https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/playbook-for-disabling-azure-user/m-p/1251438#M4244 <P>I want to create a playbook that uses the Microsoft Graph integration to disable and revoke a users sessions. I have a problem with the alerts not containing the UPN but instead creates its own naming convention that follows the format domain\user.&nbsp;</P> <P>Looking at some of the built in playbooks that work with graph queries, the input field for UPN is&nbsp;<SPAN>Core.OriginalAlert.event.raw_log.properties.targetResources.userPrincipalName which I cannot get to work in my playbook. When running the command, !msgraph-user-account-disable, manually from the war room and selecting the input as the built in "UPN" it also looks like this defaults to&nbsp;${issue.original_alert_json.raw_abioc.event.auth_normalized_user.upn} but it does not successfully pull any data and errors out. Please let me know if there is another way I can do this on my end or if its something Palo needs to look at&nbsp;</SPAN></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="clairamore_0-1775144659139.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/71103i3435C66D1B365A98/image-size/medium?v=v2&amp;px=400" role="button" title="clairamore_0-1775144659139.png" alt="clairamore_0-1775144659139.png" /></span></P> <P>&nbsp;</P> Thu, 02 Apr 2026 15:45:05 GMT clairamore 2026-04-02T15:45:05Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/playbook-for-disabling-azure-user/m-p/1251438#M4244 <P>I want to create a playbook that uses the Microsoft Graph integration to disable and revoke a users sessions. I have a problem with the alerts not containing the UPN but instead creates its own naming convention that follows the format domain\user.&nbsp;</P> <P>Looking at some of the built in playbooks that work with graph queries, the input field for UPN is&nbsp;<SPAN>Core.OriginalAlert.event.raw_log.properties.targetResources.userPrincipalName which I cannot get to work in my playbook. When running the command, !msgraph-user-account-disable, manually from the war room and selecting the input as the built in "UPN" it also looks like this defaults to&nbsp;${issue.original_alert_json.raw_abioc.event.auth_normalized_user.upn} but it does not successfully pull any data and errors out. Please let me know if there is another way I can do this on my end or if its something Palo needs to look at&nbsp;</SPAN></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="clairamore_0-1775144659139.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/71103i3435C66D1B365A98/image-size/medium?v=v2&amp;px=400" role="button" title="clairamore_0-1775144659139.png" alt="clairamore_0-1775144659139.png" /></span></P> <P>&nbsp;</P> Thu, 02 Apr 2026 15:45:05 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/playbook-for-disabling-azure-user/m-p/1251438#M4244 clairamore 2026-04-02T15:45:05Z