Reportly is an EntraID user activity report tool.

This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following:

1. Information about the user
2. Actions taken by the user
3. Actions taken on the user
4. User login and failure logs

When running the tool, a link to authentication and a device code will show, follow the link and enter the code to authenticate.

Insert User principal name of a suspicious user.
Insert start and end times in the following format: 2022-11-16
I recommend a range of no longer than a week.

When the report will be ready the tool will print "Your report is ready!". The reports are created in the executable's directory by default.

Attached an example report "report_example.html"

In order to use the tool you will need an EntraID application with the following delegated microsoft graph api permissions:

• AuditLog.Read.All
  
• GroupMember.Read.All
  
• RoleManagement.Read.Directory
  
• User.Read
  
• User.Read.All
  
  dont forget to grant admin consent

Also, when creating the application, make sure you mark the following option as "yes":

• you can find this property under the application's "Authentication" tab.

Add a secret to the application.

• Go to "Certificates & secrets"
• Add a secret
• Immediately copy the secret to the config file (after you watch it once, it disappears)

After you created the application you need to fill the config.cfg file:
clientId = application id
clientSecret = application secret
tenantId = tenant id