalio_m365-0.1.0/src/scalio_m365/entra.py

@@ -0,0 +1,416 @@
+"""Entra ID writers through Microsoft Graph: conditional access, authorization policy, authentication methods, admin
+consent workflow, Microsoft 365 group settings and group expiration.
+
+Every writer has a reader that answers with the catalog's property names, so `same()` can compare both sides.
+"""
+from __future__ import annotations
+
+from typing import Any
+
+from .graph import Graph, WriteError
+from .mapping import (
+    GUEST_ROLES,
+    LOCATION_WORDS,
+    REVIEWER_GROUP,
+    ca_extra,
+    changed,
+    consent_reviewers,
+    feature_settings,
+    group_query,
+    lower,
+    norm,
+    upper,
+)
+
+# ------------------------------------------------------------------ conditional access
+
+CA_PATH = "/identity/conditionalAccess/policies"
+CA_FIELDS = frozenset({
+    "DisplayName", "Id", "State", "IncludeApplications", "ExcludeApplications", "IncludeUserActions",
+    "IncludeUsers", "ExcludeUsers", "IncludeGroups", "ExcludeGroups", "IncludeRoles", "ExcludeRoles",
+    "IncludePlatforms", "ExcludePlatforms", "IncludeLocations", "ExcludeLocations", "ClientAppTypes",
+    "UserRiskLevels", "SignInRiskLevels", "TransferMethods", "GrantControlOperator", "BuiltInControls",
+    "AuthenticationStrength", "SignInFrequencyIsEnabled", "SignInFrequencyValue", "SignInFrequencyType",
+    "PersistentBrowserIsEnabled", "PersistentBrowserMode",
+    "IncludeGuestOrExternalUserTypes", "ExcludeGuestOrExternalUserTypes", "ContinuousAccessEvaluationMode",
+    "ApplicationEnforcedRestrictionsIsEnabled", "SignInFrequencyInterval"})
+
+
+def _guests(types) -> dict | None:
+    if not types:
+        return None
+    return {"guestOrExternalUserTypes": ",".join(types),
+            "externalTenants": {"@odata.type": "#microsoft.graph.conditionalAccessAllExternalTenants",
+                                "membershipKind": "all"}}
+
+
+async def ca_props(g: Graph, p: dict) -> dict:
+    """One policy as Graph answers it -> catalog names (ids become names)."""
+    c = p.get("conditions") or {}
+    apps, users = c.get("applications") or {}, c.get("users") or {}
+    platforms, locations = c.get("platforms") or {}, c.get("locations") or {}
+    grant, session = p.get("grantControls") or {}, p.get("sessionControls") or {}
+    freq, browser = session.get("signInFrequency") or {}, session.get("persistentBrowser") or {}
+    strength = grant.get("authenticationStrength") or {}
+    roles, locs = await g.roles(), await g.locations()
+
+    def loc(x):
+        return x if x in LOCATION_WORDS else locs.get(x, x)
+    return {
+        "DisplayName": p.get("displayName"), "Id": p.get("id"), "State": p.get("state"),
+        "IncludeApplications": apps.get("includeApplications") or [],
+        "ExcludeApplications": apps.get("excludeApplications") or [],
+        "IncludeUserActions": apps.get("includeUserActions") or [],
+        "IncludeUsers": [await g.user_name(x) for x in users.get("includeUsers") or []],
+        "ExcludeUsers": [await g.user_name(x) for x in users.get("excludeUsers") or []],
+        "IncludeGroups": [await g.group_name(x) for x in users.get("includeGroups") or []],
+        "ExcludeGroups": [await g.group_name(x) for x in users.get("excludeGroups") or []],
+        "IncludeRoles": [roles.get(x, x) for x in users.get("includeRoles") or []],
+        "ExcludeRoles": [roles.get(x, x) for x in users.get("excludeRoles") or []],
+        "IncludePlatforms": platforms.get("includePlatforms") or [],
+        "ExcludePlatforms": platforms.get("excludePlatforms") or [],
+        "IncludeLocations": [loc(x) for x in locations.get("includeLocations") or []],
