Just needed to clean up expired app registration secrets from a tenant, and figured I could just make a very quick script to find secrets and certificates that expire soon. Have fun – no explanation needed i guess.

Connect-AzureAD
$expiresWithinDays = 31
$expired = Get-AzureADApplication | ForEach-Object {
    $app = $_
    #$keys = Get-AzureADApplicationKeyCredential -ObjectId $_.ObjectId 
    @(
        Get-AzureADApplicationPasswordCredential -ObjectId $_.ObjectId
        Get-AzureADApplicationKeyCredential -ObjectId $_.ObjectId
    ) | Where-Object {
        $_.EndDate -lt (Get-Date).AddDays($expiresWithinDays)
    } | ForEach-Object {
        $id = "Not set"
        if($_.CustomKeyIdentifier) {
            $id = [System.Text.Encoding]::UTF8.GetString($_.CustomKeyIdentifier)
        }
        [PSCustomObject] @{
            App = $app.DisplayName
            ObjectID = $app.ObjectId
            AppId = $app.AppId
            Type = $_.GetType().name
            KeyIdentifier = $id
            EndDate = $_.EndDate
        }
    }
}

$expired | Out-GridView

Need a script to generate a report of all access package assignments in your tenants? Look no further.

Had an emergency at a customer today, where the IAM solution removed a few thousand users from licensing groups. In order to quickly add these back until the IAM system was operational again, the following method was used.

A quick script to get stuff from Azure AD using the batch endpoint, that can essentially let you run your scripts 10 to 20 times as fast in certain circumstances.

The Microsoft Graph finally should have all functionality that previously only the Azure AD Graph had, such as the ability to create and manage B2C user accounts. Earlier you had to create them through the Azure AD Graph, in order to do certain things such as setting the account type as local and managing username.

What should be a fairly straight forward select is not straight forward. Talking to the product group, this is on the horizon, but right now, this must be done through slow means.

Microsoft has not currently made it easy to figure out how to configure Seamless Single Sign-On when using AAD Connect Cloud Provisioning. Here is how!

This is a very quick cmdlet for getting attributes that does not match between two objects

<#
.Synopsis
   Returns a list of all attributes that does not match between two objects
#>
function Get-MismatchedAttributes
{
    [CmdletBinding()]
    [OutputType([boolean])]
    Param
    (
        [Parameter(Mandatory=$true,
                    ValueFromPipelineByPropertyName=$false,
                    Position=0)]
        $ReferenceObject,
              
        [Parameter(Mandatory=$true,
                    ValueFromPipelineByPropertyName=$false,
                    Position=1)]
        $DifferenceObject,

        [Parameter(Mandatory=$false,
                    ValueFromPipelineByPropertyName=$false,
                    Position=2)]
        [String[]] $Attributes = $null
    )

    if($Attributes -eq $null) {
        $Attributes = @(
            $ReferenceObject | gm -MemberType NoteProperty | select -exp Name
            $DifferenceObject | gm -MemberType NoteProperty | select -exp Name
        ) | Sort -Unique
    }
    
    $Attributes | Where {$ReferenceObject.$($_) -ne $DifferenceObject.$($_)}
}



$obj1 = [PSCustomObject] @{
    Attr1 = "abc"
    Attr2 = "def"
    Attr3 = "klm"
}

$obj2 = [PSCustomObject] @{
    Attr1 = "abc"
    Attr2 = "okj"
}

Write-Host "Attributes that does not match, limited to Attr1 and Attr2" -ForegroundColor Red
Get-MismatchedAttributes $obj1 $obj2 -Attributes "Attr1","Attr2"

Write-Host "All attributes that does not match" -ForegroundColor Red
Get-MismatchedAttributes $obj1 $obj2