Skip to content

Commit 70eda0b

Browse files
robecerobece
committed
Updated scripts
1 parent e088cf4 commit 70eda0b

File tree

2 files changed

+208
-2
lines changed

2 files changed

+208
-2
lines changed

‎articles/event-grid/scripts/event-grid-powershell-webhook-secure-delivery-azure-ad-app.md

Lines changed: 107 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,113 @@ ms.date: 09/29/2021
1010

1111
## Sample script - stable
1212

13-
[!code-powershell[main](../../../powershell_scripts/event-grid/secure-webhook-delivery/secure-webhook-azure-ad-app.ps1 "Register Azure AD App")]
13+
```azurepowershell
14+
# NOTE: Before run this script ensure you are logged in Azure by using "az login" command.
15+
16+
$webhookAppObjectId = "[REPLACE_WITH_YOUR_ID]"
17+
$eventSubscriptionWriterAppId = "[REPLACE_WITH_YOUR_ID]"
18+
19+
# Start execution
20+
try {
21+
22+
# Creates an application role of given name and description
23+
24+
Function CreateAppRole([string] $Name, [string] $Description)
25+
{
26+
$appRole = New-Object Microsoft.Open.AzureAD.Model.AppRole
27+
$appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string]
28+
$appRole.AllowedMemberTypes.Add("Application");
29+
$appRole.AllowedMemberTypes.Add("User");
30+
$appRole.DisplayName = $Name
31+
$appRole.Id = New-Guid
32+
$appRole.IsEnabled = $true
33+
$appRole.Description = $Description
34+
$appRole.Value = $Name;
35+
36+
return $appRole
37+
}
38+
39+
# Creates Azure Event Grid Azure AD Application if not exists
40+
41+
$eventGridAppId = "4962773b-9cdb-44cf-a8bf-237846a00ab7" # You don't need to modify this id
42+
$eventGridRoleName = "AzureEventGridSecureWebhookSubscriber" # You don't need to modify this role name
43+
$eventGridSP = Get-AzureADServicePrincipal -Filter ("appId eq '" + $eventGridAppId + "'")
44+
if ($eventGridSP -match "Microsoft.EventGrid")
45+
{
46+
Write-Host "The Azure AD Application is already defined.`n"
47+
} else {
48+
Write-Host "Creating the Azure Event Grid Azure AD Application"
49+
$eventGridSP = New-AzureADServicePrincipal -AppId $eventGridAppId
50+
}
51+
52+
# Creates the Azure app role for the webhook Azure AD application
53+
54+
$app = Get-AzureADApplication -ObjectId $webhookAppObjectId
55+
$appRoles = $app.AppRoles
56+
57+
Write-Host "Azure AD App roles before addition of the new role..."
58+
Write-Host $appRoles
59+
60+
if ($appRoles -match $eventGridRoleName)
61+
{
62+
Write-Host "The Azure Event Grid role is already defined.`n"
63+
} else {
64+
Write-Host "Creating the Azure Event Grid role in Azure AD Application: " $webhookAppObjectId
65+
$newRole = CreateAppRole -Name $eventGridRoleName -Description "Azure Event Grid Role"
66+
$appRoles.Add($newRole)
67+
Set-AzureADApplication -ObjectId $app.ObjectId -AppRoles $appRoles
68+
}
69+
70+
Write-Host "Azure AD App roles after addition of the new role..."
71+
Write-Host $appRoles
72+
73+
# Creates the user role assignment for the app that will create event subscription
74+
75+
$servicePrincipal = Get-AzureADServicePrincipal -Filter ("appId eq '" + $app.AppId + "'")
76+
$eventSubscriptionWriterSP = Get-AzureADServicePrincipal -Filter ("appId eq '" + $eventSubscriptionWriterAppId + "'")
77+
78+
if ($null -eq $eventSubscriptionWriterSP)
79+
{
80+
Write-Host "Create new Azure AD Application"
81+
$eventSubscriptionWriterSP = New-AzureADServicePrincipal -AppId $eventSubscriptionWriterAppId
82+
}
83+
84+
try
85+
{
86+
Write-Host "Creating the Azure AD Application role assignment: " $eventSubscriptionWriterAppId
87+
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
88+
New-AzureADServiceAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventSubscriptionWriterSP.ObjectId -PrincipalId $eventSubscriptionWriterSP.ObjectId
89+
}
90+
catch
91+
{
92+
if( $_.Exception.Message -like '*Permission being assigned already exists on the object*')
93+
{
94+
Write-Host "The Azure AD Application role is already defined.`n"
95+
}
96+
else
97+
{
98+
Write-Error $_.Exception.Message
99+
}
100+
Break
101+
}
102+
103+
# Creates the service app role assignment for Event Grid Azure AD Application
104+
105+
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
106+
New-AzureADServiceAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventGridSP.ObjectId -PrincipalId $eventGridSP.ObjectId
107+
108+
# Print output references for backup
109+
110+
Write-Host ">> Webhook's Azure AD Application Id: $($app.AppId)"
111+
Write-Host ">> Webhook's Azure AD Application ObjectId Id: $($app.ObjectId)"
112+
}
113+
catch {
114+
Write-Host ">> Exception:"
115+
Write-Host $_
116+
Write-Host ">> StackTrace:"
117+
Write-Host $_.ScriptStackTrace
118+
}
119+
```
14120

