Skip to content

Commit 0d786d1

Browse files
v-regandownerv-regandowner
authored
Merge pull request #264497 from spelluru/aadgraph0126
Graph API
2 parents 96163ce + c44f554 commit 0d786d1

File tree

3 files changed

+90
-91
lines changed

3 files changed

+90
-91
lines changed

‎articles/event-grid/scripts/powershell-webhook-secure-delivery-microsoft-entra-app.md

Lines changed: 35 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
title: Azure PowerShell - Secure WebHook delivery with Microsoft Entra Application in Azure Event Grid
33
description: Describes how to deliver events to HTTPS endpoints protected by Microsoft Entra Application using Azure Event Grid
44
ms.devlang: powershell
5-
ms.custom: devx-track-azurepowershell, has-azure-ad-ps-ref
5+
ms.custom: has-azure-ad-ps-ref, azure-ad-ref-level-one-done
66
ms.topic: sample
7-
ms.date: 10/14/2021
7+
ms.date: 02/02/2024
88
---
99

1010
# Secure WebHook delivery with Microsoft Entra Application in Azure Event Grid
@@ -34,10 +34,10 @@ try {
3434
3535
Function CreateAppRole([string] $Name, [string] $Description)
3636
{
37-
$appRole = New-Object Microsoft.Open.AzureAD.Model.AppRole
37+
$appRole = New-Object Microsoft.Graph.PowerShell.Models.MicrosoftGraphAppRole
3838
$appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string]
39-
$appRole.AllowedMemberTypes.Add("Application");
40-
$appRole.AllowedMemberTypes.Add("User");
39+
$appRole.AllowedMemberTypes += "Application";
40+
$appRole.AllowedMemberTypes += "User";
4141
$appRole.DisplayName = $Name
4242
$appRole.Id = New-Guid
4343
$appRole.IsEnabled = $true
@@ -47,65 +47,64 @@ try {
4747
return $appRole
4848
}
4949
50-
# Creates Azure Event Grid Azure AD Application if not exists
50+
# Creates Azure Event Grid Microsoft Entra Application if not exists
5151
# You don't need to modify this id
52-
# But Azure Event Grid Azure AD Application Id is different for different clouds
52+
# But Azure Event Grid Entra Application Id is different for different clouds
5353
5454
$eventGridAppId = "4962773b-9cdb-44cf-a8bf-237846a00ab7" # Azure Public Cloud
5555
# $eventGridAppId = "54316b56-3481-47f9-8f30-0300f5542a7b" # Azure Government Cloud
56-
$eventGridRoleName = "AzureEventGridSecureWebhookSubscriber" # You don't need to modify this role name
57-
$eventGridSP = Get-AzureADServicePrincipal -Filter ("appId eq '" + $eventGridAppId + "'")
58-
if ($eventGridSP -match "Microsoft.EventGrid")
56+
$eventGridSP = Get-MgServicePrincipal -Filter ("appId eq '" + $eventGridAppId + "'")
57+
if ($eventGridSP.DisplayName -match "Microsoft.EventGrid")
5958
{
60-
Write-Host "The Azure AD Application is already defined.`n"
59+
Write-Host "The Event Grid Microsoft Entra Application is already defined.`n"
6160
} else {
62-
Write-Host "Creating the Azure Event Grid Azure AD Application"
63-
$eventGridSP = New-AzureADServicePrincipal -AppId $eventGridAppId
61+
Write-Host "Creating the Azure Event Grid Microsoft Entra Application"
62+
$eventGridSP = New-MgServicePrincipal -AppId $eventGridAppId
6463
}
6564
66-
# Creates the Azure app role for the webhook Azure AD application
67-
68-
$app = Get-AzureADApplication -ObjectId $webhookAppObjectId
65+
# Creates the Azure app role for the webhook Microsoft Entra application
66+
$eventGridRoleName = "AzureEventGridSecureWebhookSubscriber" # You don't need to modify this role name
67+
$app = Get-MgApplication -ObjectId $webhookAppObjectId
6968
$appRoles = $app.AppRoles
7069
71-
Write-Host "Azure AD App roles before addition of the new role..."
72-
Write-Host $appRoles
70+
Write-Host "Microsoft Entra App roles before addition of the new role..."
71+
Write-Host $appRoles.DisplayName
7372
74-
if ($appRoles -match $eventGridRoleName)
73+
if ($appRoles.DisplayName -match $eventGridRoleName)
7574
{
7675
Write-Host "The Azure Event Grid role is already defined.`n"
7776
} else {
78-
