Anuj Chaudhary: mfa

Showing posts with label mfa. Show all posts

Monday, April 6, 2026

Re-prompt for Multi-factor authentication on every Just-In-Time request using Privileged Identity Management

Microsoft Entra Privileged Identity Management now re‑prompts users for Multi‑Factor Authentication on every Just‑In‑Time activation request, even if they’ve already signed in with MFA.

See how we’re raising the bar for secure privileged access https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/groups-role-settings#on-activation-require-microsoft-entra-conditional-access-authentication-context

Friday, February 14, 2020

Connect to Azure AD PowerShell with MFA

Sometimes you might want to connect to Azure AD PowerShell with MFA but there is no way for the PowerShell to prompt you for MFA unless you have MFA enforced on the account.

The scenario which I had was calling a cmdlet for Privileged Identity Management where I was activating a role which requires MFA https://docs.microsoft.com/en-us/powershell/module/azuread/?view=azureadps-2.0-preview#privileged_role_management

The solution is to get an access token with MFA and pass the token while connecting to PowerShell.

The pre-requisite is that you have already installed Azure AD Preview PowerShell by following these steps https://docs.microsoft.com/en-us/powershell/azure/active-directory/install-adv2?view=azureadps-2.0

# Install msal.ps

if(!(Get-Module | Where-Object {$_.Name -eq 'PowerShellGet' -and $_.Version -ge '2.2.4.1'})) { Install-Module PowerShellGet -Force }

if(!(Get-Package msal.ps)) { Install-Package msal.ps }

# Get token for MS Graph by prompting for MFA

$MsResponse = Get-MSALToken -Scopes @("https://graph.microsoft.com/.default") -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -RedirectUri "urn:ietf:wg:oauth:2.0:oob" -Authority "https://login.microsoftonline.com/common" -Interactive -ExtraQueryParameters @{claims='{"access_token" : {"amr": { "values": ["mfa"] }}}'}

# Get token for AAD Graph

$AadResponse = Get-MSALToken -Scopes @("https://graph.windows.net/.default") -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -RedirectUri "urn:ietf:wg:oauth:2.0:oob" -Authority "https://login.microsoftonline.com/common"

Connect-AzureAD -AadAccessToken $AadResponse.AccessToken -MsAccessToken $MsResponse.AccessToken -AccountId: "upn" -tenantId: "tenantId"

# Call cmdlet which requires MFA

$resource = Get-AzureADMSPrivilegedResource -ProviderId AadRoles

$roleDefinition = Get-AzureADMSPrivilegedRoleDefinition -ProviderId AadRoles -ResourceId $resource.Id -Filter "DisplayName eq 'Global Administrator'"

$subject = Get-AzureADUser -Filter "userPrincipalName eq 'upn'"

$schedule = New-Object Microsoft.Open.MSGraph.Model.AzureADMSPrivilegedSchedule

$schedule.Type = "Once"

$schedule.Duration="PT1H"

$schedule.StartDateTime = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ")

Open-AzureADMSPrivilegedRoleAssignmentRequest -ProviderId AadRoles -Schedule $schedule -ResourceId $resource.Id -RoleDefinitionId $roleDefinition.Id -SubjectId $subject.ObjectId -AssignmentState "Active" -Type "UserAdd" -Reason "Test"

Friday, August 2, 2019

Handle Conditional Access challenge for Privileged Identity Management on Microsoft Graph

Privileged Identity Management (PIM) for Azure resources api’s are available on Microsoft Graph (MSGraph) so that developers can automate the PIM operations like activation, assignment, etc. To learn more, see http://www.anujchaudhary.com/2018/02/powershell-sample-for-privileged.html

Some organizations enable conditional policies like Multi factor authentication (MFA) for accessing any Azure resources. When users go to PIM through Azure Portal, they are prompted for MFA while logging into the Azure Portal. When they access the PIM UI, everything works since they have already performed MFA.

However, if the users are accessing PIM api’s for Azure resources through MSGraph, they might not be prompted for MFA on login since no conditional access policy might be enabled for MSGraph. When a PIM api is called, it fails with 400 Bad Request invalid_grant error since a conditional access policy is not met for Azure resources.

Example:

HTTP/1.1 400 Bad Request

{

"error": {

"code": "invalid_grant",

"message": "{\"Name\":\"MsalUiRequiredException\",\"Message\":\"AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '797f4846-ba00-4fd7-ba43-dac1f8f63013'.\\r\\nTrace ID: 7bdbe148-89e6-4493-a150-93dac7a06c00\\r\\nCorrelation ID: ff221ee5-ebb9-42d0-8f70-dbffde1b2104\\r\\nTimestamp: 2020-09-16 01:16:03Z\",\"Claims\":\"{\\\"access_token\\\":{\\\"capolids\\\":{\\\"essential\\\":true,\\\"values\\\":[\\\"051744ca-6abe-4095-b526-14a7f4033309\\\"]}}}\"}",

"innerError": {

"date": "2020-09-16T01:16:03",

"request-id": "82cd21d1-6413-4512-a2d1-fa1d0a3c5826",

"client-request-id": "82cd21d1-6413-4512-a2d1-fa1d0a3c5826"

}

To handle this, the user needs to catch the error, get the claims challenge and send in a login request with claims challenge as an extra query string parameter.

To learn more, see https://docs.microsoft.com/en-us/azure/active-directory/develop/conditional-access-dev-guide#scenario-app-performing-the-on-behalf-of-flow

Below is a PowerShell sample which showcases on how to handle the conditional access challenge when calling PIM api's on MSGraph. Just save this as a .ps1 file and run it with PowerShell.

