mirror of
https://github.com/Gerenios/AADInternals
synced 2026-06-08 11:09:38 +00:00
Nestori
1289 lines
44 KiB
PowerShell
1289 lines
44 KiB
PowerShell
# This script contains functions for MSGraph API at https://graph.microsoft.com
|
|
|
|
# Returns the 50 latest signin entries or the given entry
|
|
# Jun 9th 2020
|
|
function Get-AzureSignInLog
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Returns the 50 latest entries from Azure AD sign-in log or single entry by id
|
|
|
|
.DESCRIPTION
|
|
Returns the 50 latest entries from Azure AD sign-in log or single entry by id
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph
|
|
PS C:\>Get-AADIntAzureSignInLog
|
|
|
|
createdDateTime id ipAddress userPrincipalName appDisplayName
|
|
--------------- -- --------- ----------------- --------------
|
|
2020-05-25T05:54:28.5131075Z b223590e-8ba1-4d54-be54-03071659f900 199.11.103.31 admin@company.onmicrosoft.com Azure Portal
|
|
2020-05-29T07:56:50.2565658Z f6151a97-98cc-444e-a79f-a80b54490b00 139.93.35.110 user@company.com Azure Portal
|
|
2020-05-29T08:02:24.8788565Z ad2cfeff-52f2-442a-b8fc-1e951b480b00 11.146.246.254 user2@company.com Microsoft Docs
|
|
2020-05-29T08:56:48.7857468Z e0f8e629-863f-43f5-a956-a4046a100d00 1.239.249.24 admin@company.onmicrosoft.com Azure Active Directory PowerShell
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph
|
|
PS C:\>Get-AADIntAzureSignInLog
|
|
|
|
createdDateTime id ipAddress userPrincipalName appDisplayName
|
|
--------------- -- --------- ----------------- --------------
|
|
2020-05-25T05:54:28.5131075Z b223590e-8ba1-4d54-be54-03071659f900 199.11.103.31 admin@company.onmicrosoft.com Azure Portal
|
|
2020-05-29T07:56:50.2565658Z f6151a97-98cc-444e-a79f-a80b54490b00 139.93.35.110 user@company.com Azure Portal
|
|
2020-05-29T08:02:24.8788565Z ad2cfeff-52f2-442a-b8fc-1e951b480b00 11.146.246.254 user2@company.com Microsoft Docs
|
|
2020-05-29T08:56:48.7857468Z e0f8e629-863f-43f5-a956-a4046a100d00 1.239.249.24 admin@company.onmicrosoft.com Azure Active Directory PowerShell
|
|
|
|
PS C:\>Get-AADIntAzureSignInLog -EntryId b223590e-8ba1-4d54-be54-03071659f900
|
|
|
|
id : b223590e-8ba1-4d54-be54-03071659f900
|
|
createdDateTime : 2020-05-25T05:54:28.5131075Z
|
|
userDisplayName : admin company
|
|
userPrincipalName : admin@company.onmicrosoft.com
|
|
userId : 289fcdf8-af4e-40eb-a363-0430bc98d4d1
|
|
appId : c44b4083-3bb0-49c1-b47d-974e53cbdf3c
|
|
appDisplayName : Azure Portal
|
|
ipAddress : 199.11.103.31
|
|
clientAppUsed : Browser
|
|
userAgent : Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36
|
|
...
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$EntryId,
|
|
[switch]$Export
|
|
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
# Select one entry if provided
|
|
if($EntryId)
|
|
{
|
|
$queryString = "`$filter=id eq '$EntryId'"
|
|
}
|
|
else
|
|
{
|
|
$queryString = "`$top=50&`$orderby=createdDateTime"
|
|
}
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "auditLogs/signIns" -QueryString $queryString
|
|
|
|
# Return full results
|
|
if($Export)
|
|
{
|
|
return $results
|
|
}
|
|
elseif($EntryId) # The single entry
|
|
{
|
|
return $results
|
|
}
|
|
else # Print out only some info - the API always returns all info as $Select is not supported :(
|
|
{
|
|
$results | select createdDateTime,id,ipAddress,userPrincipalName,appDisplayName | ft
|
|
}
|
|
}
|
|
}
|
|
|
|
# Returns the 50 latest signin entries or the given entry
|
|
# Jun 9th 2020
|
|
function Get-AzureAuditLog
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Returns the 50 latest entries from Azure AD sign-in log or single entry by id
|
|
|
|
.DESCRIPTION
|
|
Returns the 50 latest entries from Azure AD sign-in log or single entry by id
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph
|
|
PS C:\>Get-AADIntAzureAuditLog
|
|
|
|
id activityDateTime activityDisplayName operationType result initiatedBy
|
|
-- ---------------- ------------------- ------------- ------ -----------
|
|
Directory_9af6aff3-dc09-4ac1-a1d3-143e80977b3e_EZPWC_41985545 2020-05-29T07:57:51.4037921Z Add service principal Add success @{user=; app=}
|
|
Directory_f830a9d4-e746-48dc-944c-eb093364c011_1ZJAE_22273050 2020-05-29T07:57:51.6245497Z Add service principal Add failure @{user=; app=}
|
|
Directory_a813bc02-5d7a-4a40-9d37-7d4081d42b42_RKRRS_12877155 2020-06-02T12:49:38.5177891Z Add user Add success @{app=; user=}
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph
|
|
PS C:\>Get-AADIntAzureAuditLog
|
|
|
|
id activityDateTime activityDisplayName operationType result initiatedBy
|
|
-- ---------------- ------------------- ------------- ------ -----------
|
|
Directory_9af6aff3-dc09-4ac1-a1d3-143e80977b3e_EZPWC_41985545 2020-05-29T07:57:51.4037921Z Add service principal Add success @{user=; app=}
|
|
Directory_f830a9d4-e746-48dc-944c-eb093364c011_1ZJAE_22273050 2020-05-29T07:57:51.6245497Z Add service principal Add failure @{user=; app=}
|
|
Directory_a813bc02-5d7a-4a40-9d37-7d4081d42b42_RKRRS_12877155 2020-06-02T12:49:38.5177891Z Add user Add success @{app=; user=}
|
|
|
|
PS C:\>Get-AADIntAzureAuditLog -EntryId Directory_9af6aff3-dc09-4ac1-a1d3-143e80977b3e_EZPWC_41985545