+        "ExcludeLocations": [loc(x) for x in locations.get("excludeLocations") or []],
+        "ClientAppTypes": c.get("clientAppTypes") or [],
+        "UserRiskLevels": c.get("userRiskLevels") or [],
+        "SignInRiskLevels": c.get("signInRiskLevels") or [],
+        "TransferMethods": (c.get("authenticationFlows") or {}).get("transferMethods"),
+        "GrantControlOperator": grant.get("operator"),
+        "BuiltInControls": grant.get("builtInControls") or [],
+        "AuthenticationStrength": strength.get("displayName"),
+        "SignInFrequencyIsEnabled": bool(freq.get("isEnabled")),
+        "SignInFrequencyValue": freq.get("value"),
+        "SignInFrequencyType": upper(freq.get("type")),
+        "PersistentBrowserIsEnabled": bool(browser.get("isEnabled")),
+        "PersistentBrowserMode": upper(browser.get("mode")),
+        **ca_extra(p),
+    }
+
+
+async def read_ca(g: Graph) -> list[dict]:
+    return [await ca_props(g, p) for p in await g.all(CA_PATH)]
+
+
+def _ids(names, table: dict[str, str], what: str, words=frozenset()) -> list[str]:
+    """Display names to ids ("Global Administrator" and "GlobalAdministrator" both match)."""
+    by_name = {norm(v): k for k, v in table.items()}
+    out = []
+    for n in names or []:
+        if n in words or n in table:
+            out.append(n)
+        elif norm(n) in by_name:
+            out.append(by_name[norm(n)])
+        else:
+            raise WriteError(f"{what} '{n}' is not known in the tenant.")
+    return out
+
+
+async def ca_body(g: Graph, p: dict) -> dict:
+    """Catalog names -> the Graph body of a policy (names become ids)."""
+    roles, locs = await g.roles(), await g.locations()
+    users = {
+        "includeUsers": [await g.user_id(x) for x in p.get("IncludeUsers") or []],
+        "excludeUsers": [await g.user_id(x) for x in p.get("ExcludeUsers") or []],
+        "includeGroups": [await g.group_id(x) for x in p.get("IncludeGroups") or []],
+        "excludeGroups": [await g.group_id(x) for x in p.get("ExcludeGroups") or []],
+        "includeRoles": _ids(p.get("IncludeRoles"), roles, "Role"),
+        "excludeRoles": _ids(p.get("ExcludeRoles"), roles, "Role"),
+    }
+    for key, prop in (("includeGuestsOrExternalUsers", "IncludeGuestOrExternalUserTypes"),
+                      ("excludeGuestsOrExternalUsers", "ExcludeGuestOrExternalUserTypes")):
+        if _guests(p.get(prop)):
+            users[key] = _guests(p.get(prop))
+    if not any(users.get(k) for k in ("includeUsers", "includeGroups", "includeRoles", "includeGuestsOrExternalUsers")):
+        users["includeUsers"] = ["None"]
+    conditions: dict[str, Any] = {
+        "applications": {"includeApplications": p.get("IncludeApplications") or [],
+                         "excludeApplications": p.get("ExcludeApplications") or [],
+                         "includeUserActions": p.get("IncludeUserActions") or []},
+        "users": users,
+        "clientAppTypes": p.get("ClientAppTypes") or ["all"],
+        "userRiskLevels": p.get("UserRiskLevels") or [],
+        "signInRiskLevels": p.get("SignInRiskLevels") or [],
+    }
+    if p.get("IncludePlatforms"):
+        conditions["platforms"] = {"includePlatforms": p["IncludePlatforms"],
+                                   "excludePlatforms": p.get("ExcludePlatforms") or []}
+    if p.get("IncludeLocations"):
+        conditions["locations"] = {
+            "includeLocations": _ids(p["IncludeLocations"], locs, "Named location", LOCATION_WORDS),
+            "excludeLocations": _ids(p.get("ExcludeLocations"), locs, "Named location", LOCATION_WORDS)}