Sceenshot

Source code

#Acquire AAD token

function AcquireToken($claims){

$clientID = "dabc52c4-106b-4179-9df2-2f791f44ba14"

$redirectUri = "https://pimmsgraph"

$authority = "https://login.microsoftonline.com/common"

if($claims -ne $null)

{

$authResult = Get-MSALToken -Scopes @("https://graph.microsoft.com/.default") -ClientId $ClientID -RedirectUri $redirectUri -Authority $authority -Interactive -ExtraQueryParameters @{claims=$claims}

Set-Variable -Name mfaDone -Value $true -Scope Global

}

else

{

$authResult = Get-MSALToken -Scopes @("https://graph.microsoft.com/.default") -ClientId $ClientID -RedirectUri $redirectUri -Authority $authority -Interactive

}

if($authResult -ne $null)

{

Write-Host "User logged in successfully ..." -ForegroundColor Green

}

Set-Variable -Name headerParams -Value @{'Authorization'="$($authResult.AccessTokenType) $($authResult.AccessToken)"} -Scope Global

Set-Variable -Name assigneeId -Value $authResult.UserInfo.UniqueId -Scope Global

}

#List resources

function ListResources(){

$url = $serviceRoot + "resources?`$filter=(type+eq+'subscription')"

Write-Host $url

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get

$resources = ConvertFrom-Json $response.Content

$i = 0

$obj = @()

foreach ($resource in $resources.value)

{

$item = New-Object psobject -Property @{

Id = ++$i

ResourceId = $resource.id

ResourceName = $resource.displayName

ResourceType = $resource.type

}

$obj = $obj + $item

}

return $obj

}

#Disaplay resources

function DisplayResources(){

$resources = ListResources

$resources | Format-Table -AutoSize -Wrap Id,ResourceName,ResourceType

}

############################################################################################################################################################################

$global:serviceRoot = "https://graph.microsoft.com/beta/privilegedAccess/azureResources/"

$global:MSGraphRoot = "https://graph.microsoft.com/v1.0/"

$global:headerParams = ""

$global:assigneeId = ""

$global:mfaDone = $false;

# Install msal.ps

if(!(Get-Module | Where-Object {$_.Name -eq 'PowerShellGet' -and $_.Version -ge '2.2.4.1'})) { Install-Module PowerShellGet -Force }

if(!(Get-Package msal.ps)) { Install-Package msal.ps }

$Authed = AcquireToken $global:clientID $global:redirectUri $global:resourceAppIdURI $global:authority $false

if ($Authed -eq $false)

{

return

}

try

{

DisplayResources

}

catch

{

$stream = $_.Exception.Response.GetResponseStream()

$stream.Position = 0;

$streamReader = New-Object System.IO.StreamReader($stream)

$err = $streamReader.ReadToEnd()

$streamReader.Close()

$stream.Close()

if($err.Contains("invalid_grant"))

{

$errorObject = ConvertFrom-Json $err

$message = ConvertFrom-Json $errorObject.error.message

$claims = $message.claims

Write-Host "Prompting the user again since since a conditional access policy is enabled..." -ForegroundColor Green

AcquireToken $claims

DisplayResources

}

else

{

Write-Host $err -ForegroundColor Red

}

Write-Host ""

Monday, February 26, 2018

Change Azure AD MFA option or phone number

Recently someone asked how can I change my Azure AD MFA option (like call/text/app) or how can I change my phone number.
The easiest way to do this is to go to https://account.activedirectory.windowsazure.com/Proofup.aspx where you will be able to update your MFA option or phone number.

Wednesday, February 7, 2018

PowerShell sample for Privileged Identity Management (PIM)

PIM for Azure Resources provides Just in Time (JIT) and Temporary access capabilities for Azure AD roles and Azure Resource roles. See more at https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

How cool would it be if I can use the MSGraph PIM api’s to build custom applications. For example, your IT Org has N different resource groups where you want to activate every day. It would be time consuming to activate them one by one. Instead, you can build a custom app using PowerShell or UI so that you can activate to all of these resource groups in one shot.

In this blog, I will share a sample to list all your eligible roles and activate or deactivate them. You will also be able to assign someone to a role.

I will share the full source code so you can customize it to suit your needs. Just save this as a .ps1 file and run it with PowerShell.

Screenshot

Setup

Create a native AAD application. See https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-integrating-applications
Grant it the following permissions to the application.
- Read and write privileged access to Azure AD - You will need it if you are going to use the app for PIM for Azure AD Roles
- Read and write privileged access to Azure resources - You will need it if you are going to use the app for PIM for Azure Resources
- Read directory data - You will need it if you are going to read users, etc. from directory like the assignment example in the below source code
- Note than these permissions require Admin consent so you will have to contact the tenant admin to grant these permissions. See https://docs.microsoft.com/en-us/azure/active-directory/application-dev-registration-config-grant-permissions-how-to
In the below code, update $clientID with your application id and $redirectUri with the redirect uri of the application.
For Azure resources, set $global:serviceRoot = "https://graph.microsoft.com/beta/privilegedAccess/azureResources/"
For Azure AD roles, set $global:serviceRoot = "https://graph.microsoft.com/beta/privilegedAccess/aadRoles/"

For Azure AD groups, set $global:serviceRoot = "https://graph.microsoft.com/beta/privilegedAccess/aadGroups/"

