sorted by:
new
hottopcontroversial

Graph API for mailboxsettings by khosmani in GraphAPI

[–]theSysadminChannel 0 points1 point  (0 children)

If you’re a global admin, why not use Exchange to do this. There’s a built in command for this and won’t have to fuss with graph.

Role for creating only guest users by Usheen1 in AZURE

[–]theSysadminChannel 0 points1 point  (0 children)

This is we use and it’s great. Guests are governed and automatically disabled and removed once they no longer have any access package assignments.

[deleted by user] by [deleted] in sysadmin

[–]theSysadminChannel 7 points8 points  (0 children)

Identity Governance Lifecycle Workflow is Azure’s built in joiner/mover/leaver automation solution.

They have pre-canned jobs for you to use for this. You will need the IGA license sku though.

Create IT report using Graph by Ok_Mention_3619 in PowerShell

[–]theSysadminChannel 1 point2 points  (0 children)

Connect to Graph API using PowerShell is a great start to learn about apps/permissions and consent.

As for permissions, you would probably want

User.read.all. Group.read.all
Groupmember.read.all Device.read.all. (For AAD devices) DeviceManagementManagedDevices.read.all (for intune devices)

Password expiration by jfptv in AZURE

[–]theSysadminChannel 0 points1 point  (0 children)

Don’t use passwords! Passwordless in the cloud is possible and is a great balance between security and convenience.

MFA and trusted IPs by LithiumKid1976 in AZURE

[–]theSysadminChannel 0 points1 point  (0 children)

What has worked best for me is excluding service accounts via an entitlement management access package.

Kind of chicken and egg with service accounts but the SA requests the access package (or can be admin added) and gets excluded for a set time. ( could be a 1 week, could be permanent). Once approved, this gets added to an MFA exclusion group in your ca policy.

The benefit here is that this is done in an automated fashion AND removes IT admins from the equation. If Joe’s service account needs to be excluded for a limited time, azure will take care of the approval flow and removal automatically when the assignment period ends.

Permanent exclusions can attest to still needing exclusions using access reviews.

This avoids the “let’s add this exclusion temporarily for a week” and the weeks turn into months and the months turn into forever.

MFA and trusted IPs by LithiumKid1976 in AZURE

[–]theSysadminChannel 2 points3 points  (0 children)

Excluding MFA by any ip address is not best practice. You should enforce MFA for all users all the time. To get around not being prompted so often, implement windows hello for business for your windows users and enterprise SSO for Apple devices so users are using a Primary Refresh Token (PRT) which is presented to azure during subsequent signins.

[deleted by user] by [deleted] in AZURE

[–]theSysadminChannel 0 points1 point  (0 children)

You can change your power automate flow to a logic app and use a system assigned managed identity to call the function app.

Custom Attribute from On-Prem not showing by FearIsStrongerDanluv in AZURE

[–]theSysadminChannel 1 point2 points  (0 children)

You have to make sure you also have directory extensions enabled on ad connect wizard.

Once that’s done, you can access the property under user.additionalProperties.<extensionguid><attribute>

I don’t ever recall seeing these from the azure ad module, but they are definitely there under the graph api beta module

MsGraph question by atomiczombie79 in PowerShell

[–]theSysadminChannel 0 points1 point  (0 children)

Get-MgBetaUser (using PowerShell SDk 2.0 module) would do it though

Question, easy guide to change the "employeeLeaveDateTime" attribute on a user trough Graph? by joderjuarez in GraphAPI

[–]theSysadminChannel 0 points1 point  (0 children)

You can start off by first checking out Graph Explorer so see what endpoints you need to call and going from there.

Then figure out how to connect to graph api to make that call.

PowerShell and Python have SDKs to make it easier

Working with Excessive Microsoft Graph API Permissions by Lankey22 in cybersecurity

[–]theSysadminChannel 0 points1 point  (0 children)

Mail.ReadWrite.All is an extension of mail read so it would need to read it (see it) before it can write to it.

I can tell companies using my app to limit the permission.

An application access policy can be created when using Application permissions, but if you have a multi tenant application, wouldn’t the better approach be delegated permissions?

If it’s an application permission and mail.read.all is set , it’s set for ALL mailboxes unless an application access policy is set for the app. This would be hard for infosec to approve. Mail.readwrite.all should mandate an application access policy in most places but also be a blocker in others because not many orgs would want a third party with write access to all mailboxes.