|
|
|
|
id : Directory_9af6aff3-dc09-4ac1-a1d3-143e80977b3e_EZPWC_41985545
|
|
category : ApplicationManagement
|
|
correlationId : 9af6aff3-dc09-4ac1-a1d3-143e80977b3e
|
|
result : success
|
|
resultReason :
|
|
activityDisplayName : Add service principal
|
|
activityDateTime : 2020-05-29T07:57:51.4037921Z
|
|
loggedByService : Core Directory
|
|
operationType : Add
|
|
initiatedBy : @{user=; app=}
|
|
targetResources : {@{id=66ce0b00-92ee-4851-8495-7c144b77601f; displayName=Azure Credential Configuration Endpoint Service; type=ServicePrincipal; userPrincipalName=;
|
|
groupType=; modifiedProperties=System.Object[]}}
|
|
additionalDetails : {}
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$EntryId,
|
|
[switch]$Export
|
|
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
# Select one entry if provided
|
|
if($EntryId)
|
|
{
|
|
$queryString = "`$filter=id eq '$EntryId'"
|
|
}
|
|
else
|
|
{
|
|
$queryString = "`$top=50&`$orderby=activityDateTime"
|
|
}
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "auditLogs/directoryAudits" -QueryString $queryString
|
|
|
|
# Return full results
|
|
if($Export)
|
|
{
|
|
return $results
|
|
}
|
|
elseif($EntryId) # The single entry
|
|
{
|
|
return $results
|
|
}
|
|
else # Print out only some info - the API always returns all info as $Select is not supported :(
|
|
{
|
|
$results | select id,activityDateTime,activityDisplayName,operationType,result,initiatedBy | ft
|
|
}
|
|
}
|
|
}
|
|
|
|
function Get-AADUsers
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SearchString,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$UserPrincipalName
|
|
|
|
)
|
|
Process
|
|
{
|
|
if(![string]::IsNullOrEmpty($SearchString))
|
|
{
|
|
$queryString="`$filter=(startswith(displayName,'$SearchString') or startswith(userPrincipalName,'$SearchString'))"
|
|
}
|
|
elseif(![string]::IsNullOrEmpty($UserPrincipalName))
|
|
{
|
|
$queryString="`$filter=userPrincipalName eq '$UserPrincipalName'"
|
|
}
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API users -QueryString $queryString
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the user's data
|
|
# Jun 16th 2020
|
|
function Get-MSGraphUser
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$UserPrincipalName
|
|
)
|
|
Process
|
|
{
|
|
# Url encode for external users, replace # with %23
|
|
$UserPrincipalName = $UserPrincipalName.Replace("#","%23")
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "users/$UserPrincipalName" -ApiVersion "v1.0" -QueryString "`$select=businessPhones,displayName,givenName,id,jobTitle,mail,mobilePhone,officeLocation,preferredLanguage,surname,userPrincipalName,onPremisesDistinguishedName,onPremisesExtensionAttributes,onPremisesImmutableId,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,refreshTokensValidFromDateTime,signInSessionsValidFromDateTime,usageLocation,provisionedPlans,proxyAddresses"
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the user's application role assignments
|
|
# Jun 16th 2020
|
|
function Get-MSGraphUserAppRoleAssignments
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$UserPrincipalName
|
|
)
|
|
Process
|
|
{
|
|
# Url encode for external users, replace # with %23
|
|
$UserPrincipalName = $UserPrincipalName.Replace("#","%23")
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "users/$UserPrincipalName/appRoleAssignments" -ApiVersion v1.0
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the user's owned devices
|
|
# Jun 16th 2020
|
|
function Get-MSGraphUserOwnedDevices
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$UserPrincipalName
|
|
)
|
|
Process
|
|
{
|
|
# Url encode for external users, replace # with %23
|
|
$UserPrincipalName = $UserPrincipalName.Replace("#","%23")
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "users/$UserPrincipalName/ownedDevices" -ApiVersion v1.0
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the user's registered devices
|
|
# Jun 16th 2020
|
|
function Get-MSGraphUserRegisteredDevices
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$UserPrincipalName
|
|
)
|
|
Process
|
|
{
|
|
# Url encode for external users, replace # with %23
|
|
$UserPrincipalName = $UserPrincipalName.Replace("#","%23")
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "users/$UserPrincipalName/registeredDevices" -ApiVersion v1.0
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the user's licenses
|
|
# Jun 16th 2020
|
|
function Get-MSGraphUserLicenseDetails
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$UserPrincipalName
|
|
)
|
|
Process
|
|
{
|
|
# Url encode for external users, replace # with %23
|
|
$UserPrincipalName = $UserPrincipalName.Replace("#","%23")
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "users/$UserPrincipalName/licenseDetails" -ApiVersion v1.0
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the user's groups
|
|
# Jun 16th 2020
|
|
function Get-MSGraphUserMemberOf
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$UserPrincipalName
|
|
)
|
|
Process
|
|
{
|
|
# Url encode for external users, replace # with %23
|
|
