|
| 1 | +<# |
| 2 | +.SYNOPSIS |
| 3 | +Adds inheritable permissions to Agent Identity Blueprints |
| 4 | +
|
| 5 | +.DESCRIPTION |
| 6 | +Configures inheritable Microsoft Graph permissions that can be granted to Agent Identity Blueprints. |
| 7 | +This allows agents created from the blueprint to inherit specific Microsoft Graph permissions. |
| 8 | +
|
| 9 | +.PARAMETER Scopes |
| 10 | +Optional. Array of Microsoft Graph permission scopes to make inheritable. If not provided, will prompt for input. |
| 11 | +Common scopes include: User.Read, Mail.Read, Calendars.Read, etc. |
| 12 | +
|
| 13 | +.PARAMETER ResourceAppId |
| 14 | +Optional. The resource application ID. Defaults to Microsoft Graph (00000003-0000-0000-c000-000000000000). |
| 15 | +
|
| 16 | +.EXAMPLE |
| 17 | +Add-MsIdInheritablePermissionsToAgentIdentityBlueprint # Will prompt for scopes |
| 18 | +
|
| 19 | +.EXAMPLE |
| 20 | +Add-MsIdInheritablePermissionsToAgentIdentityBlueprint -Scopes @("User.Read", "Mail.Read", "Calendars.Read") |
| 21 | +
|
| 22 | +.EXAMPLE |
| 23 | +Add-MsIdInheritablePermissionsToAgentIdentityBlueprint -Scopes @("User.Read") -ResourceAppId "00000003-0000-0000-c000-000000000000" |
| 24 | +#> |
| 25 | +function Add-MsIdInheritablePermissionsToAgentIdentityBlueprint { |
| 26 | + [CmdletBinding()] |
| 27 | + param ( |
| 28 | + [Parameter(Mandatory = $false)] |
| 29 | + [string[]]$Scopes, |
| 30 | + |
| 31 | + [Parameter(Mandatory = $false)] |
| 32 | + [string]$ResourceAppId = "00000003-0000-0000-c000-000000000000" |
| 33 | + ) |
| 34 | + |
| 35 | + # Prompt for ResourceAppId if not provided |
| 36 | + if (-not $ResourceAppId -or $ResourceAppId.Trim() -eq "") { |
| 37 | + Write-Host "Enter the Resource Application ID for the permissions." -ForegroundColor Yellow |
| 38 | + Write-Host "Default: 00000003-0000-0000-c000-000000000000 (Microsoft Graph)" -ForegroundColor Gray |
| 39 | + |
| 40 | + $resourceInput = Read-Host "Resource App ID (press Enter for Microsoft Graph default)" |
| 41 | + if ($resourceInput -and $resourceInput.Trim() -ne "") { |
| 42 | + $ResourceAppId = $resourceInput.Trim() |
| 43 | + } else { |
| 44 | + $ResourceAppId = "00000003-0000-0000-c000-000000000000" |
| 45 | + Write-Host "Using default: Microsoft Graph" -ForegroundColor Cyan |
| 46 | + } |
| 47 | + } |
| 48 | + |
| 49 | + # Determine resource name for display |
| 50 | + $resourceName = switch ($ResourceAppId) { |
| 51 | + "00000003-0000-0000-c000-000000000000" { "Microsoft Graph" } |
| 52 | + "00000002-0000-0000-c000-000000000000" { "Azure Active Directory Graph" } |
| 53 | + default { "Custom Resource ($ResourceAppId)" } |
| 54 | + } |
| 55 | + |
| 56 | + # Prompt for scopes if not provided |
| 57 | + if (-not $Scopes -or $Scopes.Count -eq 0) { |
| 58 | + Write-Host "Enter permission scopes to make inheritable for $resourceName." -ForegroundColor Yellow |
| 59 | + if ($ResourceAppId -eq "00000003-0000-0000-c000-000000000000") { |
| 60 | + Write-Host "Common Microsoft Graph scopes: User.Read, Mail.Read, Calendars.Read, Files.Read, etc." -ForegroundColor Gray |
| 61 | + } |
| 62 | + Write-Host "Enter multiple scopes separated by commas." -ForegroundColor Gray |
| 63 | + |
| 64 | + do { |
| 65 | + $scopeInput = Read-Host "Enter permission scopes (comma-separated)" |
| 66 | + if ($scopeInput -and $scopeInput.Trim() -ne "") { |
