configure_admin_alerts
Set up email notifications for Global Administrator role activations to monitor privileged access in Microsoft 365 environments.
Instructions
Configure alerts for Global Administrator activation (MS.AAD.7.8v1)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| notificationEmails | Yes | Email addresses to notify on role activation |
Implementation Reference
- cisa-m365/src/index.ts:292-308 (registration)Tool registration in ListTools handler, including name, description, and input schema definition.{ name: 'configure_admin_alerts', description: 'Configure alerts for Global Administrator activation (MS.AAD.7.8v1)', inputSchema: { type: 'object', properties: { notificationEmails: { type: 'array', items: { type: 'string', }, description: 'Email addresses to notify on role activation', }, }, required: ['notificationEmails'], }, },
- cisa-m365/src/index.ts:375-383 (registration)Tool dispatch in CallToolRequest handler, validates arguments and calls the implementation method.case 'configure_admin_alerts': { if (!isAlertSettingsArgs(request.params.arguments)) { throw new McpError( ErrorCode.InvalidParams, 'Invalid alert settings arguments' ); } return await this.configureAdminAlerts(request.params.arguments); }
- cisa-m365/src/index.ts:967-994 (handler)The primary handler function that executes the tool: creates a high-severity alert policy for Global Administrator activations via Microsoft Graph API /policies/alertPolicies endpoint.private async configureAdminAlerts(args: AlertSettingsArgs) { try { // Configure Global Admin activation alerts using Microsoft Graph API await this.graphClient .api('/policies/alertPolicies') .post({ displayName: 'Global Administrator Activation Alert', isEnabled: true, severity: 'high', category: 'roleManagement', notificationRecipients: args.notificationEmails, }); return { content: [ { type: 'text', text: 'Global Administrator activation alerts configured successfully', }, ], }; } catch (error: unknown) { throw new McpError( ErrorCode.InternalError, `Failed to configure admin alerts: ${error instanceof Error ? error.message : 'Unknown error'}` ); } }
- cisa-m365/src/index.ts:27-29 (schema)TypeScript interface defining the expected input arguments for the tool.interface AlertSettingsArgs { notificationEmails: string[]; }
- cisa-m365/src/index.ts:41-48 (helper)Runtime type guard/validator for AlertSettingsArgs, used in dispatch to validate tool inputs.function isAlertSettingsArgs(args: unknown): args is AlertSettingsArgs { if (typeof args !== 'object' || args === null) return false; const a = args as Record<string, unknown>; return ( Array.isArray(a.notificationEmails) && a.notificationEmails.every(email => typeof email === 'string') ); }