$UserPrincipalName = $UserPrincipalName.Replace("#","%23")
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "users/$UserPrincipalName/memberOf" -ApiVersion v1.0
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the user's direct reports
|
|
# Jun 16th 2020
|
|
function Get-MSGraphUserDirectReports
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$UserPrincipalName
|
|
)
|
|
Process
|
|
{
|
|
# Url encode for external users, replace # with %23
|
|
$UserPrincipalName = $UserPrincipalName.Replace("#","%23")
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "users/$UserPrincipalName/directReports" -ApiVersion v1.0 -QueryString "`$select=businessPhones,displayName,givenName,id,jobTitle,mail,mobilePhone,officeLocation,preferredLanguage,surname,userPrincipalName,onPremisesDistinguishedName,onPremisesExtensionAttributes,onPremisesImmutableId,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,refreshTokensValidFromDateTime,signInSessionsValidFromDateTime,usageLocation,provisionedPlans,proxyAddresses"
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the user's manager
|
|
# Jun 16th 2020
|
|
function Get-MSGraphUserManager
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$UserPrincipalName
|
|
)
|
|
Process
|
|
{
|
|
# Url encode for external users, replace # with %23
|
|
$UserPrincipalName = $UserPrincipalName.Replace("#","%23")
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "users/$UserPrincipalName/manager" -ApiVersion v1.0 -QueryString "`$select=businessPhones,displayName,givenName,id,jobTitle,mail,mobilePhone,officeLocation,preferredLanguage,surname,userPrincipalName,onPremisesDistinguishedName,onPremisesExtensionAttributes,onPremisesImmutableId,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,refreshTokensValidFromDateTime,signInSessionsValidFromDateTime,usageLocation,provisionedPlans,proxyAddresses"
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the group's owners
|
|
# Jun 16th 2020
|
|
function Get-MSGraphGroupOwners
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$GroupId
|
|
)
|
|
Process
|
|
{
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "groups/$GroupId/owners" -ApiVersion v1.0 -QueryString "`$select=businessPhones,displayName,givenName,id,jobTitle,mail,mobilePhone,officeLocation,preferredLanguage,surname,userPrincipalName,onPremisesDistinguishedName,onPremisesExtensionAttributes,onPremisesImmutableId,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,refreshTokensValidFromDateTime,signInSessionsValidFromDateTime,usageLocation,provisionedPlans,proxyAddresses"
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the group's members
|
|
# Jun 16th 2020
|
|
function Get-MSGraphGroupMembers
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$GroupId
|
|
)
|
|
Process
|
|
{
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "groups/$GroupId/members" -ApiVersion v1.0 -QueryString "`$top=500&`$select=businessPhones,displayName,givenName,id,jobTitle,mail,mobilePhone,officeLocation,preferredLanguage,surname,userPrincipalName,onPremisesDistinguishedName,onPremisesExtensionAttributes,onPremisesImmutableId,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,refreshTokensValidFromDateTime,signInSessionsValidFromDateTime,usageLocation,provisionedPlans,proxyAddresses"
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the group's members
|
|
# Jun 17th 2020
|
|
function Get-MSGraphRoleMembers
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$RoleId
|
|
)
|
|
Process
|
|
{
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "directoryRoles/$RoleId/members" -ApiVersion v1.0 -QueryString "`$select=businessPhones,displayName,givenName,id,jobTitle,mail,mobilePhone,officeLocation,preferredLanguage,surname,userPrincipalName,onPremisesDistinguishedName,onPremisesExtensionAttributes,onPremisesImmutableId,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,refreshTokensValidFromDateTime,signInSessionsValidFromDateTime,usageLocation,provisionedPlans,proxyAddresses"
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the tenant domains (all of them)
|
|
# Jun 16th 2020
|
|
function Get-MSGraphDomains
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken
|
|
)
|
|
Process
|
|
{
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "domains" -ApiVersion beta
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets team information
|
|
# Jun 17th 2020
|
|
function Get-MSGraphTeams
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$GroupId
|
|
)
|
|
Process
|
|
{
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "teams/$GroupId" -ApiVersion v1.0
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets team's app information
|
|
# Jun 17th 2020
|
|
function Get-MSGraphTeamsApps
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$GroupId
|
|
)
|
|
Process
|
|
{
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "teams/$GroupId/installedApps?`$expand=teamsAppDefinition" -ApiVersion v1.0
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the authorizationPolicy
|
|
# Sep 18th 2020
|
|
function Get-TenantAuthPolicy
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets tenant's authorization policy.
