Graph API Reports for CA Blocked Sign-Ins

graph-api-reports-ca-blocked-sign-ins.txt

Graph PowerShell:

(Invoke-MgGraphRequest -Uri "/beta/reports/serviceActivity/getMetricsForConditionalAccessBlockedSignIn(inclusiveIntervalStartDateTime=$((Get-Date).AddMinutes(-5).ToString("yyyy-MM-ddTHH:mm:ssZ")),exclusiveIntervalEndDateTime=$((Get-Date).ToString("yyyy-MM-ddTHH:mm:ssZ")),aggregationIntervalInMinutes=5)").value

Logic App:

{
    "definition": {
        "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        "contentVersion": "1.0.0.0",
        "triggers": {
            "Every_5_minutes": {
                "recurrence": {
                    "interval": 5,
                    "frequency": "Minute"
                },
                "evaluatedRecurrence": {
                    "interval": 5,
                    "frequency": "Minute"
                },
                "type": "Recurrence"
            }
        },
        "actions": {
            "Get_CA_Blocked_Sign_Ins_Report": {
                "runAfter": {},
                "type": "Http",
                "inputs": {
                    "uri": "https://graph.microsoft.com/beta/reports/serviceActivity/getMetricsForConditionalAccessBlockedSignIn(inclusiveIntervalStartDateTime=@{formatDateTime(addMinutes(utcNow(),-5),'yyyy-MM-ddTHH:mm:ssZ')},exclusiveIntervalEndDateTime=@{formatDateTime(utcNow(),'yyyy-MM-ddTHH:mm:ssZ')},aggregationIntervalInMinutes=5)",
                    "method": "GET",
                    "authentication": {
                        "type": "ManagedServiceIdentity",
                        "audience": "https://graph.microsoft.com"
                    }
                },
                "runtimeConfiguration": {
                    "contentTransfer": {
                        "transferMode": "Chunked"
                    }
                }
            },
            "ForEach_Value": {
                "foreach": "@body('Get_CA_Blocked_Sign_Ins_Report')['value']",
                "actions": {
                    "True_if_greater_than_5": {
                        "actions": {},
                        "else": {
                            "actions": {}
                        },
                        "expression": {
                            "and": [
                                {
                                    "greater": [
                                        "@items('ForEach_Value')['value']",
                                        5
                                    ]
                                }
                            ]
                        },
                        "type": "If"
                    }
                },
                "runAfter": {
                    "Get_CA_Blocked_Sign_Ins_Report": [
                        "Succeeded"
                    ]
                },
                "type": "Foreach"
            }
        },
        "outputs": {},
        "parameters": {
            "$connections": {
                "type": "Object",
                "defaultValue": {}
            }
        }
    },
    "parameters": {
        "$connections": {
            "type": "Object",
            "value": {}
        }
    }
}

Permissions for Managed Identity:
$SP_ID = "<MI ObjectId>"
$GraphSP = Get-MgServicePrincipal -Filter "startswith(DisplayName,'Microsoft Graph')" | Select-Object -first 1 #Graph App ID: 00000003-0000-0000-c000-000000000000
$AppRole = $GraphSP.AppRoles | Where-Object {$_.Value -eq "Reports.Read.All" -and $_.AllowedMemberTypes -contains "Application"}
New-MgServicePrincipalAppRoleAssignment -AppRoleId $AppRole.Id -ServicePrincipalId $SP_ID -ResourceId $GraphSP.Id -PrincipalId $SP_ID

@nathanmcnulty ,

Thank you for sharing the code here, However, The MS Graph Invoke command at line#3 throws an error:

Invoke-MgGraphRequest: GET https://graph.microsoft.com/beta/reports/serviceActivity/getMetricsForConditionalAccessBlockedSignIn(inclusiveIntervalStartDateTime=2025-04-23T12:47:58Z,exclusiveIntervalEndDateTime=2025-04-23T12:52:58Z,aggregationIntervalInMinutes=5)
HTTP/2.0 400 Bad Request
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
request-id: ba8b8c4a-3ea6-46eb-97a5-99796b7a6eec
client-request-id: 4bffc804-c5cf-4fc5-a42f-62fe1ed5e010
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"Southeast Asia","Slice":"E","Ring":"5","ScaleUnit":"000","RoleInstance":"SI1PEPF00009A4E"}}
Date: Wed, 23 Apr 2025 02:52:58 GMT
Content-Type: application/json

{"error":{"code":"400","message":"inclusiveIntervalStartDateTime not valid.","innerError":{"date":"2025-04-23T02:52:58","request-id":"ba8b8c4a-3ea6-46eb-97a5-99796b7a6eec","client-request-id":"4bffc804-c5cf-4fc5-a42f-62fe1ed5e010"}}}

Hey @albert-widjaja, so sorry I missed this. I have not been able to reproduce this error. What if you try changing .AddMinutes(-5) to .AddMinutes(-10) or something. Maybe the window is just slightly too tight.