15121
## Script explanation
16122

‎articles/event-grid/scripts/event-grid-powershell-webhook-secure-delivery-azure-ad-user.md

Lines changed: 101 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,107 @@ ms.date: 09/29/2021
1010

1111
## Sample script - stable
1212

13-
[!code-powershell[main](../../../powershell_scripts/event-grid/secure-webhook-delivery/secure-webhook-azure-ad-user.ps1 "Register Azure AD User")]
13+
```azurepowershell
14+
# NOTE: Before run this script ensure you are logged in Azure by using "az login" command.
15+
16+
$webhookAppObjectId = "[REPLACE_WITH_YOUR_ID]"
17+
$eventSubscriptionWriterUserPrincipalName = "[REPLACE_WITH_USER_PRINCIPAL_NAME_OF_THE_USER_WHO_WILL_CREATE_THE_SUBSCRIPTION]"
18+
19+
# Start execution
20+
try {
21+
22+
# Creates an application role of given name and description
23+
24+
Function CreateAppRole([string] $Name, [string] $Description)
25+
{
26+
$appRole = New-Object Microsoft.Open.AzureAD.Model.AppRole
27+
$appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string]
28+
$appRole.AllowedMemberTypes.Add("Application");
29+
$appRole.AllowedMemberTypes.Add("User");
30+
$appRole.DisplayName = $Name
31+
$appRole.Id = New-Guid
32+
$appRole.IsEnabled = $true
33+
$appRole.Description = $Description
34+
$appRole.Value = $Name;
35+
36+
return $appRole
37+
}
38+
39+
# Creates Azure Event Grid Azure AD Application if not exists
40+
41+
$eventGridAppId = "4962773b-9cdb-44cf-a8bf-237846a00ab7" # You don't need to modify this id
42+
$eventGridRoleName = "AzureEventGridSecureWebhookSubscriber" # You don't need to modify this role name
43+
$eventGridSP = Get-AzureADServicePrincipal -Filter ("appId eq '" + $eventGridAppId + "'")
44+
if ($eventGridSP -match "Microsoft.EventGrid")
45+
{
46+
Write-Host "The Azure AD Application is already defined.`n"
47+
} else {
48+
Write-Host "Creating the Azure Event Grid Azure AD Application"
49+
$eventGridSP = New-AzureADServicePrincipal -AppId $eventGridAppId
50+
}
51+
52+
# Creates the Azure app role for the webhook Azure AD application
53+
54+
$app = Get-AzureADApplication -ObjectId $webhookAppObjectId
55+
$appRoles = $app.AppRoles
56+
57+
Write-Host "Azure AD App roles before addition of the new role..."
58+
Write-Host $appRoles
59+
60+
if ($appRoles -match $eventGridRoleName)
61+
{
62+
Write-Host "The Azure Event Grid role is already defined.`n"
63+
} else {
64+
Write-Host "Creating the Azure Event Grid role in Azure AD Application: " $webhookAppObjectId
65+
$newRole = CreateAppRole -Name $eventGridRoleName -Description "Azure Event Grid Role"
66+
$appRoles.Add($newRole)
67+
Set-AzureADApplication -ObjectId $app.ObjectId -AppRoles $appRoles
68+
}
69+
70+
Write-Host "Azure AD App roles after addition of the new role..."
71+
Write-Host $appRoles
72+
73+
# Creates the user role assignment for the user who will create event subscription
74+
75+
$servicePrincipal = Get-AzureADServicePrincipal -Filter ("appId eq '" + $app.AppId + "'")
76+
77+
try
78+
{
79+
Write-Host "Creating the Azure Ad App Role assignment for user: " $eventSubscriptionWriterUserPrincipalName
80+
$eventSubscriptionWriterUser = Get-AzureAdUser -ObjectId $eventSubscriptionWriterUserPrincipalName
81+
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
82+
New-AzureADUserAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventSubscriptionWriterUser.ObjectId -PrincipalId $eventSubscriptionWriterUser.ObjectId
83+
}
84+
catch
85+
{
86+
if( $_.Exception.Message -like '*Permission being assigned already exists on the object*')
87+
{
88+
Write-Host "The Azure AD User Application role is already defined.`n"
89+
}
90+
else
91+
{
92+
Write-Error $_.Exception.Message
93+
}
94+
Break
95+
}
96+
97+
# Creates the service app role assignment for Event Grid Azure AD Application
98+
99+
$eventGridAppRole = $app.AppRoles | Where-Object -Property "DisplayName" -eq -Value $eventGridRoleName
100+
New-AzureADServiceAppRoleAssignment -Id $eventGridAppRole.Id -ResourceId $servicePrincipal.ObjectId -ObjectId $eventGridSP.ObjectId -PrincipalId $eventGridSP.ObjectId
101+
102+
# Print output references for backup
103+
104+
Write-Host ">> Webhook's Azure AD Application Id: $($app.AppId)"
105+
Write-Host ">> Webhook's Azure AD Application ObjectId Id: $($app.ObjectId)"
106+
}
107+
catch {
108+
Write-Host ">> Exception:"
109+
Write-Host $_
110+
Write-Host ">> StackTrace:"
111+
Write-Host $_.ScriptStackTrace
112+
}
113+
```
14114

15115
## Script explanation
16116

0 commit comments

Comments
 (0)