Offboard Microsoft Entra ID Users

Suspend or disable accounts in Azure Active Directory after securing approval via Jira or email, and track all of the relevant information in a Jira ticket.

If run with flowpipe server, this mod will scan Jira for issues approving Entra ID user offboarding.

Requirements

Docker daemon must be installed and running. Please see Install Docker Engine for more information.

Installation

Download and install Flowpipe (https://flowpipe.io/downloads). Or use Brew:

brew tap turbot/tap
brew install flowpipe

Clone:

git clone https://github.com/turbot/flowpipe-samples.git
cd public_cloud/offboard_entra_id_users

Install mod dependencies:

flowpipe mod install

Connections

By default, the following environment variables will be used for authentication:

AZURE_CLIENT_ID
AZURE_CLIENT_SECRET
AZURE_TENANT_ID
JIRA_API_TOKEN
JIRA_URL
JIRA_USER

You can also create connection resources in configuration files:

vi ~/.flowpipe/config/azure.fpc

connection "azure" "default" {
  client_id     = "<your client id>"
  client_secret = "<your client secret>"
  tenant_id     = "<your tenant id>"
}

vi ~/.flowpipe/config/jira.fpc

connection "jira" "default" {
  base_url    = "https://test.atlassian.net/"
  api_token   = "ATATT3........."
  username    = "abc@email.com"
}

For more information on connections in Flowpipe, please see Managing Connections.

Usage

Run the pipeline to create a Jira issue to update Entra ID user status:

flowpipe pipeline run update_entra_id_user_status --arg user_id=a1b2c3d4-1234-ab12-ae19-xxx --arg account_status=disable --arg project_key=project-foo

To scan Jira issues to disable Entra ID user at the scheduled time, start the Flowpipe server:

flowpipe server

Once started, Flowpipe will run the pipeline automatically at the scheduled time.

Configuration

To avoid entering variable values when running the pipeline or starting the server, you can set variable values:

cp flowpipe.fpvars.example flowpipe.fpvars
vi flowpipe.fpvars

# Required
project_key    = "project-foo"

# Optional
# jira_conn = "non_default_conn"
# azure_conn = "non_default_conn"