Source code

#Acquire AAD token

function AcquireToken($clientID, $redirectUri, $scopes, $authority, $mfa)

{

if($mfa)

{

$authResult = Get-MSALToken -Scopes $scopes -ClientId $clientID -RedirectUri $redirectUri -Authority $authority -Interactive -ExtraQueryParameters @{claims='{"access_token" : {"amr": { "values": ["mfa"] }}}'}

Set-Variable -Name mfaDone -Value $true -Scope Global

}

else

{

$authResult = Get-MSALToken -Scopes $scopes -ClientId $clientID -RedirectUri $redirectUri -Authority $authority -Interactive

}

if($authResult -ne $null)

{

Write-Host "User logged in successfully ..." -ForegroundColor Green

}

Set-Variable -Name headerParams -Value @{'Authorization'="$($authResult.AccessTokenType) $($authResult.AccessToken)"} -Scope Global

Set-Variable -Name assigneeId -Value $authResult.UserInfo.UniqueId -Scope Global

}

#Gets my jit assignments

function MyJitAssignments(){

$urlme = $global:MSGraphRoot + "me/"

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $urlme -Method Get

$me = ConvertFrom-Json $response.Content

$subjectId = $me.id

Write-Host $subjectId

$url = $serviceRoot + "roleAssignments?`$expand=linkedEligibleRoleAssignment,subject,roleDefinition(`$expand=resource)&`$filter=(assignmentState+eq+'Eligible')+and+(subjectId+eq+'" + $subjectId + "')"

Write-Host $url

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get

$assignments = ConvertFrom-Json $response.Content

Write-Host ""

Write-Host "Role assignments..." -ForegroundColor Green

$i = 0

$obj = @()

foreach ($assignment in $assignments.value)

{

$item = New-Object psobject -Property @{

id = ++$i

IdGuid = $assignment.id

ResourceId = $assignment.roleDefinition.resource.id

OriginalId = $assignment.roleDefinition.resource.externalId

ResourceName = $assignment.roleDefinition.resource.displayName

ResourceType = $assignment.roleDefinition.resource.type

RoleId = $assignment.roleDefinition.id

RoleName = $assignment.roleDefinition.displayName

ExpirationDate = $assignment.endDateTime

SubjectId = $assignment.subject.id

}

$obj = $obj + $item

}

return $obj

}

#List resources

function ListResources(){

$url = $serviceRoot + "resources?`$filter=(type+eq+'subscription')"

Write-Host $url

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get

$resources = ConvertFrom-Json $response.Content

$i = 0

$obj = @()

foreach ($resource in $resources.value)

{

$item = New-Object psobject -Property @{

id = ++$i

ResourceId = $resource.id

ResourceName = $resource.DisplayName

Type = $resource.type

ExternalId = $resource.externalId

}

$obj = $obj + $item

}

return $obj

}

#List roles

function ListRoles($resourceId){

$url = $serviceRoot + "resources/" + $resourceId + "/roleDefinitions?&`$orderby=displayName"

Write-Host $url

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get

$roles = ConvertFrom-Json $response.Content

$i = 0

$obj = @()

foreach ($role in $roles.value)

{

$item = New-Object psobject -Property @{

id = ++$i

RoleDefinitionId = $role.id

RoleName = $role.DisplayName

}

$obj = $obj + $item

}

return $obj

}

#List roles

function ListRoleSettings($resourceId){

$url = $serviceRoot + "resources/" + $resourceId + "/roleSettings?&`$expand=resource,roleDefinition&`$orderby=lastUpdatedDateTime+desc"

Write-Host $url

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get

$roleSettings = ConvertFrom-Json -InputObject $response.Content

$i = 0

$obj = @()

foreach ($roleSetting in $roleSettings.value)

{

# userMemberSettings

$UMSExp = ""

$UMSMFA = ""

$UMSJus = ""

$UMSActDay = ""

$UMSApprov = ""

$UMSTicket = ""

foreach ($UMS in $roleSetting.userMemberSettings)

{

switch ($UMS.ruleIdentifier) {

"MfaRule"

{

$UMSMFA = $UMS.setting

break

}

"ExpirationRule"

{

$UMSExp = $UMS.setting

break

}

"JustificationRule"

{

$UMSJus = $UMS.setting

break

}

"ActivationDayRule"

{

$UMSActDay = $UMS.setting

break

}

"ApprovalRule"

{

$UMSApprov = $UMS.setting

break

}

"TicketingRule"

{

$UMSTicket = $UMS.setting

break

}

# AdminEligibleSettings

$AESExp = ""

$AESMFA = ""

$AESJus = ""

$AESActDay = ""

$AESApprov = ""

$AESTicket = ""

foreach ($AES in $roleSetting.adminEligibleSettings)

{

switch ($AES.ruleIdentifier) {

"MfaRule"

{

$AESMFA = $AES.setting

break

}

"ExpirationRule"

{

$AESExp = $AES.setting

break

}

"JustificationRule"

{

$AESJus = $AES.setting

break

}

"ActivationDayRule"

{

$AESActDay = $AES.setting

break

}

"ApprovalRule"

{

$AESApprov = $AES.setting

break

}

"TicketingRule"

{

$AESTicket = $AES.setting

break

}

# AdminMemberSettings

$AMSExp = ""

$AMSMFA = ""

$AMSJus = ""

$AMSActDay = ""

$AMSApprov = ""

$AMSTicket = ""

foreach ($AMS in $roleSetting.adminMemberSettings)

{

switch ($AMS.ruleIdentifier) {

"MfaRule"

