Skip to content

Commit ae87fa0

Browse files
sethmanheimsethmanheim
authored
Merge pull request #16954 from sethmanheim/new-hubki2-5
Hub: add Graph API retirement script and article
2 parents 228d8ac + dec80cd commit ae87fa0

File tree

4 files changed

+139
-1
lines changed

4 files changed

+139
-1
lines changed

‎azure-stack/operator/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@
88
items:
99
- name: Security updates
1010
href: release-notes-security-updates.md
11+
- name: Microsoft Entra ID Graph API retirement
12+
href: graph-api-retirement.md
1113
- name: Release notes
1214
href: release-notes.md
1315
- name: Hotfixes

‎azure-stack/operator/graph-api-retirement.md

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
---
2+
title: Entra ID Graph API retirement
3+
description: Learn how to mitigate the retirement of the Entra ID Graph API.
4+
author: sethmanheim
5+
ms.author: sethm
6+
ms.topic: conceptual
7+
ms.date: 02/05/2025
8+
ms.reviewer: rtiberiu
9+
10+
---
11+
12+
# Microsoft Entra ID Graph API retirement
13+
14+
The Microsoft Entra ID (formerly Azure Active Directory or Azure AD) [Graph API service is being retired](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/important-update-azure-ad-graph-api-retirement/4090534). This retirement is part of a broader effort to streamline the Microsoft Entra ID platform and improve the Microsoft Entra ID developer experience.
15+
16+
## Mitigation steps
17+
18+
The Graph API retirement affects all Azure Stack Hub customers, and requires you to run the script included in this article for all impacted applications. If you have applications that need continued access to the Graph APIs, the script sets a flag that configures these applications for an extension that allows these specific applications to continue calling the legacy Graph API until June 2025.
19+
20+
The PowerShell script provided in this article sets a flag for each application to configure the Graph API extension for each Entra ID identity provider of Azure Stack Hub.
21+
22+
To ensure that your Azure Stack Hub environments that use Entra ID as an identity provider continue functioning, you should run this script by the end of February 2025.
23+
24+
> [!NOTE]
25+
> If you delay adding this flag beyond February 2025, authentication will fail. You can then run this script to ensure your Azure Stack Hub functions as needed.
26+
27+
## Run the script
28+
29+
Run the following PowerShell script in your Entra ID environment that is used by Azure Stack Hub as the "home directory" (the main identity provider of your Azure Stack Hub). The script interacts with Azure, so you don't need to run it on a specific machine. However, you need at least "application administrator" privileges in the respective Entra ID tenant to run the script.
30+
31+
Make sure to run the following script with administrator privileges on the local machine:
32+
33+
```powershell
34+
# Install the graph modules if necessary
35+
#Install-Module Microsoft.Graph.Authentication
36+
#Install-Module Microsoft.Graph.Applications
37+
38+
$ErrorActionPreference='Stop'
39+
Import-Module Microsoft.Graph.Authentication
40+
Import-Module Microsoft.Graph.Applications
41+
42+
# Repeat this flow for each of your target directory tenants
43+
$tenantId = 'MyTenantId'
44+
45+
# Sign-in with admin permissions to read and write all application objects
46+
Connect-MgGraph -TenantId $tenantId -Scopes Application.ReadWrite.All
47+
48+
# Retrieve all applications in the current directory
49+
Write-Host "Looking-up all applications in directory '$tenantId'..."
50+
$applications = Get-MgApplication -All -Property id, displayName, appId, identifierUris, requiredResourceAccess, authenticationBehaviors
51+
Write-Host "Found '$($applications.Count)' total applications in directory '$tenantId'"
52+
53+
# Find all the unique deployment guids, each one representing an Azure Stack deployment in the current directory
54+
$deploymentGuids = $applications.IdentifierUris |
55+
Where-Object { $_ -like 'https://management.*' -or $_ -like 'https://adminmanagement.*' } |
56+
ForEach-Object { "$_".Split('/')[3] } |
57+
Select-Object -Unique
58+
Write-Host "Found '$($deploymentGuids.Count)' total Azure Stack deployments in directory '$tenantId'"
59+
60+
# Find all the Azure Stack application objects for each deployment
61+
$azureStackApplications = @()
62+
foreach ($application in $applications)
63+
{
64+
foreach ($deploymentGuid in $deploymentGuids)
65+
{
66+
if (($application.IdentifierUris -join '') -like "*$deploymentGuid*")
67+
{
68+
$azureStackApplications += $application
69+
}
70+
}
71+
}
72+
73+
# Find which Azure Stack applications require access to Legacy Graph Service
74+
$azureStackLegacyGraphApplications = $azureStackApplications |
75+
Where-Object { $_.RequiredResourceAccess.ResourceAppId -contains '00000002-0000-0000-c000-000000000000' }
76+
77+
# Find which of those applications need to have their authentication behaviors patched to allow access to Legacy Graph
78+
$azureStackLegacyGraphApplicationsToUpdate = $azureStackLegacyGraphApplications |
79+
Where-Object { -not ($ab = $_.AdditionalProperties.authenticationBehaviors) -or -not $ab.ContainsKey(($key='blockAzureADGraphAccess')) -or $ab[$key] }
80+
81+
# Update the applications which require their authentication behaviors patched to allow access to Legacy Graph
82+
Write-Host "Found '$($azureStackLegacyGraphApplicationsToUpdate.Count)' total Azure Stack applications which need permission to continue calling Legacy Microsoft Graph Service"
83+
$count = 0
84+
foreach ($application in $azureStackLegacyGraphApplicationsToUpdate)
85+
{
86+
$count++
87+
Write-Host "$count/$($azureStackLegacyGraphApplicationsToUpdate.Count) - Updating application '$($application.DisplayName)' (appId=$($application.AppId)) (id=$($application.Id))"
88+
Update-MgApplication -ApplicationId $application.Id -BodyParameter @{
89+
authenticationBehaviors = @{ blockAzureADGraphAccess = $false }
90+
}
91+
}
92+
```
93+
94+
The script displays the following sample output:
95+
96+
```output
97+
Looking-up all applications in directory '<ID>'...
98+
Found '###' total applications in directory '<ID>'
99+
Found '1' total Azure Stack deployments in directory '<app ID>'
100+
Found '16' total Azure Stack applications which need permission to continue calling Legacy Microsoft Graph Service
101+
1/16 - Updating application 'Azure Stack - AKS' (appId=<app ID>) (id=<ID>)
102+
2/16 - Updating application 'Azure Stack - Hubs' (appId=<app ID>) (id=<ID>)
103+
3/16 - Updating application 'Azure Stack - Portal Administration' (appId=<app ID>) (id=<app>)
104+
4/16 - Updating application 'Azure Stack - RBAC Administration' (appId=<app ID>) (id=ID)
105+
5/16 - Updating application 'Azure Stack - Container Registry' (appId=<app ID>) (id=ID)
106+
6/16 - Updating application 'Azure Stack - RBAC' (appId=<app ID>) (id=ID)
107+
7/16 - Updating application 'Azure Stack - Hubs Administration' (appId=<app ID>) (id=ID)
108+
8/16 - Updating application 'Azure Stack - Deployment Provider' (appId=<app ID>) (id=ID)
109+
9/16 - Updating application 'Azure Stack - Deployment' (appId=<app ID>) (id=ID)
110+
10/16 - Updating application 'Azure Stack - KeyVault' (appId=<app ID>) (id=ID)
111+
11/16 - Updating application 'Azure Stack' (appId=<app ID>) (id=ID)
112+
12/16 - Updating application 'Azure Stack - Administration' (appId=<app ID>) (id=ID)
113+
13/16 - Updating application 'Azure Stack - Policy Administration' (appId=<app ID>) (id=ID)
114+
14/16 - Updating application 'Azure Stack - Policy' (appId=<app ID>) (id=ID)
115+
15/16 - Updating application 'Azure Stack - Portal' (appId=<app ID>) (id=ID)
116+
16/16 - Updating application 'Azure Stack - KeyVault Administration ' (appId=<app ID>) (id=ID)
117+
```
118+
119+
Run the script a second time to verify that all applications were updated. The script should return the following output if all applications were successfully updated:
120+
121+
```output
122+
Looking-up all applications in directory '<ID>'...
123+
Found '####' total applications in directory '<ID>>'
124+
Found '1' total Azure Stack deployments in directory '<ID>>'
125+
Found '0' total Azure Stack applications which need permission to continue calling Legacy Microsoft Graph Service
126+
```
127+
128+
## Next steps
129+
130+
[Azure Stack Hub release notes](release-notes.md)

