Hi
I’ve got some workflows that are used by chatops to revoke entra id sessions or “cloud contain” users (i.e. pop them in a group that then causes conditional access to block) but these require knowledge of the UPN. In the org im at email ! = upn.
What are people using to search please?
The starting point typically will be Firstname Lastname which generally will match the display name.
Being a small team, being able to do some initial response via ms teams on mobile will cut down a bunch of time traveling to get in front of a computer.
I’ve tried using the InsightIDR plugin Search Accounts - thought process being the data is already in there but struggling to get the name to search on into the right object \ array format (sorry if i’ve got my terms muddled here).
Next thought is to try and query ms graph api, but before going down that rabbit hole check in with the brains trust here 
Thanks!