{

$AMSMFA = $AMS.setting

break

}

"ExpirationRule"

{

$AMSExp = $AMS.setting

break

}

"JustificationRule"

{

$AMSJus = $AMS.setting

break

}

"ActivationDayRule"

{

$AMSActDay = $AMS.setting

break

}

"ApprovalRule"

{

$AMSApprov = $AMS.setting

break

}

"TicketingRule"

{

$AMSTicket = $AMS.setting

break

}

$item = New-Object psobject -Property @{

id = ++$i

RoleSettingId = $roleSetting.id

ResourceId = $roleSetting.resourceId

ResourceName = $roleSetting.resource.displayName

RoleDefinitionId = $roleSetting.roleDefinitionId

RoleName = $roleSetting.roleDefinition.displayName

AdminMemberSettings = $roleSetting.adminMemberSettings

AdminEligibleSettings = $roleSetting.adminEligibleSettings

UserEligibleSettings = $roleSetting.userEligibleSettings

UserMemberSettings = $roleSetting.userMemberSettings

UserMemberSettingsMfaRule = $UMSMFA

UserMemberSettingsExpirationRule = $UMSExp

UserMemberSettingsJustificationRule = $UMSJus

UserMemberSettingsActivationDayRule = $UMSActDay

UserMemberSettingsApprovalRule = $UMSApprov

UserMemberSettingsTicketingRule = $UMSTicket

AdminEligibleSettingsMfaRule = $AESMFA

AdminEligibleSettingsExpirationRule = $AESExp

AdminEligibleSettingsJustificationRule = $AESJus

AdminEligibleSettingsActivationDayRule = $AESActDay

AdminEligibleSettingsApprovalRule = $AESApprov

AdminEligibleSettingsTicketingRule = $AESTicket

AdminMemberSettingsMfaRule = $AMSMFA

AdminMemberSettingsExpirationRule = $AMSExp

AdminMemberSettingsJustificationRule = $AMSJus

AdminMemberSettingsActivationDayRule = $AMSActDay

AdminMemberSettingsApprovalRule = $AMSApprov

AdminMemberSettingsTicketingRule = $AMSTicket

}

$obj = $obj + $item

}

return $obj

}

#List Assignment

function ListAssignmentsWithFilter($resourceId, $roleDefinitionId){

$url = $serviceRoot + "resources/" + $resourceId + "`/roleAssignments?`$expand=subject,roleDefinition(`$expand=resource)&`$filter=(roleDefinition/id+eq+'" + $roleDefinitionId + "')"

Write-Host $url

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get

$roleAssignments = ConvertFrom-Json $response.Content

$i = 0

$obj = @()

foreach ($roleAssignment in $roleAssignments.value)

{

$item = New-Object psobject -Property @{

id = ++$i

RoleAssignmentId = $roleAssignment.id

ResourceId = $roleAssignment.roleDefinition.resource.id

OriginalId = $roleAssignment.roleDefinition.resource.externalId

ResourceName = $roleAssignment.roleDefinition.resource.displayName

ResourceType = $roleAssignment.roleDefinition.resource.type

RoleId = $roleAssignment.roleDefinition.id

RoleName = $roleAssignment.roleDefinition.displayName

ExpirationDate = $roleAssignment.endDateTime

SubjectId = $roleAssignment.subject.id

UserName = $roleAssignment.subject.displayName

AssignmentState = $roleAssignment.AssignmentState

}

$obj = $obj + $item

}

return $obj

}

#List Assignment

function ListExpiringEligibleAssignmentsWithFilter($resourceId){

$url = $serviceRoot + "resources/" + $resourceId + "`/roleAssignments?`$expand=subject,roleDefinition(`$expand=resource)&`$filter=(assignmentState+eq+'Eligible')"

Write-Host $url

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get

$roleAssignments = ConvertFrom-Json $response.Content

$i = 0

$obj = @()

$expiration = (Get-Date).ToUniversalTime().AddDays(14)

foreach ($roleAssignment in $roleAssignments.value)

{

if(($roleAssignment.endDateTime -ne $null) -and ([DateTime]$roleAssignment.endDateTime -lt $expiration))

{

$item = New-Object psobject -Property @{

id = ++$i

RoleAssignmentId = $roleAssignment.id

ResourceId = $roleAssignment.roleDefinition.resource.id

OriginalId = $roleAssignment.roleDefinition.resource.externalId

ResourceName = $roleAssignment.roleDefinition.resource.displayName

ResourceType = $roleAssignment.roleDefinition.resource.type

RoleId = $roleAssignment.roleDefinition.id

RoleName = $roleAssignment.roleDefinition.displayName

ExpirationDate = $roleAssignment.endDateTime

SubjectId = $roleAssignment.subject.id

UserName = $roleAssignment.subject.displayName

AssignmentState = $roleAssignment.AssignmentState

}

$obj = $obj + $item

}

return $obj

}

#List Users

function ListUsers($user_search){

$url = $MSGraphRoot + "users?`$filter=startswith(displayName,'" + $user_search + "')"

Write-Host $url

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get

$users = ConvertFrom-Json $response.Content

$i = 0

$obj = @()

foreach ($user in $users.value)

{

$item = New-Object psobject -Property @{

id = ++$i

UserId = $user.id

UserName = $user.DisplayName

}

$obj = $obj + $item

}

return $obj

}

#Activates the user

function Activate($isRecursive = $false){

if($isRecursive -eq $false)

