enforce_granular_roles
Enforce granular role assignments to replace Global Administrator privileges, implementing Microsoft 365 security policy MS.AAD.7.2v1 for compliance with CSA BOD 25-01 requirements.
Instructions
Enforce use of granular roles instead of Global Administrator (MS.AAD.7.2v1)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Implementation Reference
- cisa-m365/src/index.ts:835-859 (handler)The handler function that executes the 'enforce_granular_roles' tool. It patches the roleManagementPolicies endpoint in Microsoft Graph API to set enforceGranularRoles to true and blockGlobalAdminForGeneralUse to true, then returns a success message.
private async enforceGranularRoles() { try { // Configure role settings using Microsoft Graph API await this.graphClient .api('/policies/roleManagementPolicies') .patch({ enforceGranularRoles: true, blockGlobalAdminForGeneralUse: true, }); return { content: [ { type: 'text', text: 'Granular role usage enforced successfully', }, ], }; } catch (error: unknown) { throw new McpError( ErrorCode.InternalError, `Failed to enforce granular roles: ${error instanceof Error ? error.message : 'Unknown error'}` ); } } - cisa-m365/src/index.ts:243-250 (registration)Registration of the 'enforce_granular_roles' tool in the ListTools response, including its name, description, and input schema (empty object).
{ name: 'enforce_granular_roles', description: 'Enforce use of granular roles instead of Global Administrator (MS.AAD.7.2v1)', inputSchema: { type: 'object', properties: {}, }, }, - cisa-m365/src/index.ts:246-249 (schema)Input schema for the 'enforce_granular_roles' tool, which expects an empty object (no parameters).
inputSchema: { type: 'object', properties: {}, }, - cisa-m365/src/index.ts:358-359 (handler)Dispatcher switch case in the CallToolRequest handler that routes calls to the enforceGranularRoles method.
case 'enforce_granular_roles': return await this.enforceGranularRoles(); - cisa-m365/src/index.ts:1086-1089 (helper)Helper code in getPolicyStatus that checks the enforcement status of granular roles from roleManagement policies.
granularRoles: { enforced: roleManagement.enforceGranularRoles, compliant: true, },