From c4a9280ebbdff7269648f1099205fa008d185923 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Thu, 17 Jul 2025 12:37:13 +0200
Subject: [PATCH] fix(m365): handle tenant_id in mutelist (#8306)

Co-authored-by: Pepe Fagoaga <pepe@prowler.com>
---
 prowler/CHANGELOG.md                          |  1 +
 prowler/lib/check/check.py                    |  2 ++
 .../providers/m365/lib/mutelist/mutelist.py   |  3 +-
 .../m365/lib/mutelist/m365_mutelist_test.py   | 31 +++++++++++++++++--
 4 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index a940eb9f95..10a5aecbfd 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -30,6 +30,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `ServiceName` field in Network Firewall checks metadata [(#8280)](https://github.com/prowler-cloud/prowler/pull/8280)
 - Update `entra_users_mfa_capable` check to use the correct resource name and ID [(#8288)](https://github.com/prowler-cloud/prowler/pull/8288)
 - Handle multiple services and severities while listing checks [(#8302)](https://github.com/prowler-cloud/prowler/pull/8302)
+- Handle `tenant_id` for M365 Mutelist [(#8306)](https://github.com/prowler-cloud/prowler/pull/8306)
 
 ---
 
diff --git a/prowler/lib/check/check.py b/prowler/lib/check/check.py
index 088df6af51..8cd3097342 100644
--- a/prowler/lib/check/check.py
+++ b/prowler/lib/check/check.py
@@ -635,6 +635,8 @@ def execute(
                 is_finding_muted_args["account_name"] = (
                     global_provider.identity.account_name
                 )
+            elif global_provider.type == "m365":
+                is_finding_muted_args["tenant_id"] = global_provider.identity.tenant_id
             for finding in check_findings:
                 if global_provider.type == "azure":
                     is_finding_muted_args["subscription_id"] = (
diff --git a/prowler/providers/m365/lib/mutelist/mutelist.py b/prowler/providers/m365/lib/mutelist/mutelist.py
index a7bf971f3e..44ea5ec7c5 100644
--- a/prowler/providers/m365/lib/mutelist/mutelist.py
+++ b/prowler/providers/m365/lib/mutelist/mutelist.py
@@ -7,9 +7,10 @@ class M365Mutelist(Mutelist):
     def is_finding_muted(
         self,
         finding: CheckReportM365,
+        tenant_id: str,
     ) -> bool:
         return self.is_muted(
-            finding.tenant_id,
+            tenant_id,
             finding.check_metadata.CheckID,
             finding.location,
             finding.resource_name,
diff --git a/tests/providers/m365/lib/mutelist/m365_mutelist_test.py b/tests/providers/m365/lib/mutelist/m365_mutelist_test.py
index 819d278cd5..4d63b98faa 100644
--- a/tests/providers/m365/lib/mutelist/m365_mutelist_test.py
+++ b/tests/providers/m365/lib/mutelist/m365_mutelist_test.py
@@ -56,7 +56,6 @@ class TestM365Mutelist:
         mutelist = M365Mutelist(mutelist_content=mutelist_content)
 
         finding = MagicMock
-        finding.tenant_id = "subscription_1"
         finding.check_metadata = MagicMock
         finding.check_metadata.CheckID = "check_test"
         finding.status = "FAIL"
@@ -65,7 +64,35 @@ class TestM365Mutelist:
         finding.tenant_domain = "test_domain"
         finding.resource_tags = []
 
-        assert mutelist.is_finding_muted(finding)
+        assert mutelist.is_finding_muted(finding, tenant_id="subscription_1")
+
+    def test_finding_is_not_muted(self):
+        # Mutelist
+        mutelist_content = {
+            "Accounts": {
+                "subscription_1": {
+                    "Checks": {
+                        "check_test": {
+                            "Regions": ["*"],
+                            "Resources": ["test_resource"],
+                        }
+                    }
+                }
+            }
+        }
+
+        mutelist = M365Mutelist(mutelist_content=mutelist_content)
+
+        finding = MagicMock
+        finding.check_metadata = MagicMock
+        finding.check_metadata.CheckID = "check_test"
+        finding.status = "FAIL"
+        finding.location = "global"
+        finding.resource_name = "test_resource"
+        finding.tenant_domain = "test_domain"
+        finding.resource_tags = []
+
+        assert not mutelist.is_finding_muted(finding, tenant_id="subscription_2")
 
     def test_mute_finding(self):
         # Mutelist