Access Review cho Nhóm Admin

# Lấy Object ID của group SecurityAdmins
GROUP_ID=$(az ad group show \
  --group "GRP-AZ500-SecurityAdmins" \
  --query id -o tsv)
echo "Group ID: $GROUP_ID"

# Xem danh sách members hiện tại
az ad group member list \
  --group "GRP-AZ500-SecurityAdmins" \
  --query "[].{name:displayName, upn:userPrincipalName}" \
  --output table

# Thêm user nếu chưa có đủ (cần ít nhất 3-4 members để review)
az ad group member add \
  --group "GRP-AZ500-SecurityAdmins" \
  --member-id $(az ad user show \
    --id [email protected] \
    --query id -o tsv)

az ad group member add \
  --group "GRP-AZ500-SecurityAdmins" \
  --member-id $(az ad user show \
    --id [email protected] \
    --query id -o tsv)

# Lấy reviewer ID
REVIEWER_ID=$(az ad user show \
  --id [email protected] \
  --query id -o tsv)

# Tính ngày bắt đầu và kết thúc
START=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
END=$(date -u -d "+7 days" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || \
  date -u -v+7d +"%Y-%m-%dT%H:%M:%SZ")

# Tạo Access Review qua MS Graph API
az rest \
  --method POST \
  --url "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions" \
  --headers "Content-Type=application/json" \
  --body "{
    \"displayName\": \"Q1-2026-SecurityAdmins-Review\",
    \"descriptionForAdmins\": \"Quarterly review of SecurityAdmins group membership\",
    \"scope\": {
      \"query\": \"/groups/$GROUP_ID/members\",
      \"queryType\": \"MicrosoftGraph\"
    },
    \"reviewers\": [{
      \"query\": \"/users/$REVIEWER_ID\",
      \"queryType\": \"MicrosoftGraph\"
    }],
    \"settings\": {
      \"mailNotificationsEnabled\": true,
      \"reminderNotificationsEnabled\": true,
      \"justificationRequiredOnApproval\": true,
      \"defaultDecisionEnabled\": true,
      \"defaultDecision\": \"Deny\",
      \"instanceDurationInDays\": 7,
      \"autoApplyDecisionsEnabled\": true,
      \"recommendationsEnabled\": true,
      \"recurrence\": {
        \"pattern\": { \"type\": \"absoluteMonthly\", \"interval\": 3 },
        \"range\": { \"type\": \"noEnd\", \"startDate\": \"$(date +%Y-%m-%d)\" }
      }
    }
  }"

# Đăng nhập az500-secops01 để review
az login --username [email protected]

# Lấy danh sách Access Review definitions
az rest \
  --method GET \
  --url "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions" \
  --query "value[?displayName=='Q1-2026-SecurityAdmins-Review'].{id:id, status:status}" \
  -o json

# Lưu review definition ID
REVIEW_DEF_ID="YOUR_REVIEW_DEFINITION_ID"

# Xem instances của review
az rest \
  --method GET \
  --url "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions/$REVIEW_DEF_ID/instances" \
  --query "value[0].{id:id, status:status, start:startDateTime, end:endDateTime}" \
  -o json

INSTANCE_ID="YOUR_INSTANCE_ID"

# Xem tất cả decisions cần review
az rest \
  --method GET \
  --url "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions/$REVIEW_DEF_ID/instances/$INSTANCE_ID/decisions" \
  --query "value[].{user:principal.displayName, decision:decision, recommendation:recommendation}" \
  -o table

# Kiểm tra group membership sau khi apply review
az ad group member list \
  --group "GRP-AZ500-SecurityAdmins" \
  --query "[].{name:displayName, upn:userPrincipalName}" \
  --output table

# Kết quả mong đợi:
# az500-admin01  — còn lại (Approved)
# az500-secops01 — còn lại (Approved)
# az500-dev01    — ĐÃ BỊ XÓA (Denied)

# Xác nhận az500-dev01 không còn trong group
az ad group member check \
  --group "GRP-AZ500-SecurityAdmins" \
  --member-id $(az ad user show \
    --id [email protected] \
    --query id -o tsv)
# → false

Name                DisplayName          UserPrincipalName
------------------  -------------------  -----------------------------------------
az500-admin01       AZ500 Admin 01       [email protected]
az500-secops01      AZ500 SecOps 01      [email protected]

# Xem toàn bộ decisions của review instance
az rest \
  --method GET \
  --url "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions/$REVIEW_DEF_ID/instances/$INSTANCE_ID/decisions" \
  --query "value[].{user:principal.displayName, decision:decision, reason:justification, reviewer:reviewedBy.userPrincipalName}" \
  -o table

# Xem audit logs liên quan đến Access Reviews từ Entra ID
az rest \
  --method GET \
  --url "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?\$filter=loggedByService eq 'Access Reviews'&\$top=20" \
  --query "value[].{time:activityDateTime, activity:activityDisplayName, initiator:initiatedBy.user.userPrincipalName, target:targetResources[0].displayName}" \
  -o table

# Xóa Access Review definition (dừng recurring review)
az rest \
  --method DELETE \
  --url "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions/$REVIEW_DEF_ID"

# Xóa resource group nếu kết thúc toàn bộ chương 3
az group delete \
  --name rg-az500-rbac \
  --yes \
  --no-wait