Password-based SSO assigning user credentials via PowerShell

Question

Hey folks,

We're in the middle of migrating our apps from Okta to Azure, and are having a wild amount of difficulty with the SWA apps in Okta porting across to Azure.

We're trying to automate as much as possible, and have a couple of questions around assignments and detection of the sign-in fields.

First, is it possible to have the sign-in fields detected via PowerShell, perhaps using MgGraph? We have used MgGraph to create the application, set as password-based and enter the Sign-on URL, but still need to manually kick off the field detection. We don't really want to have to do this for 1600+ apps.

Second, is it possible to assign a user/group to the application and have the credentials entered as part of the assignment, again using PowerShell? Again, we are able to assign the users/group to the Enterprise app, but haven't been able to figure out the credentials piece yet.

Thanks.

Andy

Answer 1

Hi @yeooandyni

Thank you for posting this in Microsoft Q&A.

I understand that you are looking for assistance with automating the migration of SWA apps from Okta to Azure.

First, is it possible to have the sign-in fields detected via PowerShell, perhaps using MgGraph? We have used MgGraph to create the application, set as password-based and enter the Sign-on URL, but still need to manually kick off the field detection. We don't really want to have to do this for 1600+ apps.

Unfortunately, it is not possible to detect the sign-in fields via PowerShell or MgGraph. The sign-in fields detection is a manual process that needs to be done through the portal.

Second, is it possible to assign a user/group to the application and have the credentials entered as part of the assignment, again using PowerShell? Again, we are able to assign the users/group to the Enterprise app but haven't been able to figure out the credentials piece yet.

I understand when you assign a user or group to an application in Entra ID using PowerShell, you provide the admin credentials that are used to authenticate the PowerShell session and perform the assignment.

To perform a truly silent SSO authentication request using The AZ PowerShell module you can pass your UPN as the AccountID parameter while using the Connect-AzAccount command.

Connect-AzAccount -AccountID 'UPN'

Regarding the white blank window, it should take less than a second, but it will be always noticeable since opening a web browser is part of the interactive login process.

To Manage users and groups assignment to an application: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=aad-powershell

Please do correct me if this is not the case by responding in the comments section.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.