+    if p.get("TransferMethods"):
+        conditions["authenticationFlows"] = {"transferMethods": p["TransferMethods"]}
+    body: dict[str, Any] = {"displayName": p["DisplayName"],
+                            "state": p.get("State") or "enabledForReportingButNotEnforced", "conditions": conditions}
+    if p.get("BuiltInControls") or p.get("AuthenticationStrength"):
+        grant: dict[str, Any] = {"operator": p.get("GrantControlOperator") or "OR",
+                                 "builtInControls": p.get("BuiltInControls") or []}
+        if p.get("AuthenticationStrength"):
+            grant["authenticationStrength"] = {"id": _ids([p["AuthenticationStrength"]], await g.strengths(),
+                                                          "Authentication strength")[0]}
+        body["grantControls"] = grant
+    else:
+        body["grantControls"] = None
+    session: dict[str, Any] = {}
+    if p.get("SignInFrequencyIsEnabled") and p.get("SignInFrequencyInterval") == "everyTime":
+        # Every time: Graph wants no value and no type (e.g. MFA for every Intune enrollment)
+        session["signInFrequency"] = {"isEnabled": True, "frequencyInterval": "everyTime",
+                                      "authenticationType": "primaryAndSecondaryAuthentication"}
+    elif p.get("SignInFrequencyIsEnabled"):
+        session["signInFrequency"] = {"isEnabled": True, "value": p.get("SignInFrequencyValue"),
+                                      "type": lower(p.get("SignInFrequencyType")), "frequencyInterval": "timeBased"}
+    if p.get("PersistentBrowserIsEnabled"):
+        session["persistentBrowser"] = {"isEnabled": True, "mode": lower(p.get("PersistentBrowserMode"))}
+    if p.get("ContinuousAccessEvaluationMode") and p["ContinuousAccessEvaluationMode"] != "disabled":
+        session["continuousAccessEvaluation"] = {"mode": p["ContinuousAccessEvaluationMode"]}
+    if p.get("ApplicationEnforcedRestrictionsIsEnabled"):
+        session["applicationEnforcedRestrictions"] = {"isEnabled": True}
+    body["sessionControls"] = session or None
+    return body
+
+
+async def write_ca(g: Graph, actual: dict | None, after: dict) -> str:
+    if after.get("State") == "enabled" and after.get("ExcludeGroups"):
+        # An enforced policy must leave the break-glass accounts out, and they must exist.
+        total = 0
+        for name in after["ExcludeGroups"]:
+            total += await g.members(await g.group_id(name))
+        if not total:
+            raise WriteError(f"The excluded group(s) {', '.join(after['ExcludeGroups'])} have no members. Add the "
+                             f"break-glass accounts first, so an enforced policy cannot lock everybody out.")
+    body = await ca_body(g, after)
+    if actual and actual.get("Id"):
+        await g.send("PATCH", f"{CA_PATH}/{actual['Id']}", body)
+        return actual["Id"]
+    return (await g.send("POST", CA_PATH, body)).get("id")
+
+
+# ------------------------------------------------------------------ authorization policy
+
+AUTHZ_PATH = "/policies/authorizationPolicy"
+AUTHZ_FIELDS = frozenset({
+    "IsSingleInstance", "AllowInvitesFrom", "AllowedToSignUpEmailBasedSubscriptions", "AllowedToUseSSPR",
+    "AllowEmailVerifiedUsersToJoinOrganization", "BlockMsolPowerShell", "GuestUserRole",
+    "PermissionGrantPolicyIdsAssignedToDefaultUserRole", "DefaultUserRolePermissions"})
+AUTHZ_SIMPLE = {"AllowedToSignUpEmailBasedSubscriptions": "allowedToSignUpEmailBasedSubscriptions",
+                "AllowedToUseSSPR": "allowedToUseSSPR", "BlockMsolPowerShell": "blockMsolPowerShell",
+                "AllowEmailVerifiedUsersToJoinOrganization": "allowEmailVerifiedUsersToJoinOrganization"}
