health_check
Check service health and Graph connectivity, verify sign-in log permissions, and return healthy, degraded, or error status so callers know whether Entra ID triage tools can run.
Instructions
Fleet-standard health probe: service/version/status plus two independent Graph probes.
graph confirms Microsoft Graph is reachable at all (GET /users
with $top=1 -- needs only User.Read.All, the minimum permission
every deployment of this server needs anyway). signin_probe additionally confirms the current
credential can read sign-in logs -- the permission every other tool here
except get_user depends on. Both probes always run, independently of
each other: a tenant that has AuditLog.Read.All but not (yet) the
baseline User.Read.All would otherwise have this report "Graph
unreachable" -- a fabricated diagnosis, since Graph plainly is
reachable if the other probe succeeds. status is derived from the
two outcomes: healthy when both succeed, degraded when exactly
one does (Graph is reachable but some permission is missing), error
only when neither does.
Read-only. Always returns the same keys regardless of outcome (detail
is null on success, a translated message on failure), so a caller never
has to branch on which keys are present.
sites reports the optional ENTRAADM_SITES_INI table
(configured, ranges, error). A configured file that fails to
load is an error here and leaves status no better than
degraded: without it every internal IP would be reported as an
external spray suspect.
With a tenant file (ENTRAADM_CONFIG) every tenant is probed. The
top-level keys stay the DEFAULT tenant's, as in a single-tenant
deployment, plus tenant (the default's name) and tenants:
{name: {default, domains, auth_mode, status, graph, signin_probe}}
for every tenant, the default included. Each tenant's probes run under an
even share of the call budget (ENTRAADM_DEADLINE), so a tenant that
does not answer is an error there instead of stalling the call.
Another tenant that is not
healthy makes the top-level status at most degraded (the
default tenant alone can make it error). arm is the default
tenant's only. Env-only results carry neither key.
identity_protection is the Identity Protection licence probe
(licensed / not_licensed / no_permission / error, cached
per tenant for an hour; see compromise_suspects), per tenant in
tenants too. Informational: not_licensed (no Entra ID P2) and
the rest never change status.
home_countries reports ENTRAADM_HOME_COUNTRIES (configured,
countries, error), which compromise_suspects needs for its
foreign-success finding. Informational: unset or invalid never changes
status.
arm is a third, informational probe (Azure Resource Manager
reachable, and how many subscriptions this credential can see). It
never moves status: Azure RBAC is optional for this server, and a
deployment used only for Entra triage must not sit at degraded
forever because nobody granted it a Reader role. It runs last under its
own short budget (_ARM_PROBE_SECONDS) so an unresponsive ARM cannot
push this whole call past the client's tool-call timeout. The budget
bounds the request, not the first token acquisition (azure-identity is
synchronous; in azure-cli mode it shells out to az), which is the
same limit every tool here has.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||