Pre-requisites

$PSVersionTable.PSVersion
Major  Minor  Build  Revision
-----  -----  -----  --------
5      1      17134  137

Windows Management Framework 3.0
Windows Management Framework 4.0
Windows Management Framework 5.1

Setup

Pre-requisites

Install-Package Azure

Cannot find an overload for 'AcquireTokenAsync' and the argument count: '4' 

$AadModule = Get-Module -Name "AzureAD" -ListAvailable
if ($AadModule.count -gt 1) {
    $Latest_Version = ($AadModule | select version | Sort-Object)[-1]
    $aadModule      = $AadModule | ? { $_.version -eq $Latest_Version.version }
    $adal           = Join-Path $AadModule.ModuleBase "Microsoft.IdentityModel.Clients.ActiveDirectory.dll"
    }
else {$adal           = Join-Path $AadModule.ModuleBase "Microsoft.IdentityModel.Clients.ActiveDirectory.dll"}
[System.Reflection.Assembly]::LoadFrom($adal) | Select FullName

Microsoft.IdentityModel.Clients.ActiveDirectory, Version=3.19.7.16602

Setup

Creating a Native App

• Name: MicrosoftGraphNativeApp
• Application Type: Native
• Redirect URI: https://redirecturi.com

Creating the AccessToken Function

Function Get-AccessToken ($TenantName, $ClientID, $redirectUri, $resourceAppIdURI, $CredPrompt){
    Write-Host "Checking for AzureAD module..."
    if (!$CredPrompt){$CredPrompt = 'Auto'}
    $AadModule = Get-Module -Name "AzureAD" -ListAvailable
    if ($AadModule -eq $null) {$AadModule = Get-Module -Name "AzureADPreview" -ListAvailable}
    if ($AadModule -eq $null) {write-host "AzureAD Powershell module is not installed. The module can be installed by running 'Install-Module AzureAD' or 'Install-Module AzureADPreview' from an elevated PowerShell prompt. Stopping." -f Yellow;exit}
    if ($AadModule.count -gt 1) {
        $Latest_Version = ($AadModule | select version | Sort-Object)[-1]
        $aadModule      = $AadModule | ? { $_.version -eq $Latest_Version.version }
        $adal           = Join-Path $AadModule.ModuleBase "Microsoft.IdentityModel.Clients.ActiveDirectory.dll"
        $adalforms      = Join-Path $AadModule.ModuleBase "Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll"
        }
    else {
        $adal           = Join-Path $AadModule.ModuleBase "Microsoft.IdentityModel.Clients.ActiveDirectory.dll"
        $adalforms      = Join-Path $AadModule.ModuleBase "Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll"
        }
    [System.Reflection.Assembly]::LoadFrom($adal) | Out-Null
    [System.Reflection.Assembly]::LoadFrom($adalforms) | Out-Null
    $authority          = "https://login.microsoftonline.com/$TenantName"
    $authContext        = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext" -ArgumentList $authority
    $platformParameters = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters"    -ArgumentList $CredPrompt
    $authResult         = $authContext.AcquireTokenAsync($resourceAppIdURI, $clientId, $redirectUri, $platformParameters).Result
    return $authResult
    }

Creating the Invoke-MSGraphQuery Function

Function Invoke-MSGraphQuery($AccessToken, $Uri, $Method, $Body){
    Write-Progress -Id 1 -Activity "Executing query: $Uri" -CurrentOperation "Invoking MS Graph API"
    $Header = @{
        'Content-Type'  = 'application\json'
        'Authorization' = $AccessToken.CreateAuthorizationHeader()
        }
    $QueryResults = @()
    if($Method -eq "Get"){
        do{
            $Results =  Invoke-RestMethod -Headers $Header -Uri $Uri -UseBasicParsing -Method $Method -ContentType "application/json"
            if ($Results.value -ne $null){$QueryResults += $Results.value}
            else{$QueryResults += $Results}
            write-host "Method: $Method | URI $Uri | Found:" ($QueryResults).Count
            $uri = $Results.'@odata.nextlink'
            }until ($uri -eq $null)
        }
    if($Method -eq "Patch"){
        $Results =  Invoke-RestMethod -Headers $Header -Uri $Uri -Method $Method -ContentType "application/json" -Body $Body
        write-host "Method: $Method | URI $Uri | Executing"
        }
    Write-Progress -Id 1 -Activity "Executing query: $Uri" -Completed
    Return $QueryResults
    }