‎azure-stack/operator/known-issues.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ To access known issues for a different version, use the version selector dropdow
2929
> If your Azure Stack Hub instance is behind by more than two updates, it's considered out of compliance. You must [update to at least the minimum supported version to receive support](azure-stack-servicing-policy.md#keep-your-system-under-support).
3030
::: moniker-end
3131

32+
> [!IMPORTANT]
33+
> The Microsoft Entra ID Graph API service is being retired. This retirement affects all Azure Stack Hub customers, and requires you to [run the script included in this article](graph-api-retirement.md) for all affected applications.
34+
3235
<!---------------------------------------------------------->
3336
<!------------------- SUPPORTED VERSIONS ------------------->
3437
<!---------------------------------------------------------->

‎azure-stack/operator/release-notes.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Azure Stack Hub release notes
33
description: Release notes for Azure Stack Hub integrated systems, including updates and bug fixes.
44
author: sethmanheim
55
ms.topic: article
6-
ms.date: 12/13/2024
6+
ms.date: 02/05/2025
77
ms.author: sethm
88
ms.reviewer: rtiberiu
99
ms.lastreviewed: 04/22/2024
@@ -34,6 +34,9 @@ To access release notes for a different version, use the version selector dropdo
3434
> If your Azure Stack Hub instance is behind by more than two updates, it's considered out of compliance. You must [update to at least the minimum supported version to receive support](azure-stack-servicing-policy.md#keep-your-system-under-support).
3535
::: moniker-end
3636

37+
> [!IMPORTANT]
38+
> The Microsoft Entra ID Graph API service is being retired. This retirement affects all Azure Stack Hub customers, and requires you to [run the script included in this article](graph-api-retirement.md) for all affected applications.
39+
3740
> [!IMPORTANT]
3841
> If your Azure Stack Hub instance does not have an active support contract with the hardware partner, it's considered out of compliance. You must [have an active support contract for the hardware to receive support](azure-stack-servicing-policy.md#keep-your-system-under-support).
3942

0 commit comments

Comments
 (0)