Checking Azure AD tenant id using PowerShell

This is a short blog post with a PowerShell cmdlet that will return you the Azure AD tenant id for a given domain.

function Get-AzureADTenantId
{
    [CmdletBinding()]
    [Alias()]
    [OutputType([string])]
    Param
    (
        # Param1 help description
        [Parameter(Mandatory=$true,
                   ValueFromPipelineByPropertyName=$true,
                   Position=0)]
        $DomainName
    )

    Begin
    {
        Load-Assembly System.Xml.Linq | Out-Null
    }
    Process
    {
        $FederationMetadata = Get-AzureADFederationMetadata -Domain $DomainName
        $FederationMetadata.EntityDescriptor.entityID -split "/" | where{$_ -match "^[a-zA-Z0-9]{8}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{4}-[a-zA-Z0-9]{12}$"}
    }
    End
    {
    }
}

Get-AzureADTenantId microsoft.com
Get-AzureADTenantId microsoft.onmicrosoft.com

Populating Azure AD named and trusted locations using Graph

This post contains a quick example on how to utilize the new namedLocation Graph REST API endpoints to populate conditional access sites.

For simplicity, the script utilizes the access token from the Graph Explorer, rather than it’s own application registration. Continue reading “Populating Azure AD named and trusted locations using Graph”

Full IGA using Azure AD – Getting app role assignments using PowerShell

In this post I will quickly demo how to use PowerShell to get app role assignments for all application using the Microsoft Graph.

You should have followed my previous post in order to have created an application, added some appRoles to the manifest and granted access to the Graph.

Continue reading “Full IGA using Azure AD – Getting app role assignments using PowerShell”

Full IGA using Azure AD – App roles in OAuth ID token or SAML claim

In the last post we transferred to user information and roles to the application through Azure AD outbound provisioning with SCIM. This requires the application to either have or to implement a SCIM API, which might some times be unnecessary. Also, many applications does not have an internal user database, but relies on session information when doing access control.

In this blog post I will show you how applications can get user roles through the user’s ID token, demoed with OAuth 2.0 authorization code flow.

Continue reading “Full IGA using Azure AD – App roles in OAuth ID token or SAML claim”

Full IGA using Azure AD – Provisioning using SCIM

Continuing my series on how to achieve a full “Identity Governance and Administration” (IGA) solution using Azure AD, the topic this time and for the next few posts will be provisioning, with focus on actually transferring the app roles from my previous post into the application itself.

Continue reading “Full IGA using Azure AD – Provisioning using SCIM”