Configuring the Script Parameters

$resourceAppIdURI = "https://graph.microsoft.com"
$ClientID         = "39b7009d-46c2-4807-9a45-0b34dee40c9c"   #AKA Application ID
$TenantName       = "cloudlojik.onmicrosoft.com"             #Your Tenant Name
$CredPrompt       = "Auto"                                   #Auto, Always, Never, RefreshSession
$redirectUri      = "https://RedirectURI.com"                #Your Application's Redirect URI
$Uri              = "https://graph.microsoft.com/beta/users" #The query you want to issue to Invoke a REST command with
$Method           = "Get"                                    #GET or PATCH
$AccessToken      = Get-AccessToken -TenantName $TenantName -ClientID $ClientID -redirectUri $redirectUri -resourceAppIdURI $resourceAppIdURI -CredPrompt $CredPrompt
$JSON = @" 
    {
    "userPrincipalName": "MCC-MigAdmin01@cloudlojik.onmicrosoft.com"
    }
"@ #JSON Syntax if you are performing a PATCH

Execution

Invoke-MSGraphQuery -AccessToken $AccessToken -Uri $Uri -Method $Method -Body $JSON

PS C:\Users\paulkot> C:\PowerShellCommandCenter\Testing\CloudLojikGraphQuery.ps1
Checking for AzureAD module...
Method: Get | URI https://graph.microsoft.com/beta/users | Found: 100
Method: Get | URI https://graph.microsoft.com/beta/users?$skiptoken=X%.........%27 | Found: 200
Method: Get | URI https://graph.microsoft.com/beta/users?$skiptoken=X%.........%27 | Found: 300
Method: Get | URI https://graph.microsoft.com/beta/users?$skiptoken=X%.........%27 | Found: 313

id                             : bf14124a-35ac-4079-9a5b-07637e337665
deletedDateTime                : 
accountEnabled                 : True
ageGroup                       : 
businessPhones                 : {}
city                           : 
createdDateTime                : 2017-09-06T16:57:02Z
companyName                    : 
consentProvidedForMinor        : 
country                        : 
department                     : 
displayName                    : Admin
employeeId                     : 
givenName                      : 
jobTitle                       : 
legalAgeGroupClassification    : 
mail                           : admin@cloudlojik.com
mailNickname                   : admin
mobilePhone                    : 
onPremisesDomainName           : cloudlojik.com
onPremisesImmutableId          : GJAMfUzDmkWWTKVSxcZr3A==
onPremisesLastSyncDateTime     : 2017-09-06T17:57:07Z
onPremisesSecurityIdentifier   : S-1-5-21-3133886935-1569346377-3125956357-5104
onPremisesSamAccountName       : admin
onPremisesSyncEnabled          : True
onPremisesUserPrincipalName    : admin@cloudlojik.com
passwordPolicies               : DisablePasswordExpiration
passwordProfile                : 
officeLocation                 : 
postalCode                     : 
preferredDataLocation          : 
preferredLanguage              : 
proxyAddresses                 : {x500:/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=07c0a25fdaa846eab6f23051fa695d67-Admin, X500:/o=CloudlojikExchange/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Admin688, smtp:admin@cloudlojik.onmicrosoft.com, smtp:admin@cloudlojik.mail.onmicrosoft.com...}
refreshTokensValidFromDateTime : 2017-09-06T16:33:40Z
showInAddressList              : 
imAddresses                    : {}
state                          : 
streetAddress                  : 
surname                        : 
usageLocation                  : 
userPrincipalName              : admin@cloudlojik.com
userType                       : Member
assignedLicenses               : {}
assignedPlans                  : {}
deviceKeys                     : {}
onPremisesExtensionAttributes  : @{extensionAttribute1=; extensionAttribute2=; extensionAttribute3=; extensionAttribute4=; extensionAttribute5=; extensionAttribute6=; extensionAttribute7=; extensionAttribute8=; extensionAttribute9=; extensionAttribute10=; extensionAttribute11=; extensionAttribute12=; extensionAttribute13=; extensionAttribute14=; 
                                 extensionAttribute15=}
onPremisesProvisioningErrors   : {}
provisionedPlans               : {}

Prerequisites

1. Azure RM Module must be installed in Azure Automation. You can accomplish this by going to the PowerShell Gallery and having it "Deploy[ed] to Azure Automation"
2. Azure RM Module installed on your local workstation. If your running PowerShell 3.0 or later, you can run Install-Package AzureRM as an administrator.
3. Azure Subscription

How To

Creating a Storage Account

1. First create a Storage Account. If you don't already have one, you'll to connect to Azure Resource Manager through your local PowerShell client:

   Login-AzureRmAccount
   

2. Once you have authenticated, ensure that you are connected to the correct subscription. You can view your subscriptions but using Get-AzureRmSubscription.