Write-Host "Creating the Azure Event Grid role in Azure AD Application: " $webhookAppObjectId
77+
Write-Host "Creating the Azure Event Grid role in Microsoft Entra Application: " $webhookAppObjectId
7978
$newRole = CreateAppRole -Name $eventGridRoleName -Description "Azure Event Grid Role"
80-
$appRoles.Add($newRole)
81-
Set-AzureADApplication -ObjectId $app.ObjectId -AppRoles $appRoles
79+
$appRoles += $newRole
80+
Update-MgApplication -ApplicationId $webhookAppObjectId -AppRoles $appRoles
8281
}
8382
84-
Write-Host "Azure AD App roles after addition of the new role..."
85-
Write-Host $appRoles
83+
Write-Host "Microsoft Entra App roles after addition of the new role..."
84+
Write-Host $appRoles.DisplayName
8685
8786
# Creates the user role assignment for the app that will create event subscription
8887
89-
$servicePrincipal = Get-AzureADServicePrincipal -Filter ("appId eq '" + $app.AppId + "'")
90-
$eventSubscriptionWriterSP = Get-AzureADServicePrincipal -Filter ("appId eq '" + $eventSubscriptionWriterAppId + "'")
88+
$servicePrincipal = Get-MgServicePrincipal -Filter ("appId eq '" + $app.AppId + "'")
89+
$eventSubscriptionWriterSP = Get-MgServicePrincipal -Filter ("appId eq '" + $eventSubscriptionWriterAppId + "'")
9190
9291
if ($null -eq $eventSubscriptionWriterSP)
9392
{
94-
Write-Host "Create new Azure AD Application"
95-
$eventSubscriptionWriterSP = New-AzureADServicePrincipal -AppId $eventSubscriptionWriterAppId
93+
Write-Host "Create new Microsoft Entra Application"
94+
$eventSubscriptionWriterSP = New-MgServicePrincipal -AppId $eventSubscriptionWriterAppId
9695
}
9796
9897
try
9998
{
100-
Write-Host "Creating the Azure AD Application role assignment: " $eventSubscriptionWriterAppId
99+
Write-Host "Creating the Microsoft Entra Application role assignment: " $eventSubscriptionWriterAppId
101100
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
102-
New-AzureADServiceAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventSubscriptionWriterSP.ObjectId -PrincipalId $eventSubscriptionWriterSP.ObjectId
101+
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $eventSubscriptionWriterSP.Id -PrincipalId $eventSubscriptionWriterSP.Id -ResourceId $servicePrincipal.Id -AppRoleId $eventGridAppRole.Id
103102
}
104103
catch
105104
{
106105
if( $_.Exception.Message -like '*Permission being assigned already exists on the object*')
107106
{
108-
Write-Host "The Azure AD Application role is already defined.`n"
107+
Write-Host "The Microsoft Entra Application role is already defined.`n"
109108
}
110109
else
111110
{
@@ -114,15 +113,15 @@ try {
114113
Break
115114
}
116115
117-
# Creates the service app role assignment for Event Grid Azure AD Application
116+
# Creates the service app role assignment for Event Grid Microsoft Entra Application
118117
119118
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
120-
New-AzureADServiceAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventGridSP.ObjectId -PrincipalId $eventGridSP.ObjectId
119+
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $eventGridSP.Id -PrincipalId $eventGridSP.Id -ResourceId $servicePrincipal.Id -AppRoleId $eventGridAppRole.Id
121120
122121
# Print output references for backup
123122
124-
Write-Host ">> Webhook's Azure AD Application Id: $($app.AppId)"
125-
Write-Host ">> Webhook's Azure AD Application ObjectId Id: $($app.ObjectId)"
123+
Write-Host ">> Webhook's Microsoft Entra Application Id: $($app.AppId)"
124+
Write-Host ">> Webhook's Microsoft Entra Application ObjectId Id: $($app.ObjectId)"
126125
}
127126
catch {
128127
Write-Host ">> Exception:"
@@ -134,4 +133,4 @@ catch {
134133

135134
## Script explanation
136135

137-
For more details refer to [Secure WebHook delivery with Microsoft Entra ID in Azure Event Grid](../secure-webhook-delivery.md)
136+
For more information, see [Secure WebHook delivery with Microsoft Entra ID in Azure Event Grid](../secure-webhook-delivery.md).

