I am trying to migrate existing users to Azure B2C, I've added a new custom attribute to B2C called "CompanyId". When doing a bulk upload I have added a column to the CSV file called "CompanyId" but the B2C upload facility rejects the file, telling me that the "CompanyId" column header is not valid.
Is it possible to bulk upload users to B2C with custom attributes?
No, you cant bulk upload users with custom attribute on Azure portal using CSV directly. But you can update users' custom attribute after users created using PowerShell as below :
Connect-AzureAD //connect to your b2c tenant
$userNameList = <string array list of signin name of users in your CSV>
$ExtensionName = <extension name of your company id attribute>
$ExtensionValue = <value of your companyID>
$userlist = Get-AzureADUser | Where-Object {$userNameList.Contains($_.SignInNames[0].Value) }
foreach( $user in $userlist){
Set-AzureADUserExtension -ExtensionName $ExtensionName -ExtensionValue $ExtensionValue -ObjectId $user.ObjectId
}
As you can see, there is one param that we not know is "ExtensionName" . Once we created a custom attribute in B2C, the backend will create an key for it(more information), generally the key format is : extension_<some id>_<name of custom attribute>. The key is the value of ExtensionName here. To find the key , run the ps command below :
Get-AzureADExtensionProperty
I created a custom attribute as you and As you can see, the key in my case is extension_48c33b45c4f8419eb9d97a0f3ff1817b_CompanyId
So we can just add this extension key with the value you need to new created users will meet your requirement.
In this case , I uploaded a test user from Azure portal, as you can see, while I use the user to get access token , there is no companyID claim :
After run script below :
Connect-AzureAD
$userNameList = New-Object System.Collections.ArrayList
$userNameList.Add("newuser")
$ExtensionName = "extension_48c33b45c4f8419eb9d97a0f3ff1817b_CompanyId"
$ExtensionValue = "MSFT"
$userlist = Get-AzureADUser | Where-Object {$userNameList.Contains($_.SignInNames[0].Value) }
foreach( $user in $userlist){
Set-AzureADUserExtension -ExtensionName $ExtensionName -ExtensionValue $ExtensionValue -ObjectId $user.ObjectId
}
Get an access token by this new created user named "newuser" again :
As you can see , the company ID has been set. Hope it helps .
Related
Hallo i have a users in Azure AD with is member of 50 groupps and i want an new user to be member of same 50 groups is there any way to add new user to all those 50 groups withouts doing one by one?
so far no idea i can only add them one by one
You can achieve this using AzureAD powershell module and by using the below cmdlet.
Connect-AzureAD
Get-AzureADUserMembership -ObjectId "the current user object number you want to copy from" |foreach { Add-AzureADGroupMember -ObjectId $_.ObjectId -RefObjectId " the new user object number here" }
I have tested this and it is working fine.
Wrote the below script to get the MFA status for all admins.
Works well. But I want to run this using the credential of a service principal and looks like Connect-MsolService does not have an option to do that.
Alternatively, Connect-AzAccount has the option to do that but in Az Powershell I dont find a way to get the MFA details of the users.
Is there a way to get the MFA details of the user using service principal?
Connect-MsolService
$output_file_location = "c:\temp\azure_admins_mfa_status_"+$(get-date -f yyyy-MM-dd-HH-mm-ss)+".csv"
$admin_roles = "Company Administrator","Billing Administrator","Conditional Access Administrator","Exchange Service administrator","Helpdesk administrator","Password administrator","Security administrator","Sharepoint Service administrator"
# Gets all the members in the admin roles in the roles list above
# Gets the MFA status for each member
# Appends the below data points to a file specified in the $output_file_location variable
# DisplayName,E-mail,Role,MFA-Requirements, MFA-Methods, MFA-MethodsDefault
function get-mfs-status
{
foreach ($roleName in $admin_roles)
{
write-output $roleName
$members = Get-MsolRoleMember -RoleObjectId $(Get-MsolRole -RoleName $roleName).ObjectId
#write-output $members
foreach ($member in $members)
{
write-output $member.EmailAddress
}
foreach ($member in $members)
{
write-output $member
Get-MsolUser -UserPrincipalName $member.EmailAddress | select DisplayName, `
#{N='E-mail';E={$_.userPrincipalName}}, `
#{N='Role';E={$roleName}}, `
#{N='MFA-Requirements';E={(($_).StrongAuthenticationRequirements.state)}}, `
#{N='MFA-Methods';E={(($_).StrongAuthenticationMethods.MethodType)}}, `
#{N='MFA-MethodsDefault';E={($_.StrongAuthenticationMethods | where isdefault -eq 'true').MethodType}} `
| select DisplayName,E-mail,Role, MFA-Requirements, MFA-Methods, MFA-MethodsDefault| Export-Csv $output_file_location -Append `
}
}
}
get-mfs-status
• No, you cannot retrieve the MFA details of the users in an Azure AD using service principal through powershell because service principal is generated for an instance of Azure resource, not an identity which has already been assigned an Azure AD role regarding the scope that has been defined with it. Thus, as an identity though of an Azure AD administrator has the scope of the whole subscription which hosts multiple tenants of your organization, has been defined with some roles and assignments pertaining to that scope. You can create a service principal with that ID logged in to Azure Powershell for the scope of your signed in ID but cannot retrieve the MFA status of users in Azure AD because when you pass the service principal in a variable to pass it as a credential and log in to the Microsoft 365 online, it cannot actuate them to the identity credentials and M365 doesn’t consider it.
