feat(docs): update Azure and M365 docs with needed permissions (#8075)

docs/getting-started/requirements.md

@@ -70,9 +70,13 @@ The other three cases does not need additional configuration, `--az-cli-auth` an
 Prowler for Azure needs two types of permission scopes to be set:
 
 - **Microsoft Entra ID permissions**: used to retrieve metadata from the identity assumed by Prowler and specific Entra checks (not mandatory to have access to execute the tool). The permissions required by the tool are the following:
-    - `Domain.Read.All`
+    - `Directory.Read.All`
     - `Policy.Read.All`
     - `UserAuthenticationMethod.Read.All` (used only for the Entra checks related with multifactor authentication)
+
+    ???+ note
+        You can replace `Directory.Read.All` with `Domain.Read.All` that is a more restrictive permission but you won't be able to run the Entra checks related with DirectoryRoles and GetUsers.
+
 - **Subscription scope permissions**: required to launch the checks against your resources, mandatory to launch the tool. It is required to add the following RBAC builtin roles per subscription to the entity that is going to be assumed by the tool:
     - `Reader`
     - `ProwlerRole` (custom role with minimal permissions defined in [prowler-azure-custom-role](https://github.com/prowler-cloud/prowler/blob/master/permissions/prowler-azure-custom-role.json))
@@ -205,12 +209,17 @@ Prowler for M365 requires two types of permission scopes to be set (if you want
 
 - **Service Principal Application Permissions**: These are set at the **application** level and are used to retrieve data from the identity being assessed:
     - `AuditLog.Read.All`: Required for Entra service.
-    - `Domain.Read.All`: Required for all services.
-    - `Organization.Read.All`: Required for retrieving tenant information.
+    - `Directory.Read.All`: Required for all services.
     - `Policy.Read.All`: Required for all services.
     - `SharePointTenantSettings.Read.All`: Required for SharePoint service.
     - `User.Read` (IMPORTANT: this must be set as **delegated**): Required for the sign-in.
 
+    ???+ note
+        You can replace `Directory.Read.All` with `Domain.Read.All` is a more restrictive permission but you won't be able to run the Entra checks related with DirectoryRoles and GetUsers.
+
+        > If you do this you will need to add also the `Organization.Read.All` permission to the service principal application in order to authenticate.
+
+
 
 - **Powershell Modules Permissions**: These are set at the `M365_USER` level, so the user used to run Prowler must have one of the following roles:
     - `Global Reader` (recommended): this allows you to read all roles needed.

docs/tutorials/azure/getting-started-azure.md

@@ -90,11 +90,14 @@ A Service Principal is required to grant Prowler the necessary privileges.
 
 Assign the following Microsoft Graph permissions:
 
-    - Domain.Read.All
+- Directory.Read.All
 
-    - Policy.Read.All
+- Policy.Read.All
 
-    - UserAuthenticationMethod.Read.All (optional, for MFA checks)
+- UserAuthenticationMethod.Read.All (optional, for MFA checks)
+
+???+ note
+    You can replace `Directory.Read.All` with `Domain.Read.All` that is a more restrictive permission but you won't be able to run the Entra checks related with DirectoryRoles and GetUsers.
 
 1. Go to your App Registration > `API permissions`
 
@@ -107,7 +110,7 @@ Assign the following Microsoft Graph permissions:
 
 3. Search and select:
 
-    - `Domain.Read.All`
+    - `Directory.Read.All`
     - `Policy.Read.All`
     - `UserAuthenticationMethod.Read.All`
 

docs/tutorials/microsoft365/getting-started-m365.md

@@ -95,12 +95,18 @@ With this done you will have all the needed keys, summarized in the following ta
 ### Grant required API permissions
 
 Assign the following Microsoft Graph permissions:
+
 - `AuditLog.Read.All`: Required for Entra service.
-- `Domain.Read.All`: Required for all services.
+- `Directory.Read.All`: Required for all services.
 - `Policy.Read.All`: Required for all services.
 - `SharePointTenantSettings.Read.All`: Required for SharePoint service.
 - `User.Read` (IMPORTANT: this is set as **delegated**): Required for the sign-in.
 