{

$assignments = MyJitAssignments

$assignments | Format-Table -AutoSize -Wrap id,RoleName,ResourceName,ResourceType,ExpirationDate

$choice = Read-Host "Enter Id to activate"

[int]$hours = Read-Host "Enter Activation duration in hours"

$reason = Read-Host "Enter Reason"

}

$id = $assignments[$choice-1].IdGuid

$resourceId = $assignments[$choice-1].ResourceId

$roleDefinitionId = $assignments[$choice-1].RoleId

$subjectId = $assignments[$choice-1].SubjectId

$url = $serviceRoot + "roleAssignmentRequests"

$postParams = '{"id":"00000000-0000-0000-0000-000000000000","assignmentState":"Active","type":"UserAdd","reason":"' + $reason + '","roleDefinitionId":"' + $roleDefinitionId + '","resourceId":"' + $resourceId + '","subjectId":"' + $subjectId + '","schedule":{"duration":"PT' + $hours + 'H","startDateTime":"' + (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ") + '","type":"Once"},"linkedEligibleRoleAssignmentId":"' + $id + '"}'

write-Host $postParams

try

{

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json" -Body $postParams

Write-Host "Activation request queued successfully ..." -ForegroundColor Green

$recursive = $false

}

catch

{

$stream = $_.Exception.Response.GetResponseStream()

$stream.Position = 0;

$streamReader = New-Object System.IO.StreamReader($stream)

$err = $streamReader.ReadToEnd()

$streamReader.Close()

$stream.Close()

if($mfaDone -eq $false -and $err.Contains("MfaRule"))

{

Write-Host "Prompting the user for mfa ..." -ForegroundColor Green

AcquireToken $global:clientID $global:redirectUri $global:resourceAppIdURI $global:authority $true

Activate $true

}

else

{

Write-Host $err -ForegroundColor Red

}

#Extend the user role assignment

function ExtendRoleAssignment($roleAssignment, $hours){

$url = $serviceRoot + "roleAssignmentRequests"

$postParams = '{"id":"00000000-0000-0000-0000-000000000000","assignmentState":"Eligible","type":"AdminExtend","reason":"bulk extend","roleDefinitionId":"' + $roleAssignment.RoleId + '","resourceId":"' + $roleAssignment.ResourceId + '","subjectId":"' + $roleAssignment.SubjectId + '","schedule":{"duration":"PT' + $hours + 'H","startDateTime":"' + (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ") + '","type":"Once"}}'

write-Host $postParams

try

{

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json" -Body $postParams

Write-Host "Extend Successfully ..." -ForegroundColor Green

$recursive = $false

}

catch

{

$stream = $_.Exception.Response.GetResponseStream()

$stream.Position = 0;

$streamReader = New-Object System.IO.StreamReader($stream)

$err = $streamReader.ReadToEnd()

$streamReader.Close()

$stream.Close()

}

#Delete the user role assignment

function DeleteRoleAssignment($roleAssignment){

$resourceId = $roleAssignments[$ra_choice-1].ResourceId

$roleDefinitionId = $roleAssignments[$ra_choice-1].RoleId

$subjectId = $roleAssignments[$ra_choice-1].SubjectId

$assignmentState = $roleAssignments[$ra_choice-1].AssignmentState

# Delete the chosen member

$url = $serviceRoot + "roleAssignmentRequests"

$postParams = '{"assignmentState":"' + $assignmentState + '","type":"AdminRemove","reason":"Assign","roleDefinitionId":"' + $roleDefinitionId + '","resourceId":"' + $resourceId + '","subjectId":"' + $subjectId + '"}'

write-Host $postParams

write-Host $url

try

{

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json" -Body $postParams

Write-Host "Assignment has been deleted" -ForegroundColor Green

$recursive = $false

}

catch

{

$stream = $_.Exception.Response.GetResponseStream()

$stream.Position = 0;

$streamReader = New-Object System.IO.StreamReader($stream)

$err = $streamReader.ReadToEnd()

$streamReader.Close()

$stream.Close()

Write-Host $err -ForegroundColor Red

}

#Deactivates the user

function Deactivate($isRecursive = $false){

if($isRecursive -eq $false)

{

$assignments = MyJitAssignments

$assignments | Format-Table -AutoSize -Wrap id,RoleName,ResourceName,ResourceType,ExpirationDate

$choice = Read-Host "Enter Id to deactivate"

}

$id = $assignments[$choice-1].IdGuid

$resourceId = $assignments[$choice-1].ResourceId

$roleDefinitionId = $assignments[$choice-1].RoleId

$subjectId = $assignments[$choice-1].SubjectId

$url = $serviceRoot + "roleAssignmentRequests"

$postParams = '{"assignmentState":"Active","type":"UserRemove","roleDefinitionId":"' + $roleDefinitionId + '","resourceId":"' + $resourceId + '","subjectId":"' + $subjectId + '"}'

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json" -Body $postParams

Write-Host "Role deactivated successfully ..." -ForegroundColor Green

$recursive = $false

}

#Patch RoleSetting

function PatchRoleSetting($patchParams, $roleSettingId){

$url = $serviceRoot + "roleSettings/" + $roleSettingId

Write-Host $url

Write-Host $patchParams

try

{

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Patch -ContentType "application/json" -Body $patchParams

Write-Host "Update RoleSetting successfully ..." -ForegroundColor Green

$recursive = $false

}

catch

{

$stream = $_.Exception.Response.GetResponseStream()

$stream.Position = 0;

$streamReader = New-Object System.IO.StreamReader($stream)

