What is the best practice to get all AAD users from Azure Function App with Powershell?

Question

What is the best practice to get all AAD users from Azure Function App with Powershell? I would like to avoid to authenticate by a user account. So it should be something like a managed identity or Azure app registration.

Answer 1

Hello Khalid,

To get all AAD users from an Azure Function App using PowerShell without using a user account, you can indeed use Managed Identity or an Azure App Registration.

First you will need to create a App Registration with the necessary permissions : User.Read.All in Microsoft Graph.

Then create a managed Identity for your Azure Function, which allows it to authenticate to Azure services securely.

Then acquire a token using the Managed Identity within your PowerShell script in the Azure Function.

Invoke the MS Graph API using the acquired token to retrieve the list of AAD users.

More info on token usage here : https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow#get-direct-authorization

If you found this answer useful, please consider marking it as 'Accepted.' This helps other users easily find and benefit from this information

Regards