I have the free developer E5 subscription and have setup a tenancy, created users etc. I have tried creating a second directory that I am planning to use to test the Azure AD Connect tool on a local server. I can switch between the tenants on the Azure Portal with the "Switch tenant" button however can't seem to figure it out with the Powershell cmdlets.
Connect-AzureAD
Set-AzContext -TenantId "My new tenant/directory"
Following these two commands is where the confusion starts. The first commands lists the users from the first directory and the second command shows the users from the directory I have switched too.
Get-AzureAdUser (Shows the first directory, not the one switched too)
Get-AzAdUser (Shows the users of the directory switched too)
Not sure if there is something I am missing here?
Thats because those are commands from 2 different modules:
First one are from AzureAD which is a module designed for tasks within AzureAD
Ths second one are from Az With is designed to handle most, if not all of Azure's resources. The AD functionality is mostly for the module to handle lookups of azure ad objects when checking rbac and assigning access, and not really created to manage AzureAD in any meaningful way (even tho you can do some tasks).
For your task you can use the az module easliy if you just want to look up the users, but if you need to actually administer azure ad i suggest you go for azuread.
To connect to a specified tenant with azuread use connect-azuread -tenantId 'tenant id'. I also think it support that you use domain name aswell
Related
Before deleting a custom domain from Azure Active Directory (AAD), I first need to get a list of all users, groups, and applications that reference that custom domain. This can be done manually through the Azure portal
Is there a way to get this list through PowerShell? I see the PowerShell cmdlet Get-MsolDomain, but I do not see that this outputs this kind of information.
I recommend to use cmdlet Get-AzureADDomainNameReference -Name '' from module AzureAD.
You can install that module from PowerShell Gallery - https://www.powershellgallery.com/packages/AzureAD/
I would like to add an Azure app as member of the Azure Group. I am owner of the Group but when I click on Add-->Member , it only lists individual users and there is no option for adding an app:-
I am not trying to provide access to the SG so it can access the app (for that I will have to go to the specific app page) rather I am trying to make the app as the 'member' of an Azure group that I already own. But I just don't see an option for doing that.
If your group is an Office group, it does not support to add the service principal as a member(i.e. the MSI of your datafactory, which is essentially a service principal created by azure automatically in general, see this link).
If you want to add the service principal to the group, you need to use the Security group, see this link.
If your User type is member, but you are not able to create the Security group, the UsersPermissionToCreateGroupsEnabled setting should be set with false in your Azure AD tenant.
See To restrict the default permissions for member users:
For more details, refer to this link.
You need to run this command first from powershell to create the managed identity
Set-AzDataFactoryV2 -ResourceGroupName <resourceGroupName> -Name <dataFactoryName> -Location <region>
https://learn.microsoft.com/en-us/azure/data-factory/data-factory-service-identity
I have a service principal that I use for automation. It has the Directory.Read.All permission in Microsoft Graph for our Azure Active Directory.
It cannot run the Set-AzSqlServerActiveDirectoryAdministrator command. The error I get is:
Cannot find the Azure Active Directory object 'My-AD-Group'.
Please make sure that the user or group you are authorizing is
registered in the current subscription's Azure Active directory.
If I run this same command as myself, it runs just fine.
Clearly my Service Principal needs more than the Directory.Read.All permission. Yet I cannot find any documentation that lists exactly what API Permissions my Service Principal would need to successfully run this command.
Does anyone know how I can discover exactly what API permissions would be required to run a particular Azure PowerShell command that involves accessing Azure Active Directory?
As an aside, I'm not tied to PowerShell. I cannot get this command to work with the az cli either. I'm open to methods using az that would get me this answer.
You need to give the Directory.Read.All(Application permission) of Azure AD Graph API not the Microsoft Graph API. Also make sure the service principal has the permission of the sql server(e.g. the service principal is the Owner of the subscription or the sql server), then it will work fine.
If you want to add the service principal as a role of the subscription or sql server, navigate to the subscription or the sql server in the portal -> Access control (IAM) -> Add -> Add role assignment -> search your service principal with name and add it as a role(e.g. Owner) -> Save, more details here.
