-
Notifications
You must be signed in to change notification settings - Fork 89
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add functionality to run non interactive
- Loading branch information
Showing
6 changed files
with
246 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
98 changes: 98 additions & 0 deletions
98
PSModule/IntuneDocumentation/Functions/New-IntuneDocumentationAppRegistration.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| Function New-IntuneDocumentationAppRegistration(){ | ||
| <# | ||
| .DESCRIPTION | ||
| This script will create an App registration(WPNinjas.eu Automatic Documentation) in Azure AD. Global Admin privileges are required during execution of this function. Afterwards the created clint secret can be used to execute the Intunde Documentation silently. | ||
| .EXAMPLE | ||
| $p = New-IntuneDocumentationAppRegistration | ||
| $p | fl | ||
| ClientID : d5cf6364-82f7-4024-9ac1-73a9fd2a6ec3 | ||
| ClientSecret : S03AESdMlhLQIPYYw/cYtLkGkQS0H49jXh02AS6Ek0U= | ||
| ClientSecretExpiration : 21.07.2025 21:39:02 | ||
| TenantId : d873f16a-73a2-4ccf-9d36-67b8243ab99a | ||
| .NOTES | ||
| Author: Thomas Kurth/baseVISION | ||
| Date: 21.7.2020 | ||
| History | ||
| See Release Notes in Github. | ||
| #> | ||
| [CmdletBinding(SupportsShouldProcess, ConfirmImpact='Medium')] | ||
| Param( | ||
| ) | ||
| ## Manual Variable Definition | ||
| ######################################################## | ||
| #$DebugPreference = "Continue" | ||
| $ScriptName = "DocumentIntuneAppRegistration" | ||
|
|
||
|
|
||
| #region Initialization | ||
| ######################################################## | ||
| Write-Log "Start Script $Scriptname" | ||
|
|
||
| $AzureAD = Get-Module -Name AzureAD | ||
| if($AzureAD){ | ||
| Write-Verbose -Message "AzureAD module is loaded." | ||
| } else { | ||
| Write-Warning -Message "AzureAD module is not loaded, please install by 'Install-Module AzureAD'." | ||
| } | ||
|
|
||
| #region Authentication | ||
| Connect-AzureAD | ||
| #endregion | ||
| #region Main Script | ||
| ######################################################## | ||
|
|
||
| $displayName = "WPNinjas.eu Automatic Documentation" | ||
|
|
||
| if (!(Get-AzureADApplication -SearchString $displayName)) { | ||
| $app = New-AzureADApplication -DisplayName $displayName ` | ||
| -Homepage "https://localhost" ` | ||
| -ReplyUrls "urn:ietf:wg:oauth:2.0:oob" ` | ||
| -PublicClient $true | ||
|
|
||
|
|
||
| # create SPN for App Registration | ||
| Write-Debug ('Creating SPN for App Registration {0}' -f $displayName) | ||
|
|
||
| # create a password (spn key) | ||
| $startDate = Get-Date | ||
| $endDate = $startDate.AddYears(5) | ||
| $appPwd = New-AzureADApplicationPasswordCredential -ObjectId $app.ObjectId -CustomKeyIdentifier "Primary" -StartDate $startDate -EndDate $endDate | ||
|
|
||
| # create a service principal for your application | ||
| # you need this to be able to grant your application the required permission | ||
| $spForApp = New-AzureADServicePrincipal -AppId $app.AppId -PasswordCredentials @($appPwd) | ||
| } else { | ||
| Write-Output -InputObject ('App Registration {0} already exists' -f $displayName) | ||
| $app = Get-AzureADApplication -SearchString $displayName | ||
| } | ||
|
|
||
| $appPermissionsRequired = @('Policy.Read.All', | ||
| 'Directory.Read.All', | ||
| 'DeviceManagementServiceConfig.Read.All', | ||
| 'DeviceManagementRBAC.Read.All', | ||
| 'DeviceManagementManagedDevices.Read.All', | ||
| 'DeviceManagementConfiguration.Read.All', | ||
| 'DeviceManagementApps.Read.All', | ||
| 'Device.Read.All') | ||
| $targetServicePrincipalName = 'Microsoft Graph' | ||
| Set-AzureADAppPermission -targetServicePrincipalName $targetServicePrincipalName -appPermissionsRequired $appPermissionsRequired -childApp $app -spForApp $spForApp | ||
|
|
||
|
|
||
| #endregion | ||
| #region Finishing | ||
| ######################################################## | ||
| [PSCustomObject]@{ | ||
| ClientID = $app.AppId | ||
| ClientSecret = $appPwd.Value | ||
| ClientSecretExpiration = $appPwd.EndDate | ||
| TenantId = (Get-AzureADCurrentSessionInfo).TenantId | ||
| } | ||
|
|
||
| Write-Log "End Script $Scriptname" | ||
| #endregion | ||
| } |
43 changes: 43 additions & 0 deletions
43
PSModule/IntuneDocumentation/Internal/Set-AzureADAppPermission.ps1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| Function Set-AzureADAppPermission | ||
| { | ||
| [CmdletBinding(SupportsShouldProcess, ConfirmImpact='Medium')] | ||
| param | ||
| ( | ||
| [string] $targetServicePrincipalName, | ||
| $appPermissionsRequired, | ||
| $childApp, | ||
| $spForApp | ||
| ) | ||
|
|
||
| $targetSp = Get-AzureADServicePrincipal -Filter "DisplayName eq '$($targetServicePrincipalName)'" | ||
|
|
||
| # Iterate Permissions array | ||
| Write-Output -InputObject ('Retrieve Role Assignments objects') | ||
| $RoleAssignments = @() | ||
| Foreach ($AppPermission in $appPermissionsRequired) { | ||
| $RoleAssignment = $targetSp.AppRoles | Where-Object { $_.Value -eq $AppPermission} | ||
| $RoleAssignments += $RoleAssignment | ||
| } | ||
|
|
||
| $ResourceAccessObjects = New-Object 'System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.ResourceAccess]' | ||
| foreach ($RoleAssignment in $RoleAssignments) { | ||
| $resourceAccess = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" | ||
| $resourceAccess.Id = $RoleAssignment.Id | ||
| $resourceAccess.Type = 'Role' | ||
| $ResourceAccessObjects.Add($resourceAccess) | ||
| } | ||
| $requiredResourceAccess = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess" | ||
| $requiredResourceAccess.ResourceAppId = $targetSp.AppId | ||
| $requiredResourceAccess.ResourceAccess = $ResourceAccessObjects | ||
|
|
||
| # set the required resource access | ||
| Set-AzureADApplication -ObjectId $childApp.ObjectId -RequiredResourceAccess $requiredResourceAccess | ||
| Start-Sleep -s 1 | ||
|
|
||
| # grant the required resource access | ||
| foreach ($RoleAssignment in $RoleAssignments) { | ||
| Write-Output -InputObject ('Granting admin consent for App Role: {0}' -f $($RoleAssignment.Value)) | ||
| New-AzureADServiceAppRoleAssignment -ObjectId $spForApp.ObjectId -Id $RoleAssignment.Id -PrincipalId $spForApp.ObjectId -ResourceId $targetSp.ObjectId | ||
| Start-Sleep -s 1 | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters