Skip to content

Commit fefe39c

Browse files
rwike77rwike77
committed
updated powershell script for microsoft graph powershell
1 parent 4011c73 commit fefe39c

File tree

3 files changed

+51
-42
lines changed

3 files changed

+51
-42
lines changed

‎articles/active-directory/develop/multi-service-web-app-access-microsoft-graph-as-app.md

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ manager: CelesteDG
88
ms.service: app-service
99
ms.topic: tutorial
1010
ms.workload: identity
11-
ms.date: 08/19/2022
11+
ms.date: 04/05/2023
1212
ms.author: ryanwi
1313
ms.reviewer: stsoneff
1414
ms.devlang: csharp, javascript
@@ -54,32 +54,38 @@ When accessing the Microsoft Graph, the managed identity needs to have proper pe
5454
# [PowerShell](#tab/azure-powershell)
5555

5656
```powershell
57-
# Install the module. (You need admin on the machine.)
58-
# Install-Module AzureAD.
57+
# Install the module.
58+
# Install-Module Microsoft.Graph -Scope CurrentUser
5959
60-
# Your tenant ID (in the Azure portal, under Azure Active Directory > Overview).
61-
$TenantID="<tenant-id>"
62-
$resourceGroup = "securewebappresourcegroup"
63-
$webAppName="SecureWebApp-20201102125811"
60+
# The tenant ID
61+
$TenantId = "11111111-1111-1111-1111-111111111111"
6462
65-
# Get the ID of the managed identity for the web app.
66-
$spID = (Get-AzWebApp -ResourceGroupName $resourceGroup -Name $webAppName).identity.principalid
63+
# The name of your web app, which has a managed identity.
64+
$webAppName = "SecureWebApp-20201106120003"
65+
$resourceGroupName = "SecureWebApp-20201106120003ResourceGroup"
6766
68-
# Check the Microsoft Graph documentation for the permission you need for the operation.
69-
$PermissionName = "User.Read.All"
67+
# The name of the app role that the managed identity should be assigned to.
68+
$appRoleName = "User.Read.All"
7069
71-
Connect-AzureAD -TenantId $TenantID
70+
# Get the web app's managed identity's object ID.
71+
Connect-AzAccount -Tenant $TenantId
72+
$managedIdentityObjectId = (Get-AzWebApp -ResourceGroupName $resourceGroupName -Name $webAppName).identity.principalid
7273
73-
# Get the service principal for Microsoft Graph.
74-
# First result should be AppId 00000003-0000-0000-c000-000000000000
75-
$GraphServicePrincipal = Get-AzureADServicePrincipal -SearchString "Microsoft Graph" | Select-Object -first 1
74+
Connect-MgGraph -TenantId $TenantId -Scopes 'Application.Read.All','AppRoleAssignment.ReadWrite.All'
7675
77-
# Assign permissions to the managed identity service principal.
78-
$AppRole = $GraphServicePrincipal.AppRoles | `
79-
Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains "Application"}
76+
# Get Microsoft Graph app's service principal and app role.
77+
$serverApplicationName = "Microsoft Graph"
78+
$serverServicePrincipal = (Get-MgServicePrincipal -Filter "DisplayName eq '$serverApplicationName'")
79+
$serverServicePrincipalObjectId = $serverServicePrincipal.Id
8080
81-
New-AzureAdServiceAppRoleAssignment -ObjectId $spID -PrincipalId $spID `
82-
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id
81+
$appRoleId = ($serverServicePrincipal.AppRoles | Where-Object {$_.Value -eq $appRoleName }).Id
82+
83+
# Assign the managed identity access to the app role.
84+
New-MgServicePrincipalAppRoleAssignment `
85+
-ServicePrincipalId $managedIdentityObjectId `
86+
-PrincipalId $managedIdentityObjectId `
87+
-ResourceId $serverServicePrincipalObjectId `
88+
-AppRoleId $appRoleId
8389
```
8490

8591
# [Azure CLI](#tab/azure-cli)

