Microsoft 365 SMTP AUTH Finder w/ Graph, OpenAI & Google Sheets

Microsoft 365 SMTP AUTH Finder w/ Graph, OpenAI & Google Sheets — Weekly risk detection for authenticated SMTP

Automatically find Microsoft 365 accounts that are sending email via SMTP AUTH (Basic auth), analyze the evidence with Microsoft Graph sign-in logs, generate an OpenAI remediation plan, and keep an always-updated inventory in Google Sheets—with a weekly status digest to Telegram.

What this workflow does

• Runs weekly: scheduled for every Monday at 08:00 (or can be tested manually using built-in sample data).
• Pulls evidence from Microsoft Graph:
  • Retrieves the Microsoft Graph email app usage user detail report (CSV).
  • Retrieves Entra ID sign-in events filtered to the “Authenticated SMTP” client app.
• Correlates and scores accounts: parses the usage report and aggregates sign-ins per account (counts, failures, last seen time, and sending IP addresses), then merges both sources into one record per account with a verdict (e.g., BREAKS end of Dec 2026, CHECK, or No SMTP use seen).
• Generates remediation guidance with OpenAI for accounts that need action—returning a structured device guess, a single recommended fix path, short steps, and a risk rating.
• Updates Google Sheets: appends or updates all account rows with the latest findings and actions.
• Sends a Telegram digest: while any accounts need attention, it posts a weekly summary status.

Use cases

• SaaS operators and IT teams hunting for legacy SMTP AUTH usage across Microsoft 365.
• Automation engineers validating risky email flows before enforcement deadlines.
• Security teams correlating Entra sign-ins with email app usage and tracking remediation progress.

Technical details

• Microsoft Graph: uses OAuth2 client credentials with application permissions Reports.Read.All and AuditLog.Read.All, calling Graph HTTP requests for the CSV usage report and Entra sign-in events.
• OpenAI: invoked to produce a structured remediation plan for flagged accounts.
• Google Sheets: stores and maintains the account inventory.
• Nodes/logic used: if, set, code, merge, telegram, plus supporting workflow steps.