$err = $streamReader.ReadToEnd()

$streamReader.Close()

$stream.Close()

}

#List RoleAssignment

function ListAssignment(){

#List and Pick resource

$resources = ListResources

$resources | Format-Table -AutoSize -Wrap id, ResourceName, Type, ExternalId

$res_choice = Read-Host "Pick an resource Id for assigment"

$resourceId = $resources[$res_choice-1].ResourceId

#List and Pick a role

$roles = ListRoles($resourceId)

$roles | Format-Table -AutoSize -Wrap id, RoleName, RoleDefinitionId

$role_choice = Read-Host "Pick a role Id"

$roleDefinitionId = $roles[$role_choice-1].RoleDefinitionId

write-Host $roleDefinitionId

#List Member

$roleAssignments = ListAssignmentsWithFilter $resourceId $roleDefinitionId

$roleAssignments | Format-Table -AutoSize -Wrap id, ResourceName, ResourceType, RoleName, UserName, AssignmentState, ExpirationDate

}

#Delete RoleAssignment

function DelAssignment(){

#List and Pick resource

$resources = ListResources

$resources | Format-Table -AutoSize -Wrap id, ResourceName, Type, ExternalId

$res_choice = Read-Host "Pick an resource Id for assigment"

$resourceId = $resources[$res_choice-1].ResourceId

#List and Pick a role

$roles = ListRoles($resourceId)

$roles | Format-Table -AutoSize -Wrap id, RoleName, RoleDefinitionId

$role_choice = Read-Host "Pick a role Id"

$roleDefinitionId = $roles[$role_choice-1].RoleDefinitionId

write-Host $roleDefinitionId

#List Member

$roleAssignments = ListAssignmentsWithFilter $resourceId $roleDefinitionId

$roleAssignments | Format-Table -AutoSize -Wrap id, ResourceName, ResourceType, RoleName, UserName, AssignmentState, ExpirationDate

$ra_choice = Read-Host "Pick a roleAssignment you want to delete, Pick 0 for Del All active, and Pick -1 to exit"

if ($ra_choice -eq -1)

{

return

}

if (($roleAssignments -eq $null) -or ($roleAssignments[$ra_choice-1] -eq $null))

{

Write-Host "Number out-of range"

return

}

if ($ra_choice -gt 0)

{

DeleteRoleAssignment $roleAssignments[$ra_choice-1]

} elseif ($ra_choice -eq 0)

{

foreach ($ra in $roleAssignments)

{

if ($ra.AssignmentState -eq "Active")

{

DeleteRoleAssignment $ra

}

#List ExpiringRoleAssignment

function ListExpiringEligibleAssignments(){

#List and Pick resource

$resources = ListResources

$resources | Format-Table -AutoSize -Wrap id, ResourceName, Type, ExternalId

$res_choice = Read-Host "Pick a resource Id for assigment"

$resourceId = $resources[$res_choice-1].ResourceId

#List Expiring Member of the target resource

$roleAssignments = ListExpiringEligibleAssignmentsWithFilter $resourceId

$roleAssignments | Format-Table -AutoSize -Wrap id, ResourceName, ResourceType, RoleName, UserName, AssignmentState, ExpirationDate

if ($roleAssignments -eq $null)

{

Write-Host "No Eligible memberships are expiring" -ForegroundColor Green

} else

{

$ra_choice = Read-Host "Pick a roleAssignment you want to extend, Pick 0 for ExtendAll, and Pick -1 to exit"

if ($ra_choice -eq -1)

{

return

}

$days = Read-Host "Pick number of days, you want to extends"

$hours = [int]$days * 24

Write-Host $hours

if ($ra_choice -gt 0)

{

ExtendRoleAssignment $roleAssignments[$ra_choice-1] $hours

} elseif ($ra_choice -eq 0)

{

foreach ($ra in $roleAssignments)

{

ExtendRoleAssignment $ra $hours

}

#Assign a user to Eligible

function AssignmentEligible() {

#List and Pick resource

$resources = ListResources

$resources | Format-Table -AutoSize -Wrap id, ResourceName, Type, ExternalId

$res_choice = Read-Host "Pick an resource Id for assigment"

$resourceId = $resources[$res_choice-1].ResourceId

#List and Pick a role

$roles = ListRoles($resourceId)

$roles | Format-Table -AutoSize -Wrap id, RoleName, RoleDefinitionId

$role_choice = Read-Host "Pick a role Id"

$roleDefinitionId = $roles[$role_choice-1].RoleDefinitionId

write-Host $roleDefinitionId

#Search user by Name, and pick a user

$user_search = Read-Host "user Name start with..."

$users = ListUsers($user_search)

$users | Format-Table -AutoSize -Wrap id, UserName, UserId

$user_choice = Read-Host "Pick a user Id"

if (($users -eq $null) -or ($users[$user_choice-1] -eq $null))

{

Write-Host "Number out-of range"

return

}

$subjectId = $users[$user_choice-1].UserId

$url = $serviceRoot + "roleAssignmentRequests"

# Update end time

$ts = New-TimeSpan -Days 30

$postParams = '{"assignmentState":"Eligible","type":"AdminAdd","reason":"Assign","roleDefinitionId":"' + $roleDefinitionId + '","resourceId":"' + $resourceId + '","subjectId":"' + $subjectId + '","schedule":{"startDateTime":"' + (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ") + '","endDateTime":"' + ((Get-Date) + $ts).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ") + '","type":"Once"}}'

write-Host $postParams

try

{

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json" -Body $postParams

Write-Host "Assignment request queued successfully ..." -ForegroundColor Green

$recursive = $false

}

catch

{

$stream = $_.Exception.Response.GetResponseStream()