+USER_PERMS = ("AllowedToCreateApps", "AllowedToCreateSecurityGroups", "AllowedToCreateTenants",
+              "AllowedToReadBitlockerKeysForOwnedDevice", "AllowedToReadOtherUsers")
+
+
+async def read_authorization(g: Graph) -> list[dict]:
+    p = await g.get(AUTHZ_PATH)
+    if "value" in p:  # some tenants answer with a collection
+        p = (p["value"] or [{}])[0]
+    d = p.get("defaultUserRolePermissions") or {}
+    return [{
+        "IsSingleInstance": "Yes",
+        "AllowInvitesFrom": upper(p.get("allowInvitesFrom")),
+        **{dsc: p.get(graph) for dsc, graph in AUTHZ_SIMPLE.items()},
+        "GuestUserRole": GUEST_ROLES.get(p.get("guestUserRoleId") or "", p.get("guestUserRoleId")),
+        "PermissionGrantPolicyIdsAssignedToDefaultUserRole": d.get("permissionGrantPoliciesAssigned") or [],
+        "DefaultUserRolePermissions": {k: d.get(lower(k)) for k in USER_PERMS},
+    }]
+
+
+async def write_authorization(g: Graph, actual: dict | None, after: dict) -> str:
+    diff = changed(actual, after)
+    body: dict[str, Any] = {}
+    for dsc, graph in AUTHZ_SIMPLE.items():
+        if dsc in diff:
+            body[graph] = diff[dsc]
+    if "AllowInvitesFrom" in diff:
+        body["allowInvitesFrom"] = lower(diff["AllowInvitesFrom"])
+    if "GuestUserRole" in diff:
+        ids = {v: k for k, v in GUEST_ROLES.items()}
+        if diff["GuestUserRole"] not in ids:
+            raise WriteError(f"Unknown guest user role '{diff['GuestUserRole']}'.")
+        body["guestUserRoleId"] = ids[diff["GuestUserRole"]]
+    perms: dict[str, Any] = {}
+    if "DefaultUserRolePermissions" in diff:
+        perms.update({lower(k): v for k, v in (diff["DefaultUserRolePermissions"] or {}).items() if v is not None})
+    if "PermissionGrantPolicyIdsAssignedToDefaultUserRole" in diff:
+        perms["permissionGrantPoliciesAssigned"] = diff["PermissionGrantPolicyIdsAssignedToDefaultUserRole"]
+    if perms:
+        body["defaultUserRolePermissions"] = perms
+    if body:
+        await g.send("PATCH", AUTHZ_PATH, body)
+    return "authorizationPolicy"
+
+
+# ------------------------------------------------------------------ authentication methods
+
+AUTHN_BASE = "/policies/authenticationMethodsPolicy/authenticationMethodConfigurations"
+
+
+def auth_method(method: str, odata: str):
+    """Reader and writer of one authentication method. Microsoft Authenticator also has feature settings (number
+    matching context, location, companion app); a changed one keeps its include/exclude targets."""
+    path = f"{AUTHN_BASE}/{method}"
+
+    async def read(g: Graph) -> list[dict]:
+        p = await g.get(path)
+        row = {"Id": p.get("id") or method, "State": p.get("state")}
+        if method == "MicrosoftAuthenticator":
+            row["FeatureSettings"] = feature_settings(p)
+        return [row]
+
+    async def write(g: Graph, actual: dict | None, after: dict) -> str:
+        body: dict[str, Any] = {}
+        if after.get("State") and (actual or {}).get("State") != after.get("State"):
+            body["state"] = after["State"]
+        have = (actual or {}).get("FeatureSettings") or {}
+        diff = {k: v for k, v in (after.get("FeatureSettings") or {}).items()
+                if (have.get(k) or {}).get("State") != (v or {}).get("State")}
+        if diff:
+            raw = (await g.get(path)).get("featureSettings") or {}
+            body["featureSettings"] = {}
+            for key, want in diff.items():
+                name = key[0].lower() + key[1:]
+                cur = dict(raw.get(name) or {})
