From ce8f6037c1b199e5b71956af121cab3bcb162afb Mon Sep 17 00:00:00 2001
From: "Hugo P.Brito" <hugopbrit@gmail.com>
Date: Mon, 11 May 2026 12:00:08 +0100
Subject: [PATCH] fix(m365): drop misleading fallbacks when parsing PIM alert
 incidents

The DirectoryRoleStaleSignInAlertIncident schema does not expose 'subject',
'createdDateTime', or any field whose 'id' represents the affected user, so
the previous fallbacks silently substituted the wrong values and made
status_extended messages refer to the incident GUID instead of the actual
user when the API response omitted assigneeId/assigneeDisplayName.

Read each field directly from the documented incident properties so an
empty value stays empty rather than being papered over with unrelated
data.
---
 .../m365/services/entra/entra_service.py      | 24 ++++++++-----------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/prowler/providers/m365/services/entra/entra_service.py b/prowler/providers/m365/services/entra/entra_service.py
index 60683b72ed..9478d5c275 100644
--- a/prowler/providers/m365/services/entra/entra_service.py
+++ b/prowler/providers/m365/services/entra/entra_service.py
@@ -1086,22 +1086,18 @@ OAuthAppInfo
                     incidents = alert.get("alertIncidents", [])
                     affected_items = []
                     for incident in incidents:
-                        assignee_display_name = incident.get(
-                            "assigneeDisplayName", ""
-                        ) or incident.get("subject", "")
-                        assignee_id = incident.get("assigneeId", "") or incident.get(
-                            "id", ""
-                        )
-                        role_display_name = incident.get("roleDisplayName", "")
-                        last_sign_in = incident.get(
-                            "lastSignInDateTime", ""
-                        ) or incident.get("createdDateTime", "")
                         affected_items.append(
                             PimAlertIncident(
-                                assignee_display_name=assignee_display_name,
-                                assignee_id=assignee_id,
-                                role_display_name=role_display_name,
-                                last_sign_in_date_time=last_sign_in,
+                                assignee_display_name=incident.get(
+                                    "assigneeDisplayName", ""
+                                ),
+                                assignee_id=incident.get("assigneeId", ""),
+                                role_display_name=incident.get(
+                                    "roleDisplayName", ""
+                                ),
+                                last_sign_in_date_time=incident.get(
+                                    "lastSignInDateTime", ""
+                                ),
                             )
                         )
                     pim_alerts[alert_definition_id] = PimAlert(