|
|
|
|
.DESCRIPTION
|
|
Gets tenant's authorization policy, including user and guest settings.
|
|
|
|
.PARAMETER AccessToken
|
|
Access token used to retrieve the authorization policy.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph
|
|
PS C:\>Get-AADIntTenantAuthPolicy
|
|
|
|
id : authorizationPolicy
|
|
allowInvitesFrom : everyone
|
|
allowedToSignUpEmailBasedSubscriptions : True
|
|
allowedToUseSSPR : True
|
|
allowEmailVerifiedUsersToJoinOrganization : False
|
|
blockMsolPowerShell : False
|
|
displayName : Authorization Policy
|
|
description : Used to manage authorization related settings across the company.
|
|
enabledPreviewFeatures : {}
|
|
guestUserRoleId : 10dae51f-b6af-4016-8d66-8c2a99b929b3
|
|
permissionGrantPolicyIdsAssignedToDefaultUserRole : {microsoft-user-default-legacy}
|
|
defaultUserRolePermissions : @{allowedToCreateApps=True; allowedToCreateSecurityGroups=True; allowedToReadOtherUsers=True}
|
|
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
$results = Call-MSGraphAPI -AccessToken $AccessToken -API "policies/authorizationPolicy"
|
|
|
|
|
|
return $results
|
|
}
|
|
}
|
|
|
|
# Gets the guest account restrictions
|
|
# Sep 18th 2020
|
|
function Get-TenantGuestAccess
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets the guest access level of the user's tenant.
|
|
|
|
.DESCRIPTION
|
|
Gets the guest access level of the user's tenant.
|
|
|
|
Inclusive: Guest users have the same access as members
|
|
Normal: Guest users have limited access to properties and memberships of directory objects
|
|
Restricted: Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)
|
|
|
|
.PARAMETER AccessToken
|
|
Access token used to retrieve the access level.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph -SaveToCache
|
|
PS C:\>Get-AADIntTenantGuestAccess
|
|
|
|
Access Description RoleId
|
|
------ ----------- ------
|
|
Normal Guest users have limited access to properties and memberships of directory objects 10dae51f-b6af-4016-8d66-8c2a99b929b3
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
$policy = Get-TenantAuthPolicy -AccessToken $AccessToken
|
|
|
|
$roleId = $policy.guestUserRoleId
|
|
|
|
|
|
switch($roleId)
|
|
{
|
|
"a0b1b346-4d3e-4e8b-98f8-753987be4970" {
|
|
$attributes=[ordered]@{
|
|
"Access" = "Full"
|
|
"Description" = "Guest users have the same access as members"
|
|
}
|
|
break
|
|
}
|
|
"10dae51f-b6af-4016-8d66-8c2a99b929b3" {
|
|
$attributes=[ordered]@{
|
|
"Access" = "Normal"
|
|
"Description" = "Guest users have limited access to properties and memberships of directory objects"
|
|
}
|
|
break
|
|
}
|
|
"2af84b1e-32c8-42b7-82bc-daa82404023b" {
|
|
$attributes=[ordered]@{
|
|
"Access" = "Restricted"
|
|
"Description" = "Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)"
|
|
}
|
|
break
|
|
}
|
|
}
|
|
|
|
$attributes["RoleId"] = $roleId
|
|
|
|
return New-Object psobject -Property $attributes
|
|
|
|
|
|
}
|
|
}
|
|
|
|
# Sets the guest account restrictions
|
|
# Sep 18th 2020
|
|
function Set-TenantGuestAccess
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Sets the guest access level for the user's tenant.
|
|
|
|
.DESCRIPTION
|
|
Sets the guest access level for the user's tenant.
