Azuread on Nicola Suter

Discover the Microsoft Graph API with the Microsoft Endpoint Manager Portal

Tue, 08 Sep 2020 00:00:00 +0000

You always wanted to automate a specific action within Intune / the Microsoft Endpoint Manager Portal (MEM) but were afraid of the complexity? The Microsoft Graph API docs deliver you more questions instead of answers? Automating tasks within the MEM portal could be very easy, couldn’t it? I promise it will be much simpler with this magician trick.

Microsoft Endpoint Manager Portal
#

The MEM Portal UI relies on the Microsoft Graph API. This means that the UI where you create new settings and policies and the Intune backend are encapsulated with different layers. Communication between the UI and the backend happens with the Microsoft Graph API. With the developer tools we can trace network traffic and discover the request URLs and request body payload which are required to interact with the API.

{: .align-center}

Example about how to capture URLs and build a PowerShell script
#

Original request body:

Access has been blocked by Conditional Access policies when using device code flow

Thu, 03 Sep 2020 00:00:00 +0000

When using device code authentication for PowerShell modules with conditional access you might receive prompts like: “Access has been blocked by Conditional Access policies. The access policy does not allow token issuance” or “AADSTS50097: Device authentication is required”. But what’s the reason for this error and is there a solution available?

Examples from the field
#

Device code flow is quite a convenient way to sign-in for an app within the web browser - at least if it works. If not you have to consider other options and that’s probably the reason why you’re reading this blog article.

Az PowerShell

Running the Az PowerShell module on PowerShell 7 uses device code flow to authenticate against your Azure tenant and might fail:

Connect-AzAccount: AADSTS50097: Device authentication is required.
Timestamp: 2020-08-17 13:36:31Z: Response status code does not indicate success: 401 (Unauthorized).

The sign-in to Azure is tied to the “Microsoft Azure Management” app that you can select within Conditional Access.

Microsoft Graph PowerShell

The same applies for the new Microsoft.Graph PowerShell modules - but here we receive a more detailed error message:

Connect-Graph: AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.
Timestamp: 2020-08-17 13:37:12Z

The sign-in to the new Microsoft Graph Modules is tied to the “Microsoft Graph PowerShell (Preview)” app and some more apps I couldn’t determine.

Intune scope tags and role-based access control explained

Mon, 03 Aug 2020 00:00:00 +0000

For larger Intune environments a solid role-based access implementation becomes crucial to ensure a secure administration. But how does Intune role-based access control (RBAC) work in combination with scope tags and how to get started? This post gets you covered with explanations and practical examples.

Role-based access control within the Microsoft 365 ecosystem
#

Within the Microsoft 365 ecosystem, Microsoft provides Azure AD administrative roles to administrate services like Exchange (Exchange administrator), SharePoint (SharePoint administrator), Intune (Intune administrator) and so on.

As you can see Azure AD provides (usually) only one role which grants full administrative access over a service. You can configure more fine-grained controls within the service itself - that’s where the RBAC controls of the respective service kick in.

To give you another example: You might have a 1^st or 2^nd level support department which needs permissions to perform remote actions on Intune managed devices. Instead of assigning them the Azure AD Intune Administrator role, it’s more convenient to assign them a fine-grained Intune RBAC role which delegates exactly the permissions needed.

As the name already indicates Intune related roles only live within the Intune tenant and cannot be managed from AAD and vice-versa:

Azure AD guest user review solution

Tue, 14 Jul 2020 00:00:00 +0000

Azure Active Directory guest users really simplify the process to collaborate with external users. Although keeping a good governance on guest accounts can become quite a challenge. The two biggest challenges I often observe are: “Who invited that guest user?” and “Does this guest user still need access to our infrastructure?”. Inspired by a recent post of Thomas Kurth regarding Azure AD Guest Account - Governance and Cleanup I also developed a solution which comes quite close to an “Azure AD Access review” like user experience.

Notable features
#

The ‘Manager’ attribute of your guest users get’s automatically populated with the identity of the inviter
All Azure AD app registration information is stored in Azure Key Vault
Almost zero touch deployment with ARM templates
You can integrate existing guest users into this solution by populating the manager attribute in Azure AD
You can configure the approval frequency for guest accounts
Approval frequency respects last approval date for each guest account

Architecture
#

The solution leverages function of:

Azure Logic App

Who invited this Azure AD guest user?

Tue, 14 Jul 2020 00:00:00 +0000

Who invited this Azure AD guest user? Examining who invited a specific a guest account can be quite a challenging question if you don’t have a log analytics workspace in place with Azure AD Audit log forwarding configured.