   Get-AzureRmSubscription -SubscriptionName "Office 365 Test and Validations" | Select-AzureRmSubscription
       Environment           		: AzureCloud
       Account               		: paul@domain.com
       TenantId             		: 72f988bf-86f1-41af-91ab-212cd011db47
       SubscriptionId        		: 1edb6f86-8931-40e4-a70e-d2128ce0ee32
       SubscriptionName      		: Microsoft Azure Internal Consumption
       CurrentStorageAccount 		:
   

3. Next you'll want to create a Storage Account:

   New-AzureRmStorageAccount -SkuName “<"Standard_LRS,Standard_ZRS,Standard_GRS,Standard_RAGRS,Premium_LRS"> -ResourceGroupName  -Name  -Location 
   Sample: New-AzureRmStorageAccount -SkuName "Standard_LRS” -ResourceGroupName CloudLogicRG -Name clstorageacct -Location “Central US”
   

4. And finally, create a Storage Account Container:

   New-AzureStorageContainer -Name "savedfiles"
   

Setting up Automation to Export to CSV

1. Now that the foundation is established, you'll want to create a new Runbook of the type "PowerShell".
   
2. Connect to AzureRM with a Service Principal Account

   $connectionName = "AzureRunAsConnection"
   try
   {
       # Get the connection "AzureRunAsConnection "
       $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName         
   
       "Logging in to Azure..."
       Add-AzureRmAccount `
           -ServicePrincipal `
           -TenantId $servicePrincipalConnection.TenantId `
           -ApplicationId $servicePrincipalConnection.ApplicationId `
           -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint 
   }
   catch {
       if (!$servicePrincipalConnection)
       {
           $ErrorMessage = "Connection $connectionName not found."
           throw $ErrorMessage
       } else{
           Write-Error -Message $_.Exception
           throw $_.Exception
       }
   }
   

3. Select the subscription you are going to work with

   Select-AzureRmSubscription -SubscriptionId '<SubscriptionID>'
   

4. Set the Current Storage Account to the approperiate location

   Set-AzureRmCurrentStorageAccount -StorageAccountName  -ResourceGroupName 
   

5. Store O365 Credentials – For sake of clarity, we are storing the credentials in a variable. For security reasons, it is best to securely store the credentials and call them when required.

   $MSOUser = "@.onmicrosoft.com"
   $MSOPwd = ConvertTo-SecureString -String "" -AsPlainText -Force
   $MSOCred = New-Object –TypeName System.Management.Automation.PSCredential –ArgumentList $MSOUser, $MSOPwd
   

6. Connect to Office 365

   Connect-MsolService –Credential $MSOCred
   

7. Capture All MSOLUsers in a variable

   $users=get-msoluser -All
   

8. Export CSV to Local Automation Storage

   foreach ($user in $users){
       write $user
       $user | export.csv $FileName -NoTypeInformation -Append
   }
   

9. Capture the file that is local to automation and save to Storage Blob

   Set-AzureStorageBlobContent -Container savedfiles -File AutomationFile.csv -Blob SavedFile.csv
   

Notes

• The real magic is done with the very last cmdlet "Set-AzureStorageBlobContent -Container savedfiles -File AutomationFile.csv -Blob SavedFile.csv". The container should be the name of the container that you are saving the file to; in association to the Storage Account your connected to. -File is the name of the local (to the automation) file you wish to make a copy of and the -Blob will be the (new) name of the file that is created in the container.
• You can use Microsoft Storage Explorer to view the content of the storage account and download the blobs
• To download the full Automation Script please see: AzureAutomationExportCSV

Prerequisites

1. I've only tested this with PowerShell version 3.0 and later, the script may require additional modification of you are using an older version
2. MSOnline PowerShell module installed.
3. Office 365 Admin account that has the RBAC rights run access: Get-MSOLAccountSku

How To

Notes

• "Services available for this selection" indicate what plans are available for the selected SKU.
• "Services that will be disabled" list only the plans will not be available for the users. Under "initializing" you can find the plans that you selected that will be available
• If you select plans from more than a single SKU, the script will output separate sections per SKU.
• Be sure to review the number of SKUs (subscriptions) available before you attempt to license users. Its important to always plan ahead and procure enough licenses to cover to current users as well as your plans mid-term organizational growth – the last think you want to is scramble to get additional licenses at the last minute.
• If you receive an error when you execute your licensing script, be sure to review the disabled plans string (-disabledplans). In some circumstances if a plan that you are trying to keep enabled has a dependency that is being disabled, it will fail.