|
|
|
|
Inclusive: Guest users have the same access as members
|
|
Normal: Guest users have limited access to properties and memberships of directory objects
|
|
Restricted: Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)
|
|
|
|
.PARAMETER AccessToken
|
|
Access token used to retrieve the access level.
|
|
|
|
.PARAMETER Level
|
|
Guest access level. One of Inclusive, Normal, or Restricted.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph
|
|
PS C:\>Set-AADIntTenantGuestAccess -Level Normal
|
|
|
|
Access Description RoleId
|
|
------ ----------- ------
|
|
Normal Guest users have limited access to properties and memberships of directory objects 10dae51f-b6af-4016-8d66-8c2a99b929b3
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
|
|
[Parameter(Mandatory=$True)]
|
|
[ValidateSet('Full','Normal','Restricted')]
|
|
[String]$Level
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
switch($Level)
|
|
{
|
|
"Full" {$roleId = "a0b1b346-4d3e-4e8b-98f8-753987be4970"; break}
|
|
"Normal" {$roleId = "10dae51f-b6af-4016-8d66-8c2a99b929b3"; break}
|
|
"Restricted" {$roleId = "2af84b1e-32c8-42b7-82bc-daa82404023b"; break}
|
|
}
|
|
$body = "{""guestUserRoleId"":""$roleId""}"
|
|
|
|
|
|
Call-MSGraphAPI -AccessToken $AccessToken -API "policies/authorizationPolicy/authorizationPolicy" -Method "PATCH" -Body $body
|
|
|
|
Get-TenantGuestAccess -AccessToken $AccessToken
|
|
|
|
}
|
|
}
|
|
|
|
|
|
# Enables Msol PowerShell access
|
|
# Sep 18th 2020
|
|
function Enable-TenantMsolAccess
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Enables Msol PowerShell module access for the user's tenant.
|
|
|
|
.DESCRIPTION
|
|
Enables Msol PowerShell module access for the user's tenant.
|
|
|
|
.PARAMETER AccessToken
|
|
Access token used to enable the Msol PowerShell access.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph
|
|
PS C:\>Enable-AADIntTenantMsolAccess
|
|
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
$body = '{"blockMsolPowerShell":"false"}'
|
|
|
|
Call-MSGraphAPI -AccessToken $AccessToken -API "policies/authorizationPolicy/authorizationPolicy" -Method "PATCH" -Body $body
|
|
}
|
|
}
|
|
|
|
# Disables Msol PowerShell access
|
|
# Sep 18th 2020
|
|
function Disable-TenantMsolAccess
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Disables Msol PowerShell module access for the user's tenant.
|
|
|
|
.DESCRIPTION
|
|
Disables Msol PowerShell module access for the user's tenant.
|
|
|
|
.PARAMETER AccessToken
|
|
Access token used to disable the Msol PowerShell access.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph
|
|
PS C:\>Disable-AADIntTenantMsolAccess
|
|
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
$body = '{"blockMsolPowerShell":"true"}'
|
|
|
|
Call-MSGraphAPI -AccessToken $AccessToken -API "policies/authorizationPolicy/authorizationPolicy" -Method "PATCH" -Body $body
|
|
}
|
|
}
|
|
|
|
# Get rollout policies
|
|
# Jan 7th 2021
|
|
function Get-RolloutPolicies
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets the tenant's rollout policies.
|
|
|
|
.DESCRIPTION
|
|
Gets the tenant's rollout policies.
|
|
|
|
.PARAMETER AccessToken
|
|
Access token used to get tenant's rollout policies.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph -SaveToCache
|
|
PS C:\>Get-AADIntRolloutPolicies
|
|
|
|
id : cdcb37e1-9c4a-4de9-a7f5-65fdf9f6241d
|
|
displayName : passthroughAuthentication rollout policy
|
|
description :
|
|
feature : passthroughAuthentication
|
|
isEnabled : True
|
|
isAppliedToOrganization : False
|
|
|
|
id : 3c89cd34-275c-4cba-8d8e-80338db7df91
|
|
displayName : seamlessSso rollout policy
|
|
description :
|
|
feature : seamlessSso
|
|
isEnabled : True
|
|
isAppliedToOrganization : False
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
Call-MSGraphAPI -AccessToken $AccessToken -API "directory/featureRolloutPolicies" -ApiVersion beta
|
|
}
|
|
}
|
|
|
|
# Get rollout policy groups
|
|
# Jan 7th 2021
|
|
function Get-RolloutPolicyGroups
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets groups of the given rollout policy.
|
|
|
|
.DESCRIPTION
|
|
Gets groups of the given rollout policy.
|
|
|
|
.PARAMETER AccessToken
|
|
Access token used to get rollout policy groups.
