At a customer I needed to generate quite a few Azure AD dynamic groups, in order to create groups for each department, with users having a set of job titles. This is a good method to automatically assign application roles to a set of users based on their attributes, given that the attributes are managed by a sync from HR or similar. Here is how I did it.
Continue reading “Script for generating Azure AD dynamic groups”Category: Uncategorized
Script for getting Azure AD app registration secrets and certificates that expire soon
Just needed to clean up expired app registration secrets from a tenant, and figured I could just make a very quick script to find secrets and certificates that expire soon. Have fun – no explanation needed i guess.
Connect-AzureAD
$expiresWithinDays = 31
$expired = Get-AzureADApplication | ForEach-Object {
$app = $_
#$keys = Get-AzureADApplicationKeyCredential -ObjectId $_.ObjectId
@(
Get-AzureADApplicationPasswordCredential -ObjectId $_.ObjectId
Get-AzureADApplicationKeyCredential -ObjectId $_.ObjectId
) | Where-Object {
$_.EndDate -lt (Get-Date).AddDays($expiresWithinDays)
} | ForEach-Object {
$id = "Not set"
if($_.CustomKeyIdentifier) {
$id = [System.Text.Encoding]::UTF8.GetString($_.CustomKeyIdentifier)
}
[PSCustomObject] @{
App = $app.DisplayName
ObjectID = $app.ObjectId
AppId = $app.AppId
Type = $_.GetType().name
KeyIdentifier = $id
EndDate = $_.EndDate
}
}
}
$expired | Out-GridView
Generating report of all Access Package assignments in Azure AD Entitlement Management
Need a script to generate a report of all access package assignments in your tenants? Look no further.
Continue reading “Generating report of all Access Package assignments in Azure AD Entitlement Management”Generating demo Access Packages for AAD Entitlement Management through the Microsoft Graph
Some times it can be handy to be able to generate some demo content, and have some reference PowerShell for working with stuff. Here is my script for creating 5 access packages with different properties:
- A visible package available for any external user
- A hidden package available for any external user, requiring the user to know the url
- A package available to external users in connected organizations
- A package available for members of an internal group
- A package available to any internal user, with manager approval and self review
Script for adding back members to Azure AD group from audit log
Had an emergency at a customer today, where the IAM solution removed a few thousand users from licensing groups. In order to quickly add these back until the IAM system was operational again, the following method was used.
Continue reading “Script for adding back members to Azure AD group from audit log”Full IGA using Azure AD – Managing access using Entitlement Management
In this blog series on building a full Identity Governance and Administration solution, we have until now covered application roles extensively, and how these can be sent to an application.
For a quick summary, this is how you can define custom application roles, here is how to send these roles using the SCIM protocol, this article shows how to transfer the roles using the OpenID Connect ID Token or SAML claim and here I can show you how to use PowerShell to query the Microsoft Graph for application role assignments for your users and groups.
Continue reading “Full IGA using Azure AD – Managing access using Entitlement Management”Getting all direct reports from Azure AD using the batch endpoint
A quick script to get stuff from Azure AD using the batch endpoint, that can essentially let you run your scripts 10 to 20 times as fast in certain circumstances.
Continue reading “Getting all direct reports from Azure AD using the batch endpoint”