‎articles/event-grid/scripts/powershell-webhook-secure-delivery-microsoft-entra-user.md

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
title: Azure PowerShell - Secure WebHook delivery with Microsoft Entra user in Azure Event Grid
33
description: Describes how to deliver events to HTTPS endpoints protected by Microsoft Entra user using Azure Event Grid
44
ms.devlang: powershell
5-
ms.custom: devx-track-azurepowershell, has-azure-ad-ps-ref
5+
ms.custom: has-azure-ad-ps-ref, azure-ad-ref-level-one-done
66
ms.topic: sample
7-
ms.date: 09/29/2021
7+
ms.date: 02/02/2024
88
---
99

1010
# Secure WebHook delivery with Microsoft Entra user in Azure Event Grid
@@ -15,15 +15,15 @@ Here are the high level steps from the script:
1515

1616
1. Create a service principal for **Microsoft.EventGrid** if it doesn't already exist.
1717
1. Create a role named **AzureEventGridSecureWebhookSubscriber** in the **Microsoft Entra app for your Webhook**.
18-
1. Add service principal of user who will be creating the subscription to the AzureEventGridSecureWebhookSubscriber role.
18+
1. Add service principal of user who is creating the subscription to the AzureEventGridSecureWebhookSubscriber role.
1919
1. Add service principal of Microsoft.EventGrid to the AzureEventGridSecureWebhookSubscriber.
2020