+                cur.setdefault("includeTarget", {"targetType": "group", "id": "all_users"})
+                body["featureSettings"][name] = {**cur, "state": want["State"]}
+        if body:
+            if "state" not in body:
+                body["state"] = (actual or {}).get("State") or "enabled"
+            await g.send("PATCH", path, {"@odata.type": f"#microsoft.graph.{odata}", **body})
+        return method
+    return read, write
+
+
+# ------------------------------------------------------------------ admin consent workflow
+
+CONSENT_PATH = "/policies/adminConsentRequestPolicy"
+CONSENT_FIELDS = frozenset({"IsSingleInstance", "IsEnabled", "NotifyReviewers", "RemindersEnabled",
+                            "RequestDurationInDays", "Reviewers"})
+
+
+async def read_admin_consent(g: Graph) -> list[dict]:
+    p = await g.get(CONSENT_PATH)
+    names = {}
+    for r in p.get("reviewers") or []:
+        m = REVIEWER_GROUP.match((r or {}).get("query") or "")
+        if m:
+            names[m[1]] = await g.group_name(m[1])
+    return [{"IsSingleInstance": "Yes", "IsEnabled": p.get("isEnabled"), "NotifyReviewers": p.get("notifyReviewers"),
+             "RemindersEnabled": p.get("remindersEnabled"), "RequestDurationInDays": p.get("requestDurationInDays"),
+             "Reviewers": consent_reviewers(p.get("reviewers"), lambda gid: names.get(gid, gid))}]
+
+
+async def write_admin_consent(g: Graph, actual: dict | None, after: dict) -> str:
+    """Reviewers: the group(s) the baseline names (value consent_reviewers_group); without one, the reviewers
+    already set in the tenant stay. A reviewer that is not a group (user, role) keeps its query as read."""
+    p = await g.get(CONSENT_PATH)
+    if after.get("Reviewers"):
+        reviewers = [{"query": name, "queryType": "MicrosoftGraph"} if name.startswith("/")
+                     else group_query(await g.group_id(name)) for name in after["Reviewers"]]
+    else:
+        reviewers = p.get("reviewers") or []
+    if after.get("IsEnabled") and not reviewers:
+        raise WriteError("The admin consent workflow needs at least one reviewer. Set the reviewer group in the "
+                         "assignment (value consent_reviewers_group) or set reviewers once in the Entra admin center "
+                         "(Enterprise applications -> Consent and permissions -> Admin consent settings).")
+    body = {"isEnabled": after.get("IsEnabled"), "notifyReviewers": after.get("NotifyReviewers"),
+            "remindersEnabled": after.get("RemindersEnabled"),
+            "requestDurationInDays": after.get("RequestDurationInDays") or p.get("requestDurationInDays") or 30,
+            "reviewers": reviewers}
+    await g.send("PUT", CONSENT_PATH, body)
+    return "adminConsentRequestPolicy"
+
+
+# ------------------------------------------------------------------ Microsoft 365 group settings
+
+GROUP_DEFAULTS = {"EnableGroupCreation": True, "AllowGuestsToAccessGroups": True, "AllowGuestsToBeGroupOwner": False,
+                  "AllowToAddGuests": True, "EnableMIPLabels": False}
+GROUPS_FIELDS = frozenset({"IsSingleInstance", *GROUP_DEFAULTS, "GroupCreationAllowedGroupName",
+                           "GuestUsageGuidelinesUrl", "UsageGuidelinesUrl"})
+
+
+def _setting(v: str | None):
+    return {"true": True, "false": False}.get((v or "").lower(), v or None)
+
+
+async def _unified(g: Graph) -> dict | None:
+    return next((x for x in await g.all("/groupSettings") if x.get("displayName") == "Group.Unified"), None)
+
+
+async def read_groups_settings(g: Graph) -> list[dict]:
+    """Group.Unified settings; without a settings object the tenant runs on Microsoft's defaults."""
