mirror of
https://github.com/Gerenios/AADInternals
synced 2026-06-08 11:09:38 +00:00
Nestori
364 lines
11 KiB
PowerShell
364 lines
11 KiB
PowerShell
# This file contains functions utilising https://admin.microsoft.com API
|
|
|
|
# Approves the delegated admin request
|
|
# Sep 22nd 2021
|
|
function Approve-MSPartnerDelegatedAdminRequest
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Assigns Delegated Admin Permissions (DAP) for the given partner organisation.
|
|
|
|
.DESCRIPTION
|
|
Assigns Delegated Admin Permissions (DAP) for the given partner organisation.
|
|
|
|
.Parameter TenantId
|
|
TenantId of the partner organisation.
|
|
|
|
.Parameter Domain
|
|
Any registered domain of the partner organisation.
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
|
|
PS C:\>Approve-AADIntMSPartnerDelegatedAdminRequest -Domain company.com
|
|
|
|
responseCode message
|
|
------------ -------
|
|
success
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
|
|
PS C:\>Approve-AADIntMSPartnerDelegatedAdminRequest -TenantId c7e52a77-e461-4f2e-a652-573305414be9
|
|
|
|
responseCode message
|
|
------------ -------
|
|
success
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='TenantId',Mandatory=$True)]
|
|
[guid]$TenantId,
|
|
[Parameter(ParameterSetName='Domain',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken
|
|
)
|
|
Process
|
|
{
|
|
if($Domain)
|
|
{
|
|
$TenantId = Get-TenantID -Domain $Domain
|
|
}
|
|
|
|
$body = @{
|
|
"authorizeDelegateAdminData" = [ordered]@{
|
|
"msppId" = 0
|
|
"partnerId" = $TenantId
|
|
"companyName" = " "
|
|
"indirectCSPId" = ""
|
|
"userTenantId" = (Read-Accesstoken $AccessToken).tid
|
|
"enableDap" = $true
|
|
"invitationType" = "Administration"
|
|
"address" = $null
|
|
"roles" = @(
|
|
"62e90394-69f5-4237-9190-012177145e10" # Global Administrator
|
|
"729827e3-9c14-49f7-bb1b-9608f156bbb8" # Helpdesk Administrator
|
|
)
|
|
"userPrincipalName" = $null
|
|
}
|
|
|
|
}
|
|
|
|
try
|
|
{
|
|
$response = Invoke-AdminAPI -Method Post -AccessToken $AccessToken -Url "fd/commerceMgmt/partnermanage/partners/csp/delegatedaccess?api-version=2.1" -Body ($body | ConvertTo-Json)
|
|
}
|
|
catch
|
|
{
|
|
Write-Error ($_.ErrorDetails.Message | ConvertFrom-Json).error.message
|
|
return
|
|
}
|
|
|
|
$response
|
|
}
|
|
}
|
|
|
|
# Gets the list of partners
|
|
# Dec 9th 2021
|
|
function Get-MSPartners
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Shows organisation's partners.
|
|
|
|
.DESCRIPTION
|
|
Shows organisation's partners using Admin API.
|
|
|
|
.Parameter AccessToken
|
|
Access token to retrieve partners.
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
|
|
PS C:\>Get-AADIntMSPartners
|
|
|
|
Identity : b1f6d5cc-f1d3-41d9-b88c-1d177aaf171b
|
|
DisplayName : Partner Ltd
|
|
Email : pmanager@company.com
|
|
Website : http://www.company.com
|
|
Phone : +1234567890
|
|
Relationship : Indirect Reseller and Admin
|
|
TypeDetail : PartnerAdmin
|
|
CanDelete : False
|
|
CanRemoveDap : True
|
|
AllDataRetrieved : True
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken
|
|
)
|
|
Process
|
|
{
|
|
try
|
|
{
|
|
$response = Invoke-AdminAPI -AccessToken $AccessToken -Url "admin/api/Partners/GetPartners" -Method Post
|
|
}
|
|
catch
|
|
{
|
|
if($_.ErrorDetails.Message)
|
|
{
|
|
throw $_.ErrorDetails.Message
|
|
}
|
|
else
|
|
{
|
|
throw $_.Exception.Message
|
|
}
|
|
return
|
|
}
|
|
|
|
$response
|
|
}
|
|
}
|
|
|
|
# Returns access token for the requested resource
|
|
# Dec 9th 2021
|
|
function Get-AccessTokenUsingAdminAPI
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets access token for the requested resource using Admin API.
