From 7179119b0ef43c57edaef85ec71130af0aea73aa Mon Sep 17 00:00:00 2001
From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
Date: Wed, 16 Jul 2025 15:23:46 +0200
Subject: [PATCH] fix(outputs): identity type and id for prowler cloud (#8243)

---
 prowler/CHANGELOG.md                    |  1 +
 prowler/providers/m365/m365_provider.py | 18 +++++++++++++++---
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index f73657a018..0de1fd6448 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -20,6 +20,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 ### Fixed
 - Title & description wording for `iam_user_accesskey_unused` check for AWS provider [(#8233)](https://github.com/prowler-cloud/prowler/pull/8233)
 - Add GitHub provider to lateral panel in documentation and change -h environment variable output [(#8246)](https://github.com/prowler-cloud/prowler/pull/8246)
+- Show `m365_identity_type` and `m365_identity_id` in cloud reports [(#8247)](https://github.com/prowler-cloud/prowler/pull/8247)
 - Ensure `is_service_role` only returns `True` for service roles [(#8274)](https://github.com/prowler-cloud/prowler/pull/8274)
 - Update DynamoDB check metadata to fix broken link [(#8273)](https://github.com/prowler-cloud/prowler/pull/8273)
 - Show correct count of findings in Dashboard Security Posture page [(#8270)](https://github.com/prowler-cloud/prowler/pull/8270)
diff --git a/prowler/providers/m365/m365_provider.py b/prowler/providers/m365/m365_provider.py
index 80c65dd3d5..9e550c07d7 100644
--- a/prowler/providers/m365/m365_provider.py
+++ b/prowler/providers/m365/m365_provider.py
@@ -443,6 +443,7 @@ class M365Provider(Provider):
         if credentials:
             if identity and credentials.user:
                 identity.user = credentials.user
+                identity.identity_type = "Service Principal and User Credentials"
             test_session = M365PowerShell(credentials, identity)
             try:
                 if init_modules:
@@ -954,13 +955,20 @@ class M365Provider(Provider):
                     f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
                 )
             # since that exception is not considered as critical, we keep filling another identity fields
-            identity.identity_id = (
-                getenv("AZURE_CLIENT_ID") or "Unknown user id (Missing AAD permissions)"
-            )
             if sp_env_auth:
                 identity.identity_type = "Service Principal"
+                identity.identity_id = (
+                    getenv("AZURE_CLIENT_ID")
+                    or session.credentials[0]._credential.client_id
+                    or "Unknown user id (Missing AAD permissions)"
+                )
             elif env_auth:
                 identity.identity_type = "Service Principal and User Credentials"
+                identity.identity_id = (
+                    getenv("AZURE_CLIENT_ID")
+                    or session.credentials[0]._credential.client_id
+                    or "Unknown user id (Missing AAD permissions)"
+                )
             elif browser_auth or az_cli_auth:
                 identity.identity_type = "User"
                 try:
@@ -978,6 +986,10 @@ class M365Provider(Provider):
                     logger.error(
                         f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
                     )
+            else:
+                # Static Credentials
+                identity.identity_type = "Service Principal"
+                identity.identity_id = session._client_id
 
             # Retrieve tenant id from the client
             client = GraphServiceClient(credentials=session)