Kusto queries for your log analytics workspace
#

The following queries help you to identify who invited a guest. If you haven’t set-up Azure AD audit log forwarding it’s the right time to do it now as described in one of my previous blogs.

To find all guest invitations:

AuditLogs
| where OperationName == 'Invite external user' and Result == 'success'

To find all accepted invitations:

AuditLogs 
| where OperationName == 'Invite external user' and Result == 'success'
| extend InvitationId = tostring(AdditionalDetails[0].value)
| join (
 	AuditLogs
	| where OperationName in('Redeem external user invite')
	| parse kind=regex TargetResources[0].displayName with * "InvitationId: " InvitationId:string ","
)
on $left.InvitationId == $right.InvitationId

Improving your guest user governance
#

To simplify the guest user review and management process I developed a solution which fully automates this process. Additionally the solution populates the user who invited a guest as the guest’s manager which allows you to easily examine the question “Who invited this Azure AD Guest Account?”.

Azure AD guest user review solution

Remove Azure AD direct License Assignments with PowerShell

Wed, 08 Jul 2020 00:00:00 +0000

Who doesn’t love a clean and tidy environment, do you? This also applies for your license assignments in Office 365 and Azure AD. As time passess it is likely to have users with direct license assignments or users which still have old trial licenses assigned. To get rid of those assignments I created a PowerShell script with removal and reporting functionality.

Direct link to the script.

Identify direct license assignments
#

In the Azure Portal we recognize direct license assignments on a user account by viewing the “Assignment Paths”:

With the MSOnline PowerShell module we can view the Licenses property of a user and retrieve a nested property called: GroupsAssigningLicense. The GroupsAssigningLicense property contains either:

An empty array if the license was not inherited from a group -> direct assignment
An array with objectId’s
- If the array contains the user’s objectId -> direct assignment

Example 1: User with objectId 36c9b091-fe88-4dc2-a9e1-2662020b4bab has group based license assignment and direct assignment:

AccountSkuId : nicolasuter:SPE_E5
GroupsAssigningLicense : {0a918505-d0d5-4078-9891-0e8bec67cb65, 36c9b091-fe88-4dc2-a9e1-2662020b4bab}

Example 2: User has no inherited licenses from a group:

AccountSkuId : nicolasuter:SPE_E5
GroupsAssigningLicense : {}

PowerShell Script
#

You find the PowerShell script on my techblog GitHub repository.

Automating network drive mapping configuration with Intune

Fri, 19 Jul 2019 07:32:46 +0000

I’m thrilled to introduce the intune-drive-mapping-generator which creates PowerShell scripts to map network drives with Intune. The tool is open source and built on ASP.NET Core MVC.

The intune-drive-mapping-generator is your tool of choice to:

Generate an Intune PowerShell script to map network drives on Azure AD joined devices
Seamlessly migrate existing network drive mapping group policies
Generate a network drive mapping configuration from scratch
Use an existing Active Directory group as a filter to deploy all your drive mapping configurations within one script

This all happens without scripting effort. You receive a fully functional PowerShell script for the deployment with Intune.

Architecture
#

This tool is designed to work best with the following components although it can be useful for other purposes(?) :

Azure AD Joined and Intune enrolled Windows 10 devices
Synced user account from Active Directory to Azure Active Directory (Azure AD Connect)
On-premises file servers

Howto
#

Export existing group policy
#

To convert your existing drive mapping group policy configuration, save the GPO as XML report with the group policy management console.

Azuread on Nicola Suter

Discover the Microsoft Graph API with the Microsoft Endpoint Manager Portal

Microsoft Endpoint Manager Portal #

Example about how to capture URLs and build a PowerShell script #

Access has been blocked by Conditional Access policies when using device code flow

Examples from the field #

Intune scope tags and role-based access control explained

Role-based access control within the Microsoft 365 ecosystem #

Azure AD guest user review solution

Notable features #

Architecture #

Who invited this Azure AD guest user?

Kusto queries for your log analytics workspace #

Improving your guest user governance #

Remove Azure AD direct License Assignments with PowerShell

Identify direct license assignments #

PowerShell Script #

Automating network drive mapping configuration with Intune

Architecture #

Howto #

Export existing group policy #

Microsoft Endpoint Manager Portal
#

Example about how to capture URLs and build a PowerShell script
#

Examples from the field
#

Role-based access control within the Microsoft 365 ecosystem
#

Notable features
#

Architecture
#

Kusto queries for your log analytics workspace
#

Improving your guest user governance
#

Identify direct license assignments
#

PowerShell Script
#

Architecture
#

Howto
#

Export existing group policy
#