‎articles/app-service/includes/tutorial-microsoft-graph-as-app/introduction.md

Lines changed: 24 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -50,35 +50,38 @@ When accessing the Microsoft Graph, the managed identity needs to have proper pe
5050

5151
1. Run the following script to add the requested Microsoft Graph API permissions to the managed identity service principal object.
5252

53-
# [PowerShell](#tab/azure-powershell)
53+
# Install the module.
54+
# Install-Module Microsoft.Graph -Scope CurrentUser
5455

55-
```powershell
56-
# Install the module. (You need admin on the machine.)
57-
# Install-Module AzureAD.
56+
# The tenant ID
57+
$TenantId = "11111111-1111-1111-1111-111111111111"
5858

59-
# Your tenant ID (in the Azure portal, under Azure Active Directory > Overview).
60-
$TenantID="<tenant-id>"
61-
$resourceGroup = "securewebappresourcegroup"
62-
$webAppName="SecureWebApp-20201102125811"
59+
# The name of your web app, which has a managed identity.
60+
$webAppName = "SecureWebApp-20201106120003"
61+
$resourceGroupName = "SecureWebApp-20201106120003ResourceGroup"
6362

64-
# Get the ID of the managed identity for the web app.
65-
$spID = (Get-AzWebApp -ResourceGroupName $resourceGroup -Name $webAppName).identity.principalid
63+
# The name of the app role that the managed identity should be assigned to.
64+
$appRoleName = "User.Read.All"
6665

67-
# Check the Microsoft Graph documentation for the permission you need for the operation.
68-
$PermissionName = "User.Read.All"
66+
# Get the web app's managed identity's object ID.
67+
Connect-AzAccount -Tenant $TenantId
68+
$managedIdentityObjectId = (Get-AzWebApp -ResourceGroupName $resourceGroupName -Name $webAppName).identity.principalid
6969

70-
Connect-AzureAD -TenantId $TenantID
70+
Connect-MgGraph -TenantId $TenantId -Scopes 'Application.Read.All','AppRoleAssignment.ReadWrite.All'
7171

72-
# Get the service principal for Microsoft Graph.
73-
# First result should be AppId 00000003-0000-0000-c000-000000000000
74-
$GraphServicePrincipal = Get-AzureADServicePrincipal -SearchString "Microsoft Graph" | Select-Object -first 1
72+
# Get Microsoft Graph app's service principal and app role.
73+
$serverApplicationName = "Microsoft Graph"
74+
$serverServicePrincipal = (Get-MgServicePrincipal -Filter "DisplayName eq '$serverApplicationName'")
75+
$serverServicePrincipalObjectId = $serverServicePrincipal.Id
7576

76-
# Assign permissions to the managed identity service principal.
77-
$AppRole = $GraphServicePrincipal.AppRoles | `
78-
Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains "Application"}
77+
$appRoleId = ($serverServicePrincipal.AppRoles | Where-Object {$_.Value -eq $appRoleName }).Id
7978

80-
New-AzureAdServiceAppRoleAssignment -ObjectId $spID -PrincipalId $spID `
81-
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id
79+
# Assign the managed identity access to the app role.
80+
New-MgServicePrincipalAppRoleAssignment `
81+
-ServicePrincipalId $managedIdentityObjectId `
82+
-PrincipalId $managedIdentityObjectId `
83+
-ResourceId $serverServicePrincipalObjectId `
84+
-AppRoleId $appRoleId
8285
```
8386
8487
# [Azure CLI](#tab/azure-cli)

‎articles/app-service/scenario-secure-app-access-microsoft-graph-as-app.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ manager: CelesteDG
88
ms.service: app-service
99
ms.topic: tutorial
1010
ms.workload: identity
11-
ms.date: 03/14/2023
11+
ms.date: 04/05/2023
1212
ms.author: ryanwi
1313
ms.reviewer: stsoneff
1414
ms.devlang: csharp

0 commit comments

Comments
 (0)