Good Workaround!

Building a multi tenant Azure AD application with roles

Through this blog post I will show how to build a multi tenant Azure AD application, where your customers can control role assignments through regular Azure AD app roles that they again can manage through Azure AD Entitlement Management, Access Reviews and dynamically assigned through dynamic groups.

The point of doing this kind of implementation is that you can externalize role management to the customer’s Azure AD, so that the customer can use all the great Azure AD features that exist for governing access, rather than needing to have yet another interface (your application) for assigning roles.

Clearing an attribute for all users through Microsoft Graph

Certain Azure AD attributes, such as businessPhones, are not available through the Azure AD PowerShell module. Here is a super quick way to work with the graph using PowerShell, without needing separate app registrations etc.

PowerShell for verifying Norwegian social security number / personnummer

function Get-IsSSNValid
{
    [CmdletBinding()]
    [Alias()]
    Param
    (
        # Param1 help description
        [Parameter(Mandatory=$true,
                   ValueFromPipeline=$true,
                   Position=0)]
        [String] $SSN
    )
 
  
 
    Process
    {
        $FirstPart = $SSN.Substring(0,9)
        $Check = $SSN.Substring(9,2)
 
  
 
        $k1 = 11 - ((3 * [int]::Parse($FirstPart.Chars(0)) + 7 * [int]::Parse($FirstPart.Chars(1)) + 6 * [int]::Parse($FirstPart.Chars(2)) + 1 * [int]::Parse($FirstPart.Chars(3)) + 8 * [int]::Parse($FirstPart.Chars(4)) + 9 * [int]::Parse($FirstPart.Chars(5)) + 4 * [int]::Parse($FirstPart.Chars(6)) + 5 * [int]::Parse($FirstPart.Chars(7)) + 2 * [int]::Parse($FirstPart.Chars(8))) % 11)
        if($k1 -eq "11") {
            $k1 = 0
        }

        $k2 = 11 - ((5 * [int]::Parse($FirstPart.Chars(0)) + 4 * [int]::Parse($FirstPart.Chars(1)) + 3 * [int]::Parse($FirstPart.Chars(2)) + 2 * [int]::Parse($FirstPart.Chars(3)) + 7 * [int]::Parse($FirstPart.Chars(4)) + 6 * [int]::Parse($FirstPart.Chars(5)) + 5 * [int]::Parse($FirstPart.Chars(6)) + 4 * [int]::Parse($FirstPart.Chars(7)) + 3 * [int]::Parse($FirstPart.Chars(8)) + 2 * $k1) % 11)
        if($k2 -eq "11") {
            $k2 = 0
        }
        return [int]::Parse($Check.Chars(0)) -eq $k1 -and [int]::Parse($Check.Chars(1)) -eq $k2
    }
}
 
  
 
Get-IsSSNValid "12345678910"

Sending merged emails through the Microsoft Graph using PowerShell

Some times there is a need to send merged emails to users or customers, where certain placeholders are replaced by usernames, email addresses, names etc. This blog post contains a script that can do this for you, using the Microsoft Graph. You need a regular account with Office 365 and Exchange Online for this to work.

Getting all Azure AD consents using PowerShell

Customers should really start paying attention to their Azure AD application consents, which can be daunting. There are obviously tools for this, even provided by Microsoft through Cloud App Security (CAS), but you know – why not simply dump out everything in Excel and parse through it?

This blog post contains a simple PowerShell script that does exactly this.

Getting Azure AD domain authentication information using PowerShell

This is a quick blog post with an example PowerShell cmdlet allowing you to find out what type of authentication and branding exists for a domain in Azure AD.

function Get-AzureADDomainInfoFromPublicApi
{
    [CmdletBinding()]
    [Alias()]
    Param
    (
        # Param1 help description
        [Parameter(Mandatory=$true,
                   ValueFromPipeline=$true,
                   Position=0)]
        [String] $Domain
    )

    Begin
    {
    }
    Process
    {
        $Url = "https://login.microsoftonline.com/common/userrealm/?user=someone.random@" + $Domain + "&checkForMicrosoftAccount=true&api-version=2.1"
        Invoke-RestMethod $Url
    }
    End
    {
    }
}

Get-AzureADDomainInfoFromPublicApi microsoft.com
Get-AzureADDomainInfoFromPublicApi innofactor.com

For example, in the output, if “AuthURL” contains a url you’ll see that ADFS is used and if is_dsso_enabled that means the Seamless SSO is active.

MIM – Finding users with certain changed attributes last 24 hours

This post contains a quick example on how to find users with certain attributes update the last 24 hours. The script uses the Lithnet PowerShell Module, which can be install using Install-Module LithnetRMA.