Introduction

Pre-requisites

Install-Package Azure

Setup

Creating the AuthToken a Function

Function GetAuthToken
    {
    param
        (
        [Parameter(Mandatory=$true)]
        $TenantName
        )
    Import-Module Azure
    $clientId = "1950a258-227b-4e31-a9cf-717495945fc2" 
    $redirectUri = "urn:ietf:wg:oauth:2.0:oob"
    $resourceAppIdURI = "https://graph.microsoft.com"
    $authority = "https://login.microsoftonline.com/$TenantName"
    $authContext = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext" -ArgumentList $authority
    $Credential = Get-Credential
    $AADCredential = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.UserCredential" -ArgumentList $credential.UserName,$credential.Password
    $authResult = $authContext.AcquireToken($resourceAppIdURI, $clientId,$AADCredential)
    return $authResult
    }

Creating the GetAllObjectOfType Function

Function GetAllObjectOfType
    {
    param
        (
        [Parameter(Mandatory=$true)]
        $Tenant,
        [Parameter(Mandatory=$true)]
        $Type,
        [Parameter(Mandatory=$false)]
        $BatchSize,
        [Parameter(Mandatory=$false)]
        $Version
        )
  
    if($BatchSize -eq $null) {$BatchSize=100}
    if($Version -eq $null) {$Version='Beta'}
    #------Get the authorization token------#
    $token = GetAuthToken -TenantName $tenant 
  
    #------Building Rest Api header with authorization token------#
    $authHeader = @{
        'Content-Type'='application\json'
        'Authorization'=$token.CreateAuthorizationHeader()
        }

    #------Initial URI Construction------#
    $uri = "https://graph.microsoft.com/$Version/$type`?top=$BatchSize"
    $ObjCapture= @()
    do{
        $users = Invoke-RestMethod -Uri $uri –Headers $authHeader –Method Get
        $FoundUsers = ($Users.value).count
        write-host "URI" $uri " | Found:" $FoundUsers
        #------Batched URI Construction------#
        $uri = $users.'@odata.nextlink'
        $ObjCapture = $ObjCapture + $users.value
       
    }until ($uri -eq $null)
    $ObjCapture
}

Execution

GetAllObjectOfType -Tenant "cloudlojik.onmicrosoft.com" -Type "Users" -BatchSize 80 | fl

PS C:\> C:\Graph.ps1
cmdlet Get-Credential at command pipeline position 1
Supply values for the following parameters:
URI https://graph.microsoft.com/Beta/Users?top=80  | Found: 80

id                             : 41cb16c4-fea6-4b78-ac78-aa67b33da8a5
deletedDateTime                : 
accountEnabled                 : True
assignedLicenses               : {}
assignedPlans                  : {}
businessPhones                 : {}
city                           : 
companyName                    : 
country                        : 
department                     : 
deviceKeys                     : {}
displayName                    : AADConnect SyncAcct
employeeId                     : 
givenName                      : AADConnect
jobTitle                       : 
mail                           : 
mailNickname                   : aadconnectsync
mobilePhone                    : 
onPremisesDomainName           : 
onPremisesImmutableId          : 
onPremisesLastSyncDateTime     : 
onPremisesProvisioningErrors   : {}
onPremisesSecurityIdentifier   : 
onPremisesSamAccountName       : 
onPremisesSyncEnabled          : 
onPremisesUserPrincipalName    : 
passwordPolicies               : None
passwordProfile                : 
officeLocation                 : 
postalCode                     : 
preferredDataLocation          : 
preferredLanguage              : 
provisionedPlans               : {}
proxyAddresses                 : {}
refreshTokensValidFromDateTime : 2017-09-05T22:43:36Z
showInAddressList              : 
imAddresses                    : {}
state                          : 
streetAddress                  : 
surname                        : SyncAcct
usageLocation                  : US
userPrincipalName              : aadconnectsync@cloudlojik.onmicrosoft.com
userType                       : Member