| 67 | + $Scopes = $scopeInput.Split(',') | ForEach-Object { $_.Trim() } | Where-Object { $_ -ne "" } |
| 68 | + } |
| 69 | + } while (-not $Scopes -or $Scopes.Count -eq 0) |
| 70 | + } |
| 71 | + |
| 72 | + # Check if we have a stored Agent Blueprint ID |
| 73 | + if (-not $script:CurrentAgentBlueprintId) { |
| 74 | + Write-Error "No Agent Blueprint ID available. Please create a blueprint first using New-MsIdAgentIdentityBlueprint." |
| 75 | + return |
| 76 | + } |
| 77 | + |
| 78 | + # Ensure we're connected to Microsoft Graph |
| 79 | + $context = Get-MgContext |
| 80 | + if (-not $context) { |
| 81 | + Write-Error "Not connected to Microsoft Graph. Please run Connect-MgGraph first." |
| 82 | + return |
| 83 | + } |
| 84 | + |
| 85 | + try { |
| 86 | + Write-Host "Adding inheritable permissions to Agent Identity Blueprint..." -ForegroundColor Yellow |
| 87 | + Write-Host "Agent Blueprint ID: $($script:CurrentAgentBlueprintId)" -ForegroundColor Gray |
| 88 | + Write-Host "Resource App ID: $ResourceAppId ($resourceName)" -ForegroundColor Cyan |
| 89 | + Write-Host "Scopes to make inheritable:" -ForegroundColor Cyan |
| 90 | + foreach ($scope in $Scopes) { |
| 91 | + Write-Host " - $scope" -ForegroundColor White |
| 92 | + } |
| 93 | + |
| 94 | + # Build the request body |
| 95 | + $Body = [PSCustomObject]@{ |
| 96 | + resourceAppId = $ResourceAppId |
| 97 | + inheritableScopes = [PSCustomObject]@{ |
| 98 | + "@odata.type" = "microsoft.graph.enumeratedScopes" |
| 99 | + scopes = $Scopes |
| 100 | + } |
| 101 | + } |
| 102 | + |
| 103 | + $JsonBody = $Body | ConvertTo-Json -Depth 5 |
| 104 | + Write-Debug "Request Body: $JsonBody" |
| 105 | + |
| 106 | + # Use Invoke-MgRestMethod to make the API call with the stored Agent Blueprint ID |
| 107 | + $apiUrl = "https://graph.microsoft.com/beta/applications/microsoft.graph.agentIdentityBlueprint/$($script:CurrentAgentBlueprintId)/inheritablePermissions" |
| 108 | + Write-Debug "API URL: $apiUrl" |
| 109 | + $result = Invoke-MgRestMethod -Method POST -Uri $apiUrl -Body $JsonBody -ContentType "application/json" |
| 110 | + |
| 111 | + Write-Host "Successfully added inheritable permissions to Agent Identity Blueprints" -ForegroundColor Green |
| 112 | + Write-Host "Permissions are now available for inheritance by agent blueprints" -ForegroundColor Green |
| 113 | + |
| 114 | + # Store the scopes for use in other functions |
| 115 | + $script:LastConfiguredInheritableScopes = $Scopes |
| 116 | + |
| 117 | + # Create a result object with permission information |
| 118 | + $permissionResult = [PSCustomObject]@{ |
| 119 | + AgentBlueprintId = $script:CurrentAgentBlueprintId |
| 120 | + ResourceAppId = $ResourceAppId |
| 121 | + ResourceAppName = $resourceName |
| 122 | + InheritableScopes = $Scopes |
| 123 | + ScopeCount = $Scopes.Count |
| 124 | + ConfiguredAt = Get-Date |
| 125 | + ApiResponse = $result |
| 126 | + } |
| 127 | + |
| 128 | + return $permissionResult |
| 129 | + } |
| 130 | + catch { |
| 131 | + Write-Error "Failed to add inheritable permissions: $_" |
| 132 | + if ($_.Exception.Response) { |
| 133 | + Write-Host "Response Status: $($_.Exception.Response.StatusCode)" -ForegroundColor Red |
| 134 | + if ($_.Exception.Response.Content) { |
| 135 | + Write-Host "Response Content: $($_.Exception.Response.Content)" -ForegroundColor Red |
| 136 | + } |
| 137 | + } |
| 138 | + throw |
| 139 | + } |
| 140 | +} |
0 commit comments