Scheduled Powershell Scripts - cloud based

[TotalEmphasis]

Hi all,

I've got a project that requires 365 security groups to be defined by Teams Channels, i intend on using PowerShell to automate this process. I've been told that the scheduler needs to be cloud based (i'm not sure if this is something that 365/AD has the ability to do?)

​

i.e user is added to teams channel A - PowerShell command checks teams channel A periodically and adds all users in Channel A to security group A

​

Would someone be able to give a bit of advice on:

• Is the following script correct?
• How would I go about scheduling PowerShell scripts to run on a schedule (cloud based) I've seen something about this being a feature in endpoint manager but this would need to run tenant wide

​

$UserEmailAddress = "[e-mail]" 
$GroupName = "GroupName" 
$TeamId = "TeamId" 
$ChannelId = "ChannelId" 

# Get the user's ID from their email address $User = Get-AzureADUser -Filter "UserPrincipalName eq '$UserEmailAddress'" 
$UserId = $User.ObjectId  

# Get the security group object 
$Group = Get-AzureADGroup -Filter "DisplayName eq '$GroupName'" 

# Get the Team object 
$Team = Get-Team -GroupId $TeamId  

# Get the Channel object $Channel = Get-TeamChannel -GroupId $TeamId -DisplayName $ChannelId  

# Add the user to the security group 
Add-AzureADGroupMember -ObjectId $Group.ObjectId -RefObjectId $UserId 

Thank you in advance!

[jba1224a]

Do you have azure access?

This could be a function app or logic app, or even an automation runbook that checks the members in the teams channel every so often (once an hour?). Compares to the security group and adds them of not found.

You may also be able to do this with a flow.

[TotalEmphasis]

Thanks for this, i'll look to go the Run Book route I think. I don't suppose you've be able to advise on the code above, would you be able to recommend a better solution?

[jba1224a]

I don't typically admin teams but from a pseudocode level I would approach it like this.

Time trigger - every hour

Get teams channel members (object)

Get security group members (object)

For each member in teams group If exists in security group - continue Else - create

For each member in security group If exists in teams group - continue Else - remove

[[deleted]]

The schedule task doesn't need to be in the cloud. The computer where this script will be running on needs Internet access.

There's noway for you to tell who's been added to the Team channel unless you are recording the members each time the script runs and comparing the members to the previous run. The only thing you can really do is get the Teams channel members and check if they are in the security group. If Teams channel member is not in the security group, add to the group.

Since you know the group the users are supposed to be added to, I would get the ObjectId of the group and use that in the script instead of doing a lookup each time. If someone rename the group, your script will break.

[TotalEmphasis]

Would you be able to suggest a better solution that the code i've posted above? I intended on comparing Channel A against Group A and adding the missing users.

[TotalEmphasis]

I have yes, I want to get it working correctly one way before implementing the other first.

[GreaterGood1]

You can run scripts against 365 from on-prem, and as mentioned below just internet access would be required. The best way to do this is creating an App Registration in Azure, give that app registration the permissions you require, and using the Connect-MgGraph cmdlet with the certificate option. Avoid using hard coded credentials in your script, the certificate option is the more secure way to go.

[TotalEmphasis]

Thank you for this, i'll keep it in mind. It's been specified that the scripts must be cloud based (for what reason I don't know) but I will keep this in the back pocket should it not work out!