$stream.Position = 0;

$streamReader = New-Object System.IO.StreamReader($stream)

$err = $streamReader.ReadToEnd()

$streamReader.Close()

$stream.Close()

if($mfaDone -eq $false -and $err.Contains("MfaRule"))

{

Write-Host "Prompting the user for mfa ..." -ForegroundColor Green

AcquireToken $global:clientID $global:redirectUri $global:resourceAppIdURI $global:authority $true

Activate $true

}

else

{

Write-Host $err -ForegroundColor Red

}

#Cancel Request

function CancelRequest() {

$requestId = Read-Host "RequestId"

$url = $serviceRoot + "roleAssignmentRequests/" + $requestId + "/cancel"

write-Host $url

try

{

$response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json"

Write-Host "Cancel request queued successfully ..." -ForegroundColor Green

$recursive = $false

}

catch

{

$stream = $_.Exception.Response.GetResponseStream()

$stream.Position = 0;

$streamReader = New-Object System.IO.StreamReader($stream)

$err = $streamReader.ReadToEnd()

$streamReader.Close()

$stream.Close()

Write-host $err

}

#List RoleSetting

function ListRoleSetting(){

#List and Pick resource

$resources = ListResources

$resources | Format-Table -AutoSize -Wrap id, ResourceName, Type, ExternalId

$res_choice = Read-Host "Pick an resource Id for assigment"

$resourceId = $resources[$res_choice-1].ResourceId

#List RoleSettings and Pick a role/multiple role to update

$roleSettings = ListRoleSettings($resourceId)

$roleSettings | Format-List id, RoleName, RoleDefinitionId, ResourceName, ResourceId, AdminMemberSettings, AdminEligibleSettings, UserMemberSettings, UserEligibleSettings,

AdminMemberSettingsMfaRule, AdminMemberSettingsExpirationRule, AdminMemberSettingsJustificationRule, AdminMemberSettingsActivationDayRule, AdminMemberSettingsApprovalRule, AdminMemberSettingsTicketingRule,

AdminEligibleSettingsMfaRule, AdminEligibleSettingsExpirationRule, AdminEligibleSettingsJustificationRule, AdminEligibleSettingsActivationDayRule, AdminEligibleSettingsApprovalRule, AdminEligibleSettingsTicketingRule,

UserMemberSettingsMfaRule, UserMemberSettingsExpirationRule, UserMemberSettingsJustificationRule, UserMemberSettingsActivationDayRule, UserMemberSettingsApprovalRule, UserMemberSettingsTicketingRule,

UserEligibleSettingsMfaRule, UserEligibleSettingsExpirationRule, UserEligibleSettingsJustificationRule, UserEligibleSettingsActivationDayRule, UserEligibleSettingsApprovalRule, UserEligibleSettingsTicketingRule

}

#Update RoleSetting

function UpdateRoleSetting(){

#List and Pick resource

$resources = ListResources

$resources | Format-Table -AutoSize -Wrap id, ResourceName, Type, ExternalId

$res_choice = Read-Host "Pick an resource Id for assigment"

$resourceId = $resources[$res_choice-1].ResourceId

#List RoleSettings and Pick a role/multiple role to update

$roleSettings = ListRoleSettings($resourceId)

$roleSettings | Format-List id, RoleName, RoleDefinitionId, ResourceName, ResourceId, AdminMemberSettings, AdminEligibleSettings, UserMemberSettings, UserEligibleSettings,

UserMemberSettingsMfaRule, UserMemberSettingsExpirationRule, UserMemberSettingsJustificationRule, UserMemberSettingsActivationDayRule, UserMemberSettingsApprovalRule, UserMemberSettingsTicketingRule,

$roleSettings | Format-Table -AutoSize -Wrap id, RoleName, ResourceName, RoleDefinitionId, ResourceId

$roleSetting_choice = Read-Host "Pick a role Id"

$roleSettingId = $roleSettings[$roleSetting_choice-1].RoleSettingId

write-Host $roleSettingId

# Activation Setting: "MfaRule", "ExpirationRule", "JustificationRule", "ActivationDayRule", "ApprovalRule", "TicketingRule"

$Activation = Read-Host "Update Activation Setting or not (Y or N)"

if ($Activation -like 'Y')

{

$ActivationMfaRule = Read-Host "Activation MFA enabled (Y or N)"

$ActivationExpirationRule = Read-Host "Activation Grant period in mins (ie. 240 is 4 hr)"

$ActivationJustificationRule = Read-Host "Activation Justification enabled (Y or N)"

$ActivationGP = [timespan]::fromminutes($ActivationExpirationRule)

#$UserMemberSetting = '{@{ruleIdentifier=ExpirationRule; setting={"maximumGrantPeriod":"'+$ActivationGP+'","maximumGrantPeriodInMinutes":'+$ActivationExpirationRule+',"permanentAssignment":false}}'

$UserMemberSetting =',"userMemberSettings": [{"ruleIdentifier":"ExpirationRule","setting": "{\"permanentAssignment\":false,\"maximumGrantPeriodInMinutes\":'+$ActivationExpirationRule+'}"}'

if ($ActivationMfaRule -like 'Y')

{

$UserMemberSetting = $UserMemberSetting + ',{"ruleIdentifier":"MfaRule","setting":"{\"mfaRequired\":true}"}'

