Managed Identities to be filtered from app certificate/keys expiry list

Milo James 46

Hi Team,

We have similar script being used to get the details of all app certificates and their key expiry before their actual end dates. So that we can have it renewed. I noticed that it also gathers Managed Identities along. As managed identity certs/keys are auto-renewed. we would like to exclude them.

Request you to let us know when we filter out using ($_.Type-ne <What should be managed identity type>) here.

I hope to have to the right team look into it and share the details. I was not getting it for Managed Idenity in Azure.

Saurabh Sharma 23,801 Reputation points Microsoft Employee

2021-06-02T22:15:51.577+00:00

Hi @Milo James ,
Thanks for using Microsoft Q&A !!.
I tried to use the code but I not getting any Managed Identities out this list and seeing only registered applications. Can you please share the type of resource (webapp, etc.) for which you are seeing a managed identity details? Also, could you please share the actual code if you have modified any part of the code from the shared link.

Thanks
Saurabh
Milo James 46 Reputation points

2021-06-03T08:18:38.06+00:00
Hi,

We use the below script and it does pop up all the managed identities.

$AzApps = Get-AzADServicePrincipal | Where-Object -FilterScript { ($_.DisplayName -notlike "*Microsoft*")

This way, we would like to filter out Managed identites.

1 answer

Saurabh Sharma 23,801 Reputation points Microsoft Employee

2021-06-03T17:09:01.247+00:00

Hi @Milo James
Ok got it. You could use the below cmdlet to filter out Managed Identities as managed identities contain 'https://identity.azure.net' as part of Service Principal Names.

$AzApps = Get-AzADServicePrincipal | Where-Object -FilterScript { ($_.ServicePrincipalNames -notmatch "https://identity.azure.net") }

Please let me know if this helps to achieve your goal.

Thanks
Saurabh

----------

Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.
Please sign in to rate this answer.
Milo James 46 Reputation points

2021-06-04T05:36:33.283+00:00

Hi Saurabh,

It still gathered all our AKS managed identities when I ran the above script as shared by you.

Saurabh Sharma 23,801 Reputation points Microsoft Employee

2021-06-04T21:01:05.417+00:00

@Milo James ok, I am checking on the same and get back to you if we can filter those out.

Thanks
Saurabh

Saurabh Sharma 23,801 Reputation points Microsoft Employee

2021-06-10T22:49:55.97+00:00

Hi @Milo James , Instead of using Get-AzADServiceprincipal can you try using Get-AzureADServicePrincipal to get service principals as this cmdlet returns "ServicePrincipalType" as one of the properties and set as "ManagedIdentity" for a managed identities like your AKS. So you can use cmdlet something like below to exclude managed identities -

Get-AzureADServicePrincipal -All:$true | Where-Object { ($_.ServicePrincipalType -ne "ManagedIdentity" ) }

Thanks
Saurabh

Saurabh Sharma 23,801 Reputation points Microsoft Employee

2021-06-14T20:35:52.037+00:00

Hi @Milo James ,

Please let me know if this works for you.

Thanks
Saurabh
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Managed Identities to be filtered from app certificate/keys expiry list

1 answer

Your answer