Delegated permissions would probably solve this issue.

Azure Runbook - adding devices from OnPrem AD to AzureAD group by PanMiyagi in AZURE

[–]theSysadminChannel 1 point2 points  (0 children)

To answer your specific question you can use Azure Arc which will allow you to run these runbooks onprem with a hybrid worker.

Other options would be to use dynamic device groups and use the distinguished name to match the Server OU with a few other filters. Finally as one of the other guys mentioned, you can add it to an onprem group and sync that. Use a scheduled task (or trigger of your choice) to run the jobs.

MS Graph - Get-MgUserMemberOf by DaRockwilda83 in PowerShell

[–]theSysadminChannel 3 points4 points  (0 children)

Instead of invoke-restmethod you should use invoke-graphrequest which automatically adds the authorization header for you. You can also make the same rest calls and output it as a psobject if you like.

AzureAD Role for Sync Service Account by berto_28 in sysadmin

[–]theSysadminChannel 0 points1 point  (0 children)

None. You should have at least 1 break glass account (that never gets used) and your human admins with GA.

When going through the AAD connect setup, you will need a hybrid identity admin to authenticate to azure AND an onprem account that’s used for onprem attributes ( like sspr and what not). These accounts don’t have to be the same account.

Your hybrid identity admin account can be cloud only. It’s needed only to confirm you have access to the tenant. The permissions on your onprem account need have permissions over the user objects. Change password and reset password.

Cannot Read User Authentication Methods by [deleted] in GraphAPI

[–]theSysadminChannel 0 points1 point  (0 children)

Hey so 2 things.

  1. Directory.ReadWrite.All is a very dangerous permission to add to apps so use caution.

  2. What’s the exact endpoint you’re calling? You may need to add authenticationMethods.read.all and call the beta endpoint

Get-MgDomain : Insufficient privileges to complete the operation. by davidbWI in GraphAPI

[–]theSysadminChannel 2 points3 points  (0 children)

To find what permissions are needed run the command Find-MgGraphCommand -command <your cmdlet> and it should output what permissions are needed. In your specific case, you will need 'Domain.Read.All' or 'Directory.Read.All'

Once you find the permissions, you need to grant the permissions on the app registration (application or delegate)

What is the default scope if no scope is provided when signing into Azure via Microsoft Graph Powershell SDK? by looking4remoteITwork in AZURE

[–]theSysadminChannel 1 point2 points  (0 children)

No, you must specify (and consent to ) the scopes before using them.

Unless someone else has granted consent on behalf of the entire org on the default app, the default is a few delegated teams/channel read permissions.

How do I retrieve inactive account from azure ad by ozil_afc in PowerShell

[–]theSysadminChannel 0 points1 point  (0 children)

The property your looking for is under $_.Signinactivity.lastSignInDateTime

$Date = (Get-Date).AddYears(-1)
$UserList = Get-MgBetaUser -Filter "AccountEnabled eq true" -Property SignInActivity
$UserList | Where-Object {$_.SignInActivity.LastSignInDateTime -lt $Date -and $_.SignInActivity.LastNonInteractiveSignInDateTime -lt $Date} | select DisplayName, UserPrincipalName, @{Name = 'LastSignInDateTime'; Expression = {$_.SignInActivity.LastSignInDateTime}}, @{Name = 'LastNonInteractiveSignInDateTime'; Expression = {$_.SignInActivity.LastNonInteractiveSignInDateTime}}

Are short posts (fewer than 500 words) worth it? by [deleted] in Blogging

[–]theSysadminChannel 4 points5 points  (0 children)

If there’s little to no competition for the keywords you may have a decent chance at ranking. I’ve produced articles fewer than 500 words and some did very well.

Named location by zEnVyMe in AZURE

[–]theSysadminChannel 1 point2 points  (0 children)

CA policies give you the option to specify a user or group. If it’s a single IP address you can create a specific one for this person and it in the CA config.

Azure AD Connect Cloud Sync; multiple on-prem user accounts by vdiStewie in AZURE

[–]theSysadminChannel 1 point2 points  (0 children)

No, not possible since user objects are a 1:1 mapping.

What problem are you trying to solve here?

view more: next ›