21-
## Sample script - stable
21+
## Sample script
2222

2323
```azurepowershell
2424
# NOTE: Before run this script ensure you are logged in Azure by using "az login" command.
2525
26-
$webhookAppObjectId = "[REPLACE_WITH_YOUR_ID]"
26+
$webhookAppId = "[REPLACE_WITH_YOUR_ID]"
2727
$eventSubscriptionWriterUserPrincipalName = "[REPLACE_WITH_USER_PRINCIPAL_NAME_OF_THE_USER_WHO_WILL_CREATE_THE_SUBSCRIPTION]"
2828
2929
# Start execution
@@ -33,10 +33,10 @@ try {
3333
3434
Function CreateAppRole([string] $Name, [string] $Description)
3535
{
36-
$appRole = New-Object Microsoft.Open.AzureAD.Model.AppRole
36+
$appRole = New-Object Microsoft.Graph.PowerShell.Models.MicrosoftGraphAppRole
3737
$appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string]
38-
$appRole.AllowedMemberTypes.Add("Application");
39-
$appRole.AllowedMemberTypes.Add("User");
38+
$appRole.AllowedMemberTypes += "Application";
39+
$appRole.AllowedMemberTypes += "User";
4040
$appRole.DisplayName = $Name
4141
$appRole.Id = New-Guid
4242
$appRole.IsEnabled = $true
@@ -46,59 +46,59 @@ try {
4646
return $appRole
4747
}
4848
49-
# Creates Azure Event Grid Azure AD Application if not exists
49+
# Creates Azure Event Grid Microsoft Entra Application if not exists
5050
# You don't need to modify this id
51-
# But Azure Event Grid Azure AD Application Id is different for different clouds
51+
# But Azure Event Grid Microsoft Entra Application Id is different for different clouds
5252
5353
$eventGridAppId = "4962773b-9cdb-44cf-a8bf-237846a00ab7" # Azure Public Cloud
5454
# $eventGridAppId = "54316b56-3481-47f9-8f30-0300f5542a7b" # Azure Government Cloud
55-
$eventGridRoleName = "AzureEventGridSecureWebhookSubscriber" # You don't need to modify this role name
56-
$eventGridSP = Get-AzureADServicePrincipal -Filter ("appId eq '" + $eventGridAppId + "'")
57-
if ($eventGridSP -match "Microsoft.EventGrid")
55+
$eventGridSP = Get-MgServicePrincipal -Filter ("appId eq '" + $eventGridAppId + "'")
56+
if ($eventGridSP.DisplayName -match "Microsoft.EventGrid")
5857
{
59-
Write-Host "The Azure AD Application is already defined.`n"
58+
Write-Host "The Event Grid Microsoft Entra Application is already defined.`n"
6059
} else {
61-
Write-Host "Creating the Azure Event Grid Azure AD Application"
62-
$eventGridSP = New-AzureADServicePrincipal -AppId $eventGridAppId
60+
Write-Host "Creating the Azure Event Grid Microsoft Entra Application"
61+
$eventGridSP = New-MgServicePrincipal -AppId $eventGridAppId
6362
}
6463
65-
# Creates the Azure app role for the webhook Azure AD application
64+
# Creates the Azure app role for the webhook Microsoft Entra application
65+
$eventGridRoleName = "AzureEventGridSecureWebhookSubscriber" # You don't need to modify this role name
6666
67-
$app = Get-AzureADApplication -ObjectId $webhookAppObjectId
67+
$app = Get-MgApplication -ApplicationId $webhookAppObjectId
6868
$appRoles = $app.AppRoles
6969
70-
Write-Host "Azure AD App roles before addition of the new role..."
71-
Write-Host $appRoles
70+
Write-Host "Microsoft Entra App roles before addition of the new role..."
71+
Write-Host $appRoles.DisplayName
7272
73-
if ($appRoles -match $eventGridRoleName)
73+
if ($appRoles.DisplayName -match $eventGridRoleName)
7474
{
7575
Write-Host "The Azure Event Grid role is already defined.`n"
7676
} else {
77-
Write-Host "Creating the Azure Event Grid role in Azure AD Application: " $webhookAppObjectId
77+
Write-Host "Creating the Azure Event Grid role in Microsoft Entra Application: " $webhookAppObjectId
7878
$newRole = CreateAppRole -Name $eventGridRoleName -Description "Azure Event Grid Role"
79-
$appRoles.Add($newRole)
80-
Set-AzureADApplication -ObjectId $app.ObjectId -AppRoles $appRoles
79+
$appRoles += $newRole
80+
Update-MgApplication -ApplicationId $webhookAppObjectId -AppRoles $appRoles
8181
}
8282
83-
Write-Host "Azure AD App roles after addition of the new role..."
84-
Write-Host $appRoles
83+
Write-Host "Microsoft Entra App roles after addition of the new role..."
84+
Write-Host $appRoles.DisplayName
8585
8686
# Creates the user role assignment for the user who will create event subscription
8787
88-
$servicePrincipal = Get-AzureADServicePrincipal -Filter ("appId eq '" + $app.AppId + "'")
88+
$servicePrincipal = Get-MgServicePrincipal -Filter ("appId eq '" + $app.AppId + "'")
8989
9090
try
9191
{
92-
Write-Host "Creating the Azure Ad App Role assignment for user: " $eventSubscriptionWriterUserPrincipalName
93-
$eventSubscriptionWriterUser = Get-AzureAdUser -ObjectId $eventSubscriptionWriterUserPrincipalName
92+
Write-Host "Creating the Microsoft Entra App Role assignment for user: " $eventSubscriptionWriterUserPrincipalName
93+
$eventSubscriptionWriterUser = Get-MgUser -UserId $eventSubscriptionWriterUserPrincipalName
9494
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
95-
New-AzureADUserAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventSubscriptionWriterUser.ObjectId -PrincipalId $eventSubscriptionWriterUser.ObjectId
95+
New-MgUserAppRoleAssignment -UserId $eventSubscriptionWriterUser.Id -PrincipalId $eventSubscriptionWriterUser.Id -ResourceId $servicePrincipal.Id -AppRoleId $eventGridAppRole.Id
9696
}
9797
catch
9898
{
9999
if( $_.Exception.Message -like '*Permission being assigned already exists on the object*')
100100
{
101-
Write-Host "The Azure AD User Application role is already defined.`n"
101+
Write-Host "The Microsoft Entra User Application role is already defined.`n"
102102
}
103103
else
104104
{
@@ -107,15 +107,15 @@ try {
107107
Break
108108
}
109109
110-
# Creates the service app role assignment for Event Grid Azure AD Application
110+
# Creates the service app role assignment for Event Grid Microsoft Entra Application
111111
112112
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
113-
New-AzureADServiceAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventGridSP.ObjectId -PrincipalId $eventGridSP.ObjectId
113+
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $eventGridSP.Id -PrincipalId $eventGridSP.Id -ResourceId $servicePrincipal.Id -AppRoleId $eventGridAppRole.Id
114114
115115
# Print output references for backup
116116
117-
Write-Host ">> Webhook's Azure AD Application Id: $($app.AppId)"
118-
Write-Host ">> Webhook's Azure AD Application ObjectId Id: $($app.ObjectId)"
117+
Write-Host ">> Webhook's Microsoft Entra Application Id: $($app.AppId)"
118+
Write-Host ">> Webhook's Microsoft Entra Application Object Id: $($app.Id)"
119119
}
120120
catch {
121121
Write-Host ">> Exception:"
@@ -127,4 +127,4 @@ catch {
127127

128128
## Script explanation
129129

130-
For more details refer to [Secure WebHook delivery with Microsoft Entra ID in Azure Event Grid](../secure-webhook-delivery.md)
130+
For more information, see [Secure WebHook delivery with Microsoft Entra ID in Azure Event Grid](../secure-webhook-delivery.md).

0 commit comments

Comments
 (0)