|
|
|
|
.DESCRIPTION
|
|
Gets access token for the requested resource using Admin API.
|
|
The client id of the retuned access token is 00000006-0000-0ff1-ce00-000000000000 (Microsoft Office 365 Portal).
|
|
|
|
.Parameter Access
|
|
Some supported type of access token.
|
|
|
|
.Parameter TokenType
|
|
The type of the access token to return. Can be one of "PortalAT","BusinessStoreAT"
|
|
|
|
.Parameter Resource
|
|
Gets an access token for the given resource. Can be one of "https://management.core.windows.net/","https://graph.microsoft.com/"
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
|
|
PS C:\>$at = Get-AADIntAccessTokenUsingAdminAPI -TokenType PortalAT
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
|
|
PS C:\>$at = Get-AADIntAccessTokenUsingAdminAPI -Resource https://management.core.windows.net/
|
|
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Normal',Mandatory=$True)]
|
|
[ValidateSet('PortalAT','BusinessStoreAT')]
|
|
[String]$TokenType,
|
|
[Parameter(ParameterSetName='Resource',Mandatory=$True)]
|
|
[ValidateSet('https://graph.microsoft.com/','https://management.core.windows.net/')]
|
|
[String]$Resource,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[Microsoft.PowerShell.Commands.WebRequestSession]$WebSession,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$SaveToCache=$False
|
|
)
|
|
Process
|
|
{
|
|
if($TokenType)
|
|
{
|
|
$access_token = Invoke-AdminAPI -AccessToken $AccessToken -Url "admin/api/users/getuseraccesstoken?tokenType=$TokenType" -Method Get -WebSession $WebSession
|
|
}
|
|
else
|
|
{
|
|
$access_token = Invoke-AdminAPI -AccessToken $AccessToken -Url "admin/api/users/token" -Method Post -Body "=$Resource"
|
|
}
|
|
|
|
if($SaveToCache)
|
|
{
|
|
Add-AccessTokenToCache -AccessToken $access_token
|
|
}
|
|
else
|
|
{
|
|
$access_token
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
# Approves the delegated admin request
|
|
# Dec 11th 2021
|
|
function Remove-MSPartnerDelegatedAdminRoles
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Removes Delegated Admin Permissions (DAP) from the given partner organisation.
|
|
|
|
.DESCRIPTION
|
|
Removes Delegated Admin Permissions (DAP) from the given partner organisation.
|
|
|
|
.Parameter TenantId
|
|
TenantId of the partner organisation.
|
|
|
|
.Parameter Domain
|
|
Any registered domain of the partner organisation.
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
|
|
PS C:\>Remove-AADIntMSPartnerDelegatedAdminRoles -Domain company.com
|
|
|
|
responseCode message
|
|
------------ -------
|
|
success
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
|
|
PS C:\>Remove-AADIntMSPartnerDelegatedAdminRoles -TenantId c7e52a77-e461-4f2e-a652-573305414be9
|
|
|
|
responseCode message
|
|
------------ -------
|
|
success
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='TenantId',Mandatory=$True)]
|
|
[guid]$TenantId,
|
|
[Parameter(ParameterSetName='Domain',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken
|
|
)
|
|
Process
|
|
{
|
|
if($Domain)
|
|
{
|
|
$TenantId = Get-TenantID -Domain $Domain
|
|
}
|
|
|
|
try
|
|
{
|
|
$response = Invoke-AdminAPI -Method Delete -AccessToken $AccessToken -Url "fd/commerceMgmt/partnermanage/partners/csp/$TenantId/delegatedaccess?api-version=2.1"
|
|
}
|
|
catch
|
|
{
|
|
Write-Error ($_.ErrorDetails.Message | ConvertFrom-Json).error.message
|
|
return
|
|
}
|
|
|
|
$response
|
|
}
|
|
}
|
|
|
|
# Returns tenant organisation information
|
|
# Jan 26th 2022
|
|
function Get-TenantOrganisationInformation
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Returns organisation information for the given tenant.
