Kiểm Tra & Thu Hồi OAuth Permission Grant

# Liệt kê tất cả service principals trong tenant
az ad sp list --all \
  --query "[].{Name:displayName, AppId:appId, Type:servicePrincipalType}" \
  --output table | head -30

# Xem OAuth2 permission grants (admin consent grants)
az ad oauth2-permission-grant list \
  --query "[].{Client:clientId, Resource:resourceId, Scope:scope, ConsentType:consentType}" \
  --output table

# Lọc grants loại "AllPrincipals" (admin consent cho toàn tenant)
az ad oauth2-permission-grant list \
  --query "[?consentType=='AllPrincipals'].{Client:clientId, Scope:scope}" \
  --output table

# Lấy Object ID của service principal lab15
APP_ID=$(az ad app list \
  --display-name "app-az500-secureapp-lab15" \
  --query "[0].appId" -o tsv)

SP_ID=$(az ad sp show --id $APP_ID --query id -o tsv)

# Xem tất cả OAuth grants cho SP này
az ad oauth2-permission-grant list \
  --filter "clientId eq '$SP_ID'" \
  --output json

# Xem app role assignments (application permissions)
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/servicePrincipals/$SP_ID/appRoleAssignments" \
  --query "value[].{Role:appRoleId, Resource:resourceDisplayName, Principal:principalDisplayName}" \
  --output table

# Lấy Grant ID cần thu hồi
GRANT_ID=$(az ad oauth2-permission-grant list \
  --filter "clientId eq '$SP_ID'" \
  --query "[0].id" -o tsv)

echo "Grant ID: $GRANT_ID"

# Thu hồi grant cụ thể
az ad oauth2-permission-grant delete --id $GRANT_ID

# Xác nhận đã thu hồi
az ad oauth2-permission-grant list \
  --filter "clientId eq '$SP_ID'" \
  --output table

# Thu hồi app role assignment (application permission)
ASSIGNMENT_ID=$(az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/servicePrincipals/$SP_ID/appRoleAssignments" \
  --query "value[0].id" -o tsv)

az rest --method DELETE \
  --url "https://graph.microsoft.com/v1.0/servicePrincipals/$SP_ID/appRoleAssignments/$ASSIGNMENT_ID"

# Truy vấn audit log qua Microsoft Graph API
# Lọc events liên quan đến consent trong 24 giờ qua
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?\$filter=activityDisplayName eq 'Consent to application' and activityDateTime ge $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ)&\$top=10" \
  --query "value[].{Time:activityDateTime, Activity:activityDisplayName, Actor:initiatedBy.user.userPrincipalName, Target:targetResources[0].displayName}" \
  --output table

# Lọc consent revoke events
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?\$filter=activityDisplayName eq 'Remove delegated permission grant'&\$top=10" \
  --query "value[].{Time:activityDateTime, Actor:initiatedBy.user.userPrincipalName, Target:targetResources[0].displayName}" \
  --output table

# Xem authorization policy hiện tại
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" \
  --query "{DefaultUserConsent:defaultUserRolePermissions.allowedToCreateApps, PermissionGrantPoliciesAssigned:permissionGrantPoliciesAssigned}" \
  --output json

# Tắt khả năng user tự consent (chỉ admin mới consent được)
# Cập nhật permissionGrantPoliciesAssigned thành rỗng
az rest --method PATCH \
  --url "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" \
  --headers "Content-Type=application/json" \
  --body '{"permissionGrantPoliciesAssigned":[]}'

# Xác nhận thay đổi
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" \
  --query "permissionGrantPoliciesAssigned" -o json