Set-AzSqlServerActiveDirectoryAdministrator -ResourceGroupName "<ResourceGroupName>" -ServerName "<ServerName>" -DisplayName "group1" -ObjectId "64d1b8xxxxx4ffbd"
Does anyone know how I can discover exactly what API permissions would be required to run a particular Azure PowerShell command that involves accessing Azure Active Directory?
The Azure PowerShell essentially calls the different APIs, to get the permissions of the APIs, you could catch the request via Fiddler, then look into the official API doc for the permissions.
Couldn't find exactly what I was looking for in the forum...
I was testing AD Sync with a virtual domain controller. I have since deleted the virtual domain controller and need to remove the users from Azure AD. How is that done? "Delete Users" is not allowable when the user is from a local AD. Also, how do I turn off AD Sync in Azure?
"Delete Users" is not allowable when the user is from a local AD
For the on-premise synced objects, you could not manage or remove from the Azure AD.
If you want to remove the synced users and turn off the AD Sync, you could follow this way:
Install the Azure Active Directory Module for Windows PowerShell.
Connect to Azure AD by using Windows PowerShell.
Disable directory synchronization. To do this, type the cmdlet Set-MsolDirSyncEnabled –EnableDirSync $false, and then press Enter.
Check that directory synchronization was fully disabled by using the Windows PowerShell. To do this, run the cmdlet periodically:(Get-MSOLCompanyInformation).DirectorySynchronizationEnabled.
This cmdlet will return True or False. Continue to run this cmdlet periodically until it returns False, and then go to the next step.
Try to update an object by using Windows PowerShell or by using the cloud service portal. By this step, you could remove the synced users.
For the details, you could read here.
My question was in two parts.
1) Disable directory sync. This is answered by #SunnySun-MSFT above.
2) Remove local AD users from Azure AD. For this MSFT support got back to me with a working solution.
Open powershell as admin
Install-msolservice (provide global admin credentials)
Get-msoluser -all -synchronized (display all local users synched with Azure)
Get-msoluser -all -synchronized | remove-msoluser -force (delete synched users)
I have a load of Azure Powershell deployment scripts that are triggered by the build server after the completion of a build which work perfectly - I use the Import-AzurePublishSettingsFile (which is securely stored locally) to log into Azure unattended.
I now need to extend these to include management of Sql Azure Servers, Elastic Pools and Databases.
These, however, are part of the Azure Resource Manager cmdlets which have a different method of authentication.
I've found these articles:
Authenticating a Service Principal with Azure Resource Manager
Using Azure PowerShell with Azure Resource Manager
Using Windows Azure Active Directory to Authenticate the Management Libraries)
but all appear to require you to enter your credentials at some stage at the process. The second link above explicitly states:
The AzureResourceManager module requires Add-AzureAccount. A Publish Settings file is not sufficient.
I've tried (just to see what happens) switching to the Resource Manager with Switch-AzureMode -Name AzureResourceManager and then just executing one of the cmdlets, such as Get-AzureResourceGroup -Name "blah" but I just get an error of
Get-AzureResourceGroup : AuthenticationFailed: Authentication failed. The 'Authorization' header is not present or provided in an invalid format.
I am quite happy to set up an AD Application, manually, once, through the portal and then provide my scripts with the relevant Application ID or whatever is required. I just need it to be unattended so that my build can deploy!
Can anyone tell me how I go about making an unattended script to use these Azure Resource Manager cmdlets through Powershell?
This post gives full details of how to do this. Basically you embed your powershell scripts with the username and password of your AD user.
Unattended authentication to Azure Management APIs with Azure Active Directory
But be aware that if, like me, you wish to combine calls to the AzureResourceManager and AzureServiceManagement modes (using Switch-AzureMode) then you must use Add-AzureAccount -Credential <credentials> and also Remove-AzureAccount -Name <username> otherwise some of the AzureServiceManagement mode cmdlets cease to work.