Also, to get the status of MFA details of the users, you must connect to MS Online, you cannot retrieve it through Azure AD. Even if you convert the service principal secret in plain text and pass it as a credential to connect to M365, it doesn’t consider it nor it actuates the credentials.
• Instead, if you log into Azure/M365 using your actual credentials, i.e., ID and password, you will be able to retrieve the details provided you have the required role assignments and access.
Reference link for service principal usage: - https://learn.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-6.6.0
It's beta but how about that:
https://learn.microsoft.com/en-us/graph/api/reportroot-list-credentialuserregistrationdetails?view=graph-rest-beta&tabs=http
I am trying to figure out a user friendly way to assign roles for my Azure App Registration with Powershell.
Get-AzureADServiceAppRoleAssignment -ObjectId 'XXXXX-X..'
With this command I can get a list of all roles assigned to users.
I am not able to find a command that will just list the roles that exist whether they are assigned to someone or not.
Does this exist? I haven't found it in the documentation.
The Cmdlet you would want to use is Get-AzureADApplication and then app roles will be available through its AppRoles property.
Please try something like:
$app = Get-AzureADApplication -Filter "ObjectId eq '<object-id of the app>'"
$appRoles = $app.AppRoles
$appRoles
Will produce an output like containing all roles:
AllowedMemberTypes : {User} Description : Role description.
DisplayName : Role name
Id : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
IsEnabled : True
Value : Role value
I have created a new custom AppRole in App Manifest and I want to assign this new AppRole to all the user's of the application. I researched on this and I find several links on how to assign new AppRole to a user using Powershell or Bash, but I need to assign new AppRole to all the users (nearly 1500 users) using a script. Does anyone have any idea how to do this ?
Below are few links I looked into, but it assign role to a single user:
https://learn.microsoft.com/en-us/powershell/module/azuread/new-azureaduserapproleassignment?view=azureadps-2.0
https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal
You already looked at Azure Portal and the UI available and it isn't very well suited for bulk operations (only one role can be assigned at a time, users have to be selected one by one and there isn't a way to bulk select users based on some criteria etc.)
Following options might help you:
Assign a group to role instead of individual users
This requires a premium version of Azure AD. It's much more convenient not just for first time assignment but for managing overall.
Scripting/API options (PowerShell, CLI, Azure AD Graph API, Microsoft Graph API)
Idea will be to loop through all users (or desired subset of users based on some criteria) and assign the appropriate app role to them.
Here's a sample script for PowerShell.
Connect-AzureAD -TenantId <Your Tenant Id>
$app_name = "RolesWebApp"
$app_role_name = "Writer"
# Get the service principal for the app and app role
$sp = Get-AzureADServicePrincipal -Filter "displayName eq '$app_name'"
$appRole = $sp.AppRoles | Where-Object { $_.DisplayName -eq $app_role_name }
$users = Get-AzureADUser -Top 10
foreach ($user in $users)
{
# Assign the user to the app role
New-AzureADUserAppRoleAssignment -ObjectId $user.ObjectId -PrincipalId
$user.ObjectId -ResourceId $sp.ObjectId -Id $appRole.Id
}
Take a look at this SO thread where we discussed something very similar and has more details on each of the individual options.
