Search for a command to run...
I work as System Administrator for more than 15 years now and I love to make my life easier by automating work & personal stuff via PowerShell (even silly things like food recipes list generation).
No comments yet. Be the first to comment.
Or any other Azure service requiring special authentication strength
If you are using Azure Local (HCI), you might find the following PowerShell script AzureLocalVMImageUpdater.ps1 useful. What is it good for? The code replaces the Windows VM images in the specified Azure Local cluster(s) with the latest compatible ve...
Problem It happens that the hardware hash of your Autopilot device gets changed. Thanks to the replacement of the motherboard or some other issue. This can lead to future problems when your users need to reinstall the operating system, but the Autopi...
Learn how to use undocumented Azure APIs for massive performance gains
Keeping a secure, version-controlled backup of your Intune-managed device data, including BitLocker, LAPS, and FileVault keys, is a best practice for any modern IT team. In this post, I’ll guide you through an Azure DevOps pipeline that automates the...
If you are an Azure administrator you are probably aware that it can be pretty dangerous to let users give permissions consent to any Azure application that is in the wild. Because it can lead to illicit consent grant attack which seems to be more and more popular among the hackers.
One of the solutions to this problem is to require admin consent. If you enable this feature, whenever a user wants to grant consent to not yet allowed application, admins will be notified to allow/deny such request via email.
This is OK, but if you are using JIRA as your support ticket solution, wouldn't it be nice to also automatically create Jira ticket? 😉
Such Jira ticket can contain information like:
And the result can look like 👇
How to create a Jira ticket isn't part of this article, but can be found at how-to-create-a-jira-ticket-using-powershell.
To be able to work with Azure non-interactively, we need to create a service principal account that will be used in our PowerShell script to gather all data we need.
IT_Azure_Consent_Read in my case)
Store this secret password at the safe place for later use!If you want to use certificate to authentication, you can use function
Add-AzureADAppCertificatewhich is part of the AzureADStuff module. It can be used likeAdd-AzureADAppCertificate -appObjectId <IT_Azure_Consent_ReadAppObjectId> -password (Read-Host -AsSecureString)
To get all admin consent requests use Get-AzureADAppConsentRequest PowerShell function 😉 which is part of my module AzureADStuff.
The function uses these URLs to get the required data:
https://graph.microsoft.com/beta/identityGovernance/appConsent/appConsentRequestsfor reading admin consent requestshttps://graph.microsoft.com/beta/servicePrincipals?$select=appId,verifiedPublisherfor reading application publisher data
The result of the Get-AzureADAppConsentRequest can look like this 👇
To summarize it a little bit, we have:
IT_Azure_Consent_Read) with appropriate permissions to get admin consent requests from the Azure and know its secret, to be able to authenticate andGet-AzureADAppConsentRequest function to actually get the admin consent requests data.Now we need to put it together and create a PowerShell script that
And the result can look like this AzureAD_admin_consent_requests_Jira_ticket_creation.ps1
AzureAD_admin_consent_requests_Jira_ticket_creation.ps1script is just a template. To make it work, you have to check and fix lines that starts withFIXME. Therefore export Jira and Azure app credentials, defined App Id etc.
Feel free to write comment in case of any problems. 👍