|
|
|
|
.PARAMETER PolicyId
|
|
Guid of the rollout policy.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph -SaveToCache
|
|
PS C:\>Get-AADIntRolloutPolicyGroups -PolicyId cdcb37e1-9c4a-4de9-a7f5-65fdf9f6241d | Select displayName,id
|
|
|
|
displayName id
|
|
----------- --
|
|
PTA SSO Sales b9faf3ba-db5f-4ed2-b9c8-0fd5916de1f3
|
|
PTA SSO Markering f35d712f-dcdb-4040-a93d-ffd04aff3f75
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[GUID]$PolicyId
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
$response=Call-MSGraphAPI -AccessToken $AccessToken -API "directory/featureRolloutPolicies/$($PolicyId.ToString())" -QueryString "`$expand=appliesTo" -ApiVersion beta
|
|
$response.appliesTo
|
|
}
|
|
}
|
|
|
|
# Add groups to rollout policy
|
|
# Jan 7th 2021
|
|
function Add-RolloutPolicyGroups
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Adds given groups to the given rollout policy.
|
|
|
|
.DESCRIPTION
|
|
Adds given groups to the given rollout policy.
|
|
|
|
Status meaning:
|
|
204 The group successfully added
|
|
400 Invalid group id
|
|
404 Invalid policy id
|
|
|
|
.PARAMETER AccessToken
|
|
Access token used to add rollout policy groups.
|
|
|
|
.PARAMETER PolicyId
|
|
Guid of the rollout policy.
|
|
|
|
.PARAMETER GroupIds
|
|
List of group guids.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph -SaveToCache
|
|
PS C:\>Add-AADIntRolloutPolicyGroups -PolicyId cdcb37e1-9c4a-4de9-a7f5-65fdf9f6241d -GroupIds b9faf3ba-db5f-4ed2-b9c8-0fd5916de1f3,f35d712f-dcdb-4040-a93d-ffd04aff3f75
|
|
|
|
id status
|
|
-- ------
|
|
b9faf3ba-db5f-4ed2-b9c8-0fd5916de1f3 204
|
|
f35d712f-dcdb-4040-a93d-ffd04aff3f75 204
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[GUID]$PolicyId,
|
|
[Parameter(Mandatory=$True)]
|
|
[GUID[]]$GroupIds
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
# Build the body
|
|
$requests = @()
|
|
|
|
foreach($GroupId in $GroupIds)
|
|
{
|
|
$id = $GroupId.toString()
|
|
$request = @{
|
|
"id" = $id
|
|
"method" = "POST"
|
|
"url" = "directory/featureRolloutPolicies/$($PolicyId.toString())/appliesTo/`$ref"
|
|
"body" = @{ "@odata.id" = "https://graph.microsoft.com/beta/directoryObjects/$id" }
|
|
"headers" = @{ "Content-Type" = "application/json" }
|
|
}
|
|
$requests += $request
|
|
}
|
|
|
|
$body = @{ "requests" = $requests } | ConvertTo-Json -Depth 5
|
|
|
|
$response = Call-MSGraphAPI -AccessToken $AccessToken -API "`$batch" -ApiVersion beta -Method "POST" -Body $body
|
|
|
|
if($response.responses[0].body.error.message)
|
|
{
|
|
Write-Error $response.responses[0].body.error.message
|
|
}
|
|
else
|
|
{
|
|
$response.responses | select id,status
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
# Removes groups from the rollout policy
|
|
# Jan 7th 2021
|
|
function Remove-RolloutPolicyGroups
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Removes given groups from the given rollout policy.
|
|
|
|
.DESCRIPTION
|
|
Removes given groups from the given rollout policy.
|
|
|
|
Status meaning:
|
|
204 The group successfully added
|
|
400 Invalid group id
|
|
404 Invalid policy id
|
|
|
|
.PARAMETER AccessToken
|
|
Access token used to remove rollout policy groups.
|
|
|
|
.PARAMETER PolicyId
|
|
Guid of the rollout policy.
|
|
|
|
.PARAMETER GroupIds
|
|
List of group guids.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph -SaveToCache
|
|
PS C:\>Remove-AADIntRolloutPolicyGroups -PolicyId cdcb37e1-9c4a-4de9-a7f5-65fdf9f6241d -GroupIds b9faf3ba-db5f-4ed2-b9c8-0fd5916de1f3,f35d712f-dcdb-4040-a93d-ffd04aff3f75
|
|
|
|
id status
|
|
-- ------
|
|
b9faf3ba-db5f-4ed2-b9c8-0fd5916de1f3 204
|
|
f35d712f-dcdb-4040-a93d-ffd04aff3f75 204
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[GUID]$PolicyId,
|
|
[Parameter(Mandatory=$True)]
|
|
[GUID[]]$GroupIds
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
# Build the body
|
|
$requests = @()
|
|
|
|
foreach($GroupId in $GroupIds)
|
|
{
|
|
$id = $GroupId.toString()
|
|
$request = @{
|
|
"id" = $id
|
|
"method" = "DELETE"
|
|
"url" = "directory/featureRolloutPolicies/$($PolicyId.toString())/appliesTo/$id/`$ref"
|
|
}
|
|
$requests += $request
|
|
}
|
|
|
|
$body = @{ "requests" = $requests } | ConvertTo-Json -Depth 5
|
|
|
|
$response = Call-MSGraphAPI -AccessToken $AccessToken -API "`$batch" -ApiVersion beta -Method "POST" -Body $body
|
|
|
|
if($response.responses[0].body.error.message)
|
|
{
|
|
Write-Error $response.responses[0].body.error.message
|
|
}
|
|
else
|
|
{
|
|
$response.responses | select id,status
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
# Set rollout policy
|
|
# Jan 7th 2021
|
|
function Remove-RolloutPolicy
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Removes the given rollout policy.