Special note on Microsoft Graph API:
Even though for most scenarios it will be recommended to work with Microsoft Graph API instead of Azure AD Graph API. This particular functionality is only available in beta endpoint. So it would not be advisable to use it for any production code. Working with appRoleAssignments
1: Is anyone aware of a tool that can manage the assignment of Roles for Azure AD Users (the appRoles defined in the manifest) for Enterprise Applications in Azure AD?
I am talking about how to Assign Roles (app specific) to existing Azure AD Users. It’s a very slow process using the Azure Portal for this.
Of course, we could create this tool, but would be nice if such a tool already exists. What are large organizations with many Azure AD Enterprise Apps using today?
2: Is it really best practice to manually edit the manifest file in the portal? Would make more sense to have the file (the AppRoles section) in git along the application code.
Is anyone aware of a tool that can manage Roles for Azure AD Users
AFAIK, there isn't any specific tool available to manage Application roles.
Overall, you should be able to use following options for add/edit/update options related to application roles and assigning permissions to existing AD Users:
NOTE: Also know in case you are dealing with a large number of users, you could consider assigning security groups to app roles instead of doing it for individual users. It's an option worth considering, although it requires an Azure AD premium license. (Update - Also see comment from Philippe Signoret at the end of this answer about assigning groups to app roles, delegating management of the assigned groups and self-service group management)
Azure Portal by editing application manifest json (you're aware of this already)
PowerShell -
I've added a script for this one at the end. You can do this while creating a new app using New-AzureADApplication or for an existing application using Set-AzureADApplication.
For assigning these roles to existing users, you can use New-AzureADUserAppRoleAssignment as I have shown below with the updated script.
Azure AD Graph API -
You can work with AppRole Type and Application entity for managing app roles themselves. Documentation here
You can work with AppRoleAssignment Entity for assigning these roles to existing Azure AD users etc. Documentation here
Microsoft Graph API -
Documentation here - Please notice this is available only in beta version - so it's not yet good for production applications.
Look here for working with App Role Assignments
For your production applications, you could read application roles from a json file (part of source control like git etc.) and feed that into one of the programmatic options like PowerShell or Azure AD Graph API.
Here is the PowerShell script. Also take a look at these SO Post where we discussed something similar but only in scope of PowerShell.
SO Post 1
SO Post 2 (This question discusses parsing json file and updating Application manifest using PowerShell)
Connect-AzureAD -TenantId <Tenant GUID>
# Create an application role of given name and description
Function CreateAppRole([string] $Name, [string] $Description)
{
$appRole = New-Object Microsoft.Open.AzureAD.Model.AppRole
$appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string]
$appRole.AllowedMemberTypes.Add("User");
$appRole.DisplayName = $Name
$appRole.Id = New-Guid
$appRole.IsEnabled = $true
$appRole.Description = $Description
$appRole.Value = $Name;
return $appRole
}
# ObjectId for application from App Registrations in your AzureAD
$appObjectId = "<Your Application Object Id>"
$app = Get-AzureADApplication -ObjectId $appObjectId
$appRoles = $app.AppRoles
Write-Host "App Roles before addition of new role.."
Write-Host $appRoles
$newRole = CreateAppRole -Name "MyNewApplicationRole" -Description "This is my new Application Role"
$appRoles.Add($newRole)
Set-AzureADApplication -ObjectId $app.ObjectId -AppRoles $appRoles
Once you are done with above script to add AppRole, then assigning roles to a user is pretty simple and a direct command is available. Here's a sample script for that -
# Assign the values to the variables
$username = "<You user's UPN>"
$app_name = "<Your App's display name>"
$app_role_name = "<App role display name>"
# Get the user to assign, and the service principal for the app to assign to
$user = Get-AzureADUser -ObjectId "$username"
$sp = Get-AzureADServicePrincipal -Filter "displayName eq '$app_name'"
$appRole = $sp.AppRoles | Where-Object { $_.DisplayName -eq $app_role_name }
# Assign the user to the app role
New-AzureADUserAppRoleAssignment -ObjectId $user.ObjectId -PrincipalId
$user.ObjectId -ResourceId $sp.ObjectId -Id $appRole.Id
Late response but possibly better late than never, Terraform has support for this:
https://www.terraform.io/docs/providers/azuread/r/application.html