LA-DisableServicePrincipal.json

{
    "definition": {
        "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        "actions": {
            "Process_Alerts": {
                "actions": {
                    "Disable_Service_Principal_(PATCH)": {
                        "inputs": {
                            "authentication": {
                                "audience": "https://graph.microsoft.com",
                                "identity": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/UAMI-SentinelAutomation",
                                "type": "ManagedServiceIdentity"
                            },
                            "body": {
                                "accountEnabled": "false"
                            },
                            "headers": {
                                "Content-Type": "application/json"
                            },
                            "method": "PATCH",
                            "uri": "https://graph.microsoft.com/v1.0/servicePrincipals/@{body('Parse_Alert_Custom_Details')?['ObjectId'][0]}"
                        },
                        "runAfter": {
                            "Parse_Alert_Custom_Details": [
                                "Succeeded"
                            ]
                        },
                        "type": "Http"
                    },
                    "Parse_Alert_Custom_Details": {
                        "inputs": {
                            "content": "@items('Process_Alerts')?['properties']?['additionalData']?['Custom Details']",
                            "schema": {
                                "properties": {
                                    "CredentialKeyId": {
                                        "items": {
                                            "type": "string"
                                        },
                                        "type": "array"
                                    },
                                    "CredentialThumbprint": {
                                        "items": {
                                            "type": "string"
                                        },
                                        "type": "array"
                                    },
                                    "ObjectId": {
                                        "items": {
                                            "type": "string"
                                        },
                                        "type": "array"
                                    },
                                    "RequestUri": {
                                        "items": {
                                            "type": "string"
                                        },
                                        "type": "array"
                                    },
                                    "ServicePrincipalName": {
                                        "items": {
                                            "type": "string"
                                        },
                                        "type": "array"
                                    }
                                },
                                "type": "object"
                            }
                        },
                        "runAfter": {},
                        "type": "ParseJson"
                    }
                },
                "foreach": "@triggerBody()?['object']?['properties']?['Alerts']",
                "runAfter": {},
                "type": "Foreach"
            }
        },
        "contentVersion": "1.0.0.0",
        "outputs": {},
        "parameters": {
            "$connections": {
                "defaultValue": {},
                "type": "Object"
            }
        },
        "triggers": {
            "Microsoft_Sentinel_incident": {
                "inputs": {
                    "body": {
                        "callback_url": "@{listCallbackUrl()}"
                    },
                    "host": {
                        "connection": {
                            "name": "@parameters('$connections')['azuresentinel_1']['connectionId']"
                        }
                    },
                    "path": "/incident-creation"
                },
                "type": "ApiConnectionWebhook"
            }
        }
    },
    "parameters": {
        "$connections": {
            "value": {
                "azuresentinel_1": {
                    "connectionId": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroupName}/providers/Microsoft.Web/connections/azuresentinel",
                    "connectionName": "azuresentinel",
                    "connectionProperties": {
                        "authentication": {
                            "identity": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/UAMI-SentinelAutomation",
                            "type": "ManagedServiceIdentity"
                        }
                    },
                    "id": "/subscriptions/{SubscriptionId}/providers/Microsoft.Web/locations/westeurope/managedApis/azuresentinel"
                }
            }
        }
    }
}