|
|
|
|
.DESCRIPTION
|
|
Removes the given rollout policy. The policy MUST be disabled before it can be removed.
|
|
|
|
.PARAMETER AccessToken
|
|
Access token used to get tenant's rollout policies.
|
|
|
|
.PARAMETER PolicyId
|
|
Guid of the rollout policy.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph -SaveToCache
|
|
PS C:\>Remove-AADIntRolloutPolicy -PolicyId 3c89cd34-275c-4cba-8d8e-80338db7df91
|
|
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[GUID]$PolicyId
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
Call-MSGraphAPI -AccessToken $AccessToken -API "directory/featureRolloutPolicies/$($PolicyId.ToString())" -ApiVersion beta -Method DELETE
|
|
}
|
|
}
|
|
|
|
# Set rollout policy
|
|
# Jan 7th 2021
|
|
function Set-RolloutPolicy
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Creates a new rollout policy or edits existing one.
|
|
|
|
.DESCRIPTION
|
|
Creates a new rollout policy by name or edits existing one with policy id.
|
|
|
|
.PARAMETER AccessToken
|
|
Access token used to get tenant's rollout policies.
|
|
|
|
.PARAMETER PolicyId
|
|
Guid of the rollout policy.
|
|
|
|
.PARAMETER Policy
|
|
Name of the rollout policy. Can be one of: passwordHashSync, passthroughAuthentication, or seamlessSso
|
|
|
|
.PARAMETER Enable
|
|
Boolean value indicating is the feature enabled or not.
|
|
|
|
.PARAMETER EnableToOrganization
|
|
Boolean value indicating is the feature enabled for the whole organization. Currently not supported.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph -SaveToCache
|
|
PS C:\>Set-AADIntRolloutPolicy -Policy passthroughAuthentication -Enable $True
|
|
|
|
@odata.context : https://graph.microsoft.com/beta/$metadata#directory/featureRolloutPolicies/$entity
|
|
id : 1eec3ce2-5af1-4460-9cc4-1af7a6c15eb1
|
|
displayName : passthroughAuthentication rollout policy
|
|
description :
|
|
feature : passthroughAuthentication
|
|
isEnabled : True
|
|
isAppliedToOrganization : False
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph -SaveToCache
|
|
PS C:\>Set-AADIntRolloutPolicy -PolicyId 1eec3ce2-5af1-4460-9cc4-1af7a6c15eb1 -Enable $False
|
|
|
|
@odata.context : https://graph.microsoft.com/beta/$metadata#directory/featureRolloutPolicies/$entity
|
|
id : 1eec3ce2-5af1-4460-9cc4-1af7a6c15eb1
|
|
displayName : passthroughAuthentication rollout policy
|
|
description :
|
|
feature : passthroughAuthentication
|
|
isEnabled : True
|
|
isAppliedToOrganization : False
|
|
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(ParameterSetName='id',Mandatory=$True)]
|
|
[GUID]$PolicyId,
|
|
[Parameter(Mandatory=$True)]
|
|
[bool]$Enable,
|
|
[Parameter(ParameterSetName='type',Mandatory=$True)]
|
|
[ValidateSet('passwordHashSync','passthroughAuthentication','seamlessSso')]
|
|
[String]$Policy,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$EnableToOrganization = $false
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
try
|
|
{
|
|
if($Policy)
|
|
{
|
|
$body = @{
|
|
"feature" = "$Policy"
|
|
"isEnabled" = $Enable
|
|
#"isAppliedToOrganization" = $EnableToOrganization
|
|
"displayName" = "$Policy rollout policy"}
|
|
|
|
$response = Call-MSGraphAPI -AccessToken $AccessToken -API "directory/featureRolloutPolicies" -ApiVersion beta -Method POST -Body $($body | ConvertTo-Json -Depth 5)
|
|
}
|
|
else
|
|
{
|
|
$body = @{
|
|
"isEnabled" = $Enable
|
|
#"isAppliedToOrganization" = $EnableToOrganization
|
|
}
|
|
|
|
$response = Call-MSGraphAPI -AccessToken $AccessToken -API "directory/featureRolloutPolicies/$($PolicyId.ToString())" -ApiVersion beta -Method PATCH -Body $($body | ConvertTo-Json -Depth 5)
|
|
}
|
|
}
|
|
catch
|
|
{
|
|
$error = $_.ErrorDetails.Message | ConvertFrom-Json
|
|
Write-Error $error.error.message
|
|
}
|
|
|
|
|
|
$response
|
|
}
|
|
}
|
|
|
|
|
|
# Return the default domain for the given tenantid
|
|
# Sep 28th 2022
|
|
function Get-TenantDomain
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Returns the default domain for the given tenant id
|
|
|
|
.DESCRIPTION
|
|
Returns the default domain for the given tenant id
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph -SaveToCache
|
|
PS C:\>Get-AADIntTenantDomain -TenantId 72f988bf-86f1-41af-91ab-2d7cd011db47
|
|
microsoft.onmicrosoft.com
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$TenantId
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "tenantRelationships/findTenantInformationByTenantId(tenantId='$TenantId')"
|
|
|
|
Write-Verbose $results
|
|
|
|
return $results.defaultDomainName
|
|
}
|
|
}
|
|
|
|
# Adds a new TAP for the given user
|
|
# Jun 26th 2023
|
|
function New-UserTAP
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Creates a new Temporary Access Pass (TAP) for the given user.
