Fetch Microsoft MFA statuses

[gearnode]

Summary

• Fetch Microsoft Graph authentication-method registration details during Microsoft 365 access reviews.
• Map registered MFA users to enabled, unregistered users to disabled, and unmatched users to unknown.
• Add the Microsoft Graph AuditLog.Read.All OAuth scope needed for the MFA registration report.

Tests

• make go-fmt
• go test ./pkg/accessreview/drivers ./pkg/connector/provider
• git diff --check

Note: golangci-lint is not installed in the local cloud container, so the exact CI lint command could not be rerun locally.

Linear Issue: ENG-467

  

---

Summary by cubic

Show MFA status for Microsoft 365 users in access reviews by fetching Graph user registration details and mapping them to coredata.MFAStatus. Adds the https://graph.microsoft.com/AuditLog.Read.All scope and addresses ENG-467 (Microsoft connector does not show MFA).

Service +99 -1

• Fetch reports/authenticationMethods/userRegistrationDetails with pagination.
• Map isMfaRegistered to Enabled/Disabled/Unknown.
• Match users by ID and case-insensitive UPN; default to unknown when not found.
• Request https://graph.microsoft.com/AuditLog.Read.All in Microsoft 365 connector registration.

Tests +98 -0

• Mock Graph endpoints and validate MFA mapping (enabled, disabled, case-insensitive UPN fallback, unknown).
• Verify admin role assignment for Global Administrator.

^{Written for commit d9d33b6. Summary will update on new commits.}