} elseif ($ActivationMfaRule -like 'N')

{

$UserMemberSetting = $UserMemberSetting + ',{"ruleIdentifier":"MfaRule","setting":"{\"mfaRequired\":false}"}'

}

if ($ActivationJustificationRule -like 'Y')

{

$UserMemberSetting = $UserMemberSetting + ',{"ruleIdentifier":"JustificationRule","setting":"{\"required\":true}"}]'

} elseif ($ActivationJustificationRule -like 'N')

{

$UserMemberSetting = $UserMemberSetting + ',{"ruleIdentifier":"JustificationRule","setting":"{\"required\":false}"}]'

}

Write-Host $UserMemberSetting

}

$AdminE = Read-Host "Update Admin Eligible Setting or not (Y or N)"

if ($AdminE -like 'Y')

{

$AdminEMfaRule = Read-Host "Admin Eligible MFA enabled (Y or N)"

$AdminEExpirationRule = Read-Host "Admin Eligible Grant period in mins (ie. 240 is 4 hr)"

$AdminEJustificationRule = Read-Host "Admin Eligible Justification enabled (Y or N)"

$AdminEGP = [timespan]::fromminutes($AdminEExpirationRule)

$AdminESetting =',"adminEligibleSettings": [{"ruleIdentifier":"ExpirationRule","setting": "{\"permanentAssignment\":false,\"maximumGrantPeriodInMinutes\":'+$AdminEExpirationRule+'}"}'

if ($AdminEMfaRule -like 'Y')

{

$AdminESetting = $AdminESetting + ',{"ruleIdentifier":"MfaRule","setting":"{\"mfaRequired\":true}"}'

} elseif ($ActivationMfaRule -like 'N')

{

$AdminESetting = $AdminESetting + ',{"ruleIdentifier":"MfaRule","setting":"{\"mfaRequired\":false}"}'

}

if ($AdminEJustificationRule -like 'Y')

{

$AdminESetting = $AdminESetting + ',{"ruleIdentifier":"JustificationRule","setting":"{\"required\":true}"}]'

} elseif ($ActivationJustificationRule -like 'N')

{

$AdminESetting = $AdminESetting + ',{"ruleIdentifier":"JustificationRule","setting":"{\"required\":false}"}]'

}

Write-Host $AdminESetting

}

if (($AdminE -like 'Y') -or ($Activation -like 'Y'))

{

#foreach

$SettingId = '{"id":"'+$roleSettingId+'"'

Write-Host $SettingId

$RoleSet = $SettingId+$UserMemberSetting+$AdminESetting+'}'

Write-Host $RoleSet

PatchRoleSetting $RoleSet $roleSettingId

}

#Show menu

function ShowMenu(){

Write-Host ""

Write-Host "--------------------------------------- "

Write-Host "Azure RBAC JIT - PowerShell Menu "

Write-Host "--------------------------------------- "

Write-Host " 1. EndUser List: List your eligible role assignments"

Write-Host " 2. EndUser Activate: Activate an eligible role"

Write-Host " 3. EndUser Deactivate: Deactivate an active role"

Write-Host " 4. Admin List: List Assignment against a resource"

Write-Host " 5. Admin Assign: Assign a user to a role"

Write-Host " 6. Admin Delete: Delete Assignment against a resource+role+user"

Write-Host " 7. Admin Extend: List Expiring Eligible Assignment against a resource and option to extend"

Write-Host " 8. Admin/EndUser Cancel: Cancel a request"

Write-Host " 9. Admin Query RoleSetting: List roleSetting against a resource"

Write-Host " 10. Admin Update RoleSetting: Choose RoleSetting to apply to a single or multiple roles"

Write-Host " 11. Exit"

Write-Host ""

}

############################################################################################################################################################################

$global:serviceRoot = "https://graph.microsoft.com/beta/privilegedAccess/azureResources/"

$global:MSGraphRoot = "https://graph.microsoft.com/v1.0/"

$global:headerParams = ""

$global:assigneeId = ""

$global:mfaDone = $false;

$global:expiration = '2019-07-01T00:00:00Z'

$global:authority = "https://login.microsoftonline.com/common"

$global:scopes = @("https://graph.microsoft.com/.default");

$clientID = "dabc52c4-106b-4179-9df2-2f791f44ba14"

$redirectUri = "https://pimmsgraph"

# Install msal.ps

if(!(Get-Module | Where-Object {$_.Name -eq 'PowerShellGet' -and $_.Version -ge '2.2.4.1'})) { Install-Module PowerShellGet -Force }

if(!(Get-Package msal.ps)) { Install-Package msal.ps }

$Authed = AcquireToken $global:clientID $global:redirectUri $global:scopes $global:authority $false

if ($Authed -eq $false)

{

return

}

{

ShowMenu

#Write-Host "Enter your selection"

$input = Read-Host "Enter your selection"

switch ($input)

{

'1'

{

$assignments = MyJitAssignments

$assignments | Format-Table -AutoSize -Wrap id,RoleName,ResourceName,ResourceType,ExpirationDate

}

'2'

{

Activate

}

'3'

{

Deactivate

}

'4'

{

ListAssignment

}

'5'

{

AssignmentEligible

}

'6'

{

DelAssignment

}

'7'

{

ListExpiringEligibleAssignments

}

'8'

{

CancelRequest

}

'9'

{

ListRoleSetting

}

'10'

{

UpdateRoleSetting

}

'11'

{

return

}

until ($input -eq '11')

Write-Host ""