+???+ note
+    You can replace `Directory.Read.All` with `Domain.Read.All` is a more restrictive permission but you won't be able to run the Entra checks related with DirectoryRoles and GetUsers.
+
+    > If you do this you will need to add also the `Organization.Read.All` permission to the service principal application in order to authenticate.
+
 Follow these steps to assign the permissions:
 
 1. Go to your App Registration > Select your Prowler App created before > click on `API permissions`
@@ -113,8 +119,7 @@ Follow these steps to assign the permissions:
 
 3. Search and select every permission below and once all are selected click on `Add permissions`:
     - `AuditLog.Read.All`: Required for Entra service.
-    - `Domain.Read.All`
-    - `Organization.Read.All`
+    - `Directory.Read.All`
     - `Policy.Read.All`
     - `SharePointTenantSettings.Read.All`
 
@@ -134,7 +139,7 @@ Follow these steps to assign the permissions:
 
     ![Permission Screenshots](./img/directory-permission-delegated.png)
 
-6. Click `Add permissions`, then **grant admin consent**
+6. After adding all the permissions, click on `Grant admin consent`
 
     ![Grant Admin Consent](./img/grant-admin-consent.png)
 

prowler/CHANGELOG.md

@@ -37,6 +37,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Azure Databricks service integration for Azure provider, including the `databricks_workspace_vnet_injection_enabled` check [(#8008)](https://github.com/prowler-cloud/prowler/pull/8008)
 - Azure Databricks check `databricks_workspace_cmk_encryption_enabled` to ensure workspaces use customer-managed keys (CMK) for encryption at rest [(#8017)](https://github.com/prowler-cloud/prowler/pull/8017)
 - Add `storage_account_default_to_entra_authorization_enabled` check for Azure provider. [(#7981)](https://github.com/prowler-cloud/prowler/pull/7981)
+- Replace `Domain.Read.All` with `Directory.Read.All` in Azure and M365 docs [(#8075)](https://github.com/prowler-cloud/prowler/pull/8075)
 
 ### Removed
 - OCSF version number references to point always to the latest [(#8064)](https://github.com/prowler-cloud/prowler/pull/8064)

prowler/providers/azure/services/entra/entra_service.py

@@ -45,38 +45,45 @@ class Entra(AzureService):
             for tenant, client in self.clients.items():
                 users_list = await client.users.get()
                 users.update({tenant: {}})
-                for user in users_list.value:
-                    users[tenant].update(
-                        {
-                            user.id: User(
-                                id=user.id,
-                                name=user.display_name,
-                                authentication_methods=[
-                                    AuthMethod(
-                                        id=auth_method.id,
-                                        type=getattr(auth_method, "odata_type", None),
-                                    )
-                                    for auth_method in (
-                                        await client.users.by_user_id(
-                                            user.id
-                                        ).authentication.methods.get()
-                                    ).value
-                                ],
-                            )
-                        }
-                    )
+                try:
+                    for user in users_list.value:
+                        users[tenant].update(
+                            {
+                                user.id: User(
+                                    id=user.id,
+                                    name=user.display_name,
+                                    authentication_methods=[
+                                        AuthMethod(
+                                            id=auth_method.id,
+                                            type=getattr(
+                                                auth_method, "odata_type", None
+                                            ),
+                                        )
+                                        for auth_method in (
+                                            await client.users.by_user_id(
+                                                user.id
+                                            ).authentication.methods.get()
+                                        ).value
+                                    ],
+                                )
+                            }
+                        )
+                except Exception as error:
+                    if (
+                        error.__class__.__name__ == "ODataError"
+                        and error.__dict__.get("response_status_code", None) == 403
+                    ):
+                        logger.error(
+                            "You need 'UserAuthenticationMethod.Read.All' permission to access this information. It only can be granted through Service Principal authentication."
+                        )
+                    else:
+                        logger.error(
+                            f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                        )
         except Exception as error:
-            if (
-                error.__class__.__name__ == "ODataError"
-                and error.__dict__.get("response_status_code", None) == 403
-            ):
-                logger.error(
-                    "You need 'UserAuthenticationMethod.Read.All' permission to access this information. It only can be granted through Service Principal authentication."
-                )
-            else:
-                logger.error(
-                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                )
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
 
         return users