configure_admin_alerts
Set up email notifications to monitor Global Administrator role activations in Microsoft 365 environments for security compliance monitoring.
Instructions
Configure alerts for Global Administrator activation (MS.AAD.7.8v1)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| notificationEmails | Yes | Email addresses to notify on role activation |
Implementation Reference
- cisa-m365/src/index.ts:967-994 (handler)The core handler function that implements the 'configure_admin_alerts' tool by creating a Microsoft Graph API alert policy for Global Administrator role activations, using the provided notification emails.private async configureAdminAlerts(args: AlertSettingsArgs) { try { // Configure Global Admin activation alerts using Microsoft Graph API await this.graphClient .api('/policies/alertPolicies') .post({ displayName: 'Global Administrator Activation Alert', isEnabled: true, severity: 'high', category: 'roleManagement', notificationRecipients: args.notificationEmails, }); return { content: [ { type: 'text', text: 'Global Administrator activation alerts configured successfully', }, ], }; } catch (error: unknown) { throw new McpError( ErrorCode.InternalError, `Failed to configure admin alerts: ${error instanceof Error ? error.message : 'Unknown error'}` ); } }
- cisa-m365/src/index.ts:292-308 (registration)Registration of the tool in the ListTools response, defining its name, description, and input schema for notification emails.{ name: 'configure_admin_alerts', description: 'Configure alerts for Global Administrator activation (MS.AAD.7.8v1)', inputSchema: { type: 'object', properties: { notificationEmails: { type: 'array', items: { type: 'string', }, description: 'Email addresses to notify on role activation', }, }, required: ['notificationEmails'], }, },
- cisa-m365/src/index.ts:375-383 (handler)Dispatch handler in the CallToolRequestSchema switch statement that validates input arguments and invokes the configureAdminAlerts method.case 'configure_admin_alerts': { if (!isAlertSettingsArgs(request.params.arguments)) { throw new McpError( ErrorCode.InvalidParams, 'Invalid alert settings arguments' ); } return await this.configureAdminAlerts(request.params.arguments); }
- cisa-m365/src/index.ts:27-29 (schema)TypeScript interface defining the input arguments for the tool, consisting of an array of notification email strings.interface AlertSettingsArgs { notificationEmails: string[]; }
- cisa-m365/src/index.ts:41-48 (helper)Type guard function used to validate the tool's input arguments before invoking the handler.function isAlertSettingsArgs(args: unknown): args is AlertSettingsArgs { if (typeof args !== 'object' || args === null) return false; const a = args as Record<string, unknown>; return ( Array.isArray(a.notificationEmails) && a.notificationEmails.every(email => typeof email === 'string') ); }