|
|
|
|
.DESCRIPTION
|
|
Returns organisation information for the given tenant using commercial API used to get Partner Tenant information.
|
|
|
|
.Parameter AccessToken
|
|
Access Token used to fetch information. Can be any standard user of any tenant.
|
|
|
|
.Parameter TenantId
|
|
TenantId of the target tenant.
|
|
|
|
.Parameter Domain
|
|
Domain name of the target tenant.
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
|
|
|
|
PS C:\>Get-AADIntTenantOrganisationInformation -Domain "company.com"
|
|
|
|
TenantId : 043050e2-7993-416a-ae66-108ab1951612
|
|
CompanyName : Company Ltd
|
|
StreetAddress : 10 Wall Street
|
|
ApartmentOrSuite : 666
|
|
City : New York
|
|
StateOrProvince : NY
|
|
PostalCode : 10005
|
|
CountryCode : US
|
|
PhoneNumber : 1234567890
|
|
FirstName : John
|
|
LastName : Doe
|
|
#>
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(ParameterSetName='Domain',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='TenantId',Mandatory=$True)]
|
|
[guid]$TenantId
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://admin.microsoft.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c"
|
|
|
|
if($Domain)
|
|
{
|
|
[guid]$TenantId = [guid](Get-TenantID -Domain $Domain)
|
|
}
|
|
|
|
if($TenantId -eq ([guid](Read-AccessToken $AccessToken).tid))
|
|
{
|
|
Write-Error "Can't query information from your own tenant. Log in to another tenant and try again."
|
|
return
|
|
}
|
|
|
|
$headers = @{
|
|
"Authorization" = "Bearer $AccessToken"
|
|
"Accept" = "application/json; charset=utf-8"
|
|
}
|
|
$response = Invoke-WebRequest -UseBasicParsing -uri "https://admin.microsoft.com/fd/commerceMgmt/partnermanage/partners/csp/$($TenantId.toString())/delegatedaccess?invType=Administration&api-version=2.1" -Headers $headers
|
|
|
|
# Content is utf-8 encoded json, but response headers don't have encoding information
|
|
$responseBytes = New-Object byte[] $response.RawContentLength
|
|
$response.RawContentStream.Read($responseBytes,0,$response.RawContentLength)
|
|
$responseObj = ConvertFrom-Json -InputObject ([text.encoding]::UTF8.GetString($responseBytes))
|
|
|
|
$tenantInfo = $responseObj.authorizeDelegateAdminData
|
|
|
|
$attributes = [ordered]@{
|
|
"TenantId" = $tenantInfo.partnerId
|
|
"CompanyName" = $tenantInfo.companyName
|
|
"StreetAddress" = $tenantInfo.address.line1
|
|
"ApartmentOrSuite" = $tenantInfo.address.line2
|
|
#"Line3" = $tenantInfo.address.line3
|
|
"City" = $tenantInfo.address.city
|
|
"StateOrProvince" = $tenantInfo.address.state
|
|
"PostalCode" = $tenantInfo.address.postalCode
|
|
"CountryCode" = $tenantInfo.address.countryCode
|
|
"PhoneNumber" = $tenantInfo.address.phoneNumber
|
|
"FirstName" = $tenantInfo.address.firstName
|
|
"LastName" = $tenantInfo.address.lastName
|
|
}
|
|
|
|
New-Object psobject -Property $attributes
|
|
}
|
|
} |