Error when running Microsoft365 analysis exporting to html

[Bleh9000]

Hello,

When running -Instance Microsoft365 -Analysis 'Microsoft365' export to html (as well as entering tenant id, promptbehavior Selectaccount etc) I am getting a write-error stating "cannot bind argument to parameter 'items' because it is null".

I am not sure what to do here. I have tried all other commands and I get exports but when setting the analysis to 'Microsoft365' it gives me this error. When exporting with CSV it runs but it exports 2 CSVs.

o365_sway_sharing_settings.csv
o365_forms_current_user_info.csv

each CVS only has 1 row containing 8 columns but no information at all.

The account I am selecting is my admin account which has Global Reader and Security Reader within Entra -> Roles and Administrators.

When running the command again but selecting "PRINT" I get the below information
o365_sway_sharing_settings
o365_forms_current_user_info

Am I missing something? I would like to run a m365 scan and get as much information as I can.

[silverhack]

Hey @iWarrenD94 seems a permission issue. Your user should have correct permissions to access different services.

https://silverhack.github.io/monkey365/permissions/

Hope that helps

[Bleh9000]

@silverhack I understand what roles are needed for sharepoint but I am mainly talking about the instance Microsoft365 Analysis 'Microsoft365' not providing much data. I am not sure what I am doing wrong.

[silverhack]

Hey @iWarrenD94,

The best option would be to add -verbose and -informationAction continue parameter options to see what is happening under the hood.

Regarding the Microsoft365 option, and when is included into analysis, the tool will try to get some basic information from M365 admin portal.

[Bleh9000]

is the basic information that it grabs mainly 2 csv files with only 1 row worth of information? @silverhack

[silverhack]

Hi @Bleh9000,

That will vary depending on which license you have, but yes, that collector (Microsoft365) will try to get some basic info from Sway and Microsoft Forms. The following is an example for o365_forms_current_user_info.json:

{
  "id": "cf939585-5fb9-4eb2-949c-3de3b7feb8d4",
  "licenses": [
    {
      "licenseName": "FORMS_PLAN_E5",
      "skus": "[\"ENTERPRISEPREMIUM\"]"
    }
  ],
  "isPaidUser": true,
  "isRestrictedUser": false,
  "userReputationTier": 1,
  "legalAgeGroup": 0,
  "language": "en-US",
  "country": ""
}

As you probably already know, each Microsoft 365 plan includes a number of individual services, such as SharePoint Online, Exchange Online, Microsoft Teams, etc..., and Monkey365 is mainly designed to work with M365 E3/E5 licenses.

So if for example you want to gather data from a Microsoft 365 tenant, and you want to include all core services (Exchange, SharePoint, etc..), the following should work:

 $p = @{
    Instance = 'Microsoft365';
    Analysis = @('SharePointOnline','ExchangeOnline','Purview','MicrosoftTeams','Microsoft365');
    PromptBehavior = 'SelectAccount';
    ExportTo = @('HTML','CSV');
}
Invoke-Monkey365 @p

And if you want to also fetch data from Microsoft Entra ID, you should add the -IncludeEntraId flag, as shown below:

 $p = @{
    Instance = 'Microsoft365';
    Analysis = @('SharePointOnline','ExchangeOnline','Purview','MicrosoftTeams','Microsoft365');
    PromptBehavior = 'SelectAccount';
    IncludeEntraID = $true;
    ExportTo = @('HTML','CSV');
}
Invoke-Monkey365 @p

Hope that helps,

[Bleh9000]

Hi @silverhack
I tried running -IncludeEntraID but it took way too long. I was not able to find an explanation on what exactly that command did too. Mind explaining the purpose of that command?

[silverhack]

So if monkey takes too long to finish is mainly because very large environments, that is, a potential Entra ID with thousand of objects (users, groups, conditional access, etc..), and you will have this and other issues with very large environments.

For example on those environments, interactive credentials used with Monkey365 will time out and cause errors/exceptions. This is because Azure/Microsoft 365 access tokens have an expiration of roughly 60 minutes and Monkey365 does not currently support automatic refreshing tokens, and a workaround would be to execute Monkey365 with service principal authentication.

Another issue will be that local browsers (FF/Chrome/etc..) will crash rendering HTML reports for large environments.

So If your long run time is caused by a large Microsoft 365 environment, there is no current workaround. If you have large tenant, you can split the collection up by services using the Analysis, IncludeEntraID and ExcludeCollector flags.

Regarding collectors used by the tool, all are located under collectors folder, and an example report can be found at here.

[Bleh9000]

Hi @silverhack
Looking at the example report you linked atr the end of your response, looking under the Microsoft 365 tab, which of those results are from the Analysis 'Microsoft365' or are those results mainly from 'SharePointOnline','ExchangeOnline','Purview','MicrosoftTeams'

[Bleh9000]

Hi @silverhack
I think this may have answered our issue... What exactly is the 'Microsoft365' option scanning? or looking at? This here does not provide too much information other than "Retrieves basic information from Microsoft 365". I do not think we use Microsoft sway or forms which explains why there is no information for that.

[silverhack]

Short answer: You should look for collectors with the “Microsoft365” string within the Provider attribute.

Probably the name may cause immediate confusion about what’s included when you select “Microsoft365”.

The Microsoft355 flag will collect information from services or basic information that are not part of core services such as Exchange, Teams, etc..

Internally, Monkey365 will group collectors by provider, so if you select ExchangeOnline the tool will load collectors for ExchangeOnline only if the authentication and authorisation is successful.

If you do the same with Microsoft365, the tool will load collectors tied to “Microsoft365” provider and will collect basic info from Microsoft 365 admin blade, Sway, Forms,etc.

Basically every collector file contain a metadata object with information about the collector name, id, provider, etc.. You can find an example here

Just to mention that I’m working in some features that will be available in future versions of the tool. One of them is a new flag that can be used to list collectors (already implemented but not tested) and flags to list rules, among others.

Docs (and code) would benefit from further work so PR about docs, suggestions, re-wording, adding new collectors, code quality, etc, are always welcome.

Please, note that I’m the only dev for this project, and I’m doing my best in it.

Hope this clarifies your issue.

[Bleh9000]

Hi @silverhack,
Where can I find information on everything included in the Microsoft365 collector?

[silverhack]

Hi @Bleh9000,

Answered in last comment.

Cheers,

[Bleh9000]

Hi @silverhack,

I see. I got confused with the collectors within the m365 folder. They looked to me as if you were to select these options 'SharePointOnline','ExchangeOnline','Purview','MicrosoftTeams' and not 'Microsoft365'