|
|
|
|
.DESCRIPTION
|
|
Creates a new Temporary Access Pass (TAP) for the given user.
|
|
|
|
.PARAMETER
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph -SaveToCache
|
|
PS C:\>Get-AADIntTenantDomain -TenantId 72f988bf-86f1-41af-91ab-2d7cd011db47
|
|
microsoft.onmicrosoft.com
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$UsableOnce,
|
|
[Parameter(Mandatory=$False)]
|
|
[ValidateRange(10, 43200)]
|
|
[int]$Lifetime = 60,
|
|
[Parameter(Mandatory=$False)]
|
|
[DateTime]$StartTime = (Get-Date),
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$User
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
# Create the body
|
|
$body = @{
|
|
"startDateTime" = ($StartTime).ToUniversalTime().toString("yyyy-MM-ddTHH:mm:ssZ").Replace(".",":")
|
|
"lifetimeInMinutes" = $Lifetime
|
|
"isUsableOnce" = $UsableOnce -eq $true
|
|
}
|
|
|
|
$results = Call-MSGraphAPI -AccessToken $AccessToken -API "users/$user/authentication/temporaryAccessPassMethods" -Method POST -Body ($body | ConvertTo-Json)
|
|
|
|
return $results.temporaryAccessPass
|
|
}
|
|
}
|
|
|
|
# Return B2C trust framework keysets
|
|
# Sep 13th 2022
|
|
function Get-B2CEncryptionKeys
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets B2C trust framework encryption keys. Can be used to create authorization codes and refresh tokens.
|
|
|
|
.DESCRIPTION
|
|
Gets B2C trust framework encryption keys. Can be used to create authorization codes and refresh tokens.
|
|
Requires one of the following roles: B2C IEF Keyset Administrator, Global Reader, Global Administrator.
|
|
|
|
.PARAMETER AccessToken
|
|
AccessToken
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph -SaveToCache
|
|
PS C:\>Get-AADIntB2CEncryptionKeys
|
|
|
|
Container Id Key
|
|
--------- -- ---
|
|
B2C_1A_test XZ0q5X-Zu_oY2mX-El89a1YEsh4FRj0e5xpGMjJ94uE System.Security.Cryptography.RSACryptoServiceProvider
|
|
B2C_1A_TokenEncryptionKeyContainer My_custom_key_id System.Security.Cryptography.RSACryptoServiceProvider
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
# Get all keysets
|
|
$results=Call-MSGraphAPI -AccessToken $AccessToken -API "trustFramework/keySets"
|
|
|
|
# Loop through the results
|
|
foreach($container in $results)
|
|
{
|
|
# Loop through the keys (can be more than one per container)
|
|
foreach($key in $container.keys)
|
|
{
|
|
# Include only RSA encryption keys
|
|
if($key.kty -eq "RSA" -and $key.use -eq "enc")
|
|
{
|
|
# Create the parameters and RSA key
|
|
$RSAParameters = [System.Security.Cryptography.RSAParameters]::new()
|
|
$RSAParameters.Modulus = Convert-B64ToByteArray -B64 $key.n
|
|
$RSAParameters.Exponent = Convert-B64ToByteArray -B64 $key.e
|
|
$RSAKey = [System.Security.Cryptography.RSA]::Create()
|
|
$RSAKey.ImportParameters($RSAParameters)
|
|
|
|
# Return
|
|
[pscustomobject][ordered]@{
|
|
"Container" = $container.id
|
|
"Id" = $key.kid
|
|
"Key" = $RSAKey
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
} |