+    row = await _unified(g)
+    values = {v["name"]: v.get("value") for v in (row or {}).get("values") or []}
+    out = {"IsSingleInstance": "Yes", **GROUP_DEFAULTS}
+    for name in GROUP_DEFAULTS:
+        if name in values:
+            out[name] = _setting(values[name])
+    gid = values.get("GroupCreationAllowedGroupId")
+    out["GroupCreationAllowedGroupName"] = await g.group_name(gid) if gid else None
+    out["GuestUsageGuidelinesUrl"] = values.get("GuestUsageGuidelinesUrl") or None
+    out["UsageGuidelinesUrl"] = values.get("UsageGuidelinesUrl") or None
+    return [out]
+
+
+async def write_groups_settings(g: Graph, actual: dict | None, after: dict) -> str:
+    diff = changed(actual, after)
+    new: dict[str, str] = {}
+    for k, v in diff.items():
+        if k in GROUP_DEFAULTS:
+            new[k] = "true" if v else "false"
+        elif k == "GroupCreationAllowedGroupName":
+            new["GroupCreationAllowedGroupId"] = await g.group_id(v) if v else ""
+        elif k in ("GuestUsageGuidelinesUrl", "UsageGuidelinesUrl"):
+            new[k] = v or ""
+    row = await _unified(g)
+    if row:
+        values = [{"name": v["name"], "value": new.pop(v["name"], v.get("value"))} for v in row.get("values") or []]
+        values += [{"name": k, "value": v} for k, v in new.items()]
+        if diff:
+            await g.send("PATCH", f"/groupSettings/{row['id']}", {"values": values})
+        return row["id"]
+    template = next((t for t in await g.all("/groupSettingTemplates") if t.get("displayName") == "Group.Unified"), None)
+    if not template:
+        raise WriteError("The tenant has no Group.Unified settings template.")
+    values = [{"name": v["name"], "value": new.get(v["name"], v.get("defaultValue"))}
+              for v in template.get("values") or []]
+    return (await g.send("POST", "/groupSettings", {"templateId": template["id"], "values": values})).get("id")
+
+
+# ------------------------------------------------------------------ group expiration
+
+LIFECYCLE_FIELDS = frozenset({"IsSingleInstance", "GroupLifetimeInDays", "ManagedGroupTypes",
+                              "AlternateNotificationEmails"})
+
+
+async def read_group_lifecycle(g: Graph) -> list[dict]:
+    return [{"IsSingleInstance": "Yes", "Id": p.get("id"), "GroupLifetimeInDays": p.get("groupLifetimeInDays"),
+             "ManagedGroupTypes": p.get("managedGroupTypes"),
+             "AlternateNotificationEmails": [x for x in (p.get("alternateNotificationEmails") or "").split(";") if x]}
+            for p in (await g.all("/groupLifecyclePolicies"))[:1]]
+
+
+async def _notification_emails(g: Graph) -> str:
+    """Microsoft needs an address for groups without owners. Without one in the baseline: the tenant's technical
+    contact (organization.technicalNotificationMails)."""
+    org = (await g.all("/organization?$select=technicalNotificationMails"))[:1]
+    mails = [m for m in ((org[0].get("technicalNotificationMails") if org else None) or []) if m]
+    if not mails:
+        raise WriteError("Group expiration needs a notification address for groups without owners. Set the technical "
+                         "contact of the tenant (Microsoft 365 admin center -> Settings -> Org settings -> "
+                         "Organization profile) or create the policy once in the Entra admin center.")
+    return ";".join(mails)
+
+
+async def write_group_lifecycle(g: Graph, actual: dict | None, after: dict) -> str:
+    body = {"groupLifetimeInDays": int(after["GroupLifetimeInDays"]),
+            "managedGroupTypes": after.get("ManagedGroupTypes") or "All"}
+    # An empty value is refused («Invalid notification email»): send addresses only when the baseline names them;
+    # an existing policy keeps its own, a new one gets the tenant's technical contact.
+    if after.get("AlternateNotificationEmails"):
+        body["alternateNotificationEmails"] = ";".join(after["AlternateNotificationEmails"])
+    elif not (actual and actual.get("Id")):
+        body["alternateNotificationEmails"] = await _notification_emails(g)
+    if actual and actual.get("Id"):
+        if changed(actual, after):
+            await g.send("PATCH", f"/groupLifecyclePolicies/{actual['Id']}", body)
+        return actual["Id"]
+    return (await g.send("POST", "/groupLifecyclePolicies", body)).get("id")