Dominique VIVES

Host and run your PowerShell scripts in Azure

Dominique Vives [MSFT] — Mon, 02 Jul 2018 23:15:28 GMT

Few days ago, I was working with one of my customer. I advised him to host his O365 scripts in Azure instead using a local server. In this post, I would like to share why I recommended this to my customer and what solutions we've identified for hosting PowerShell script in Azure.

Why in my opinion, Azure is the best companion for executing O365 PowerShell scripts (or code)?

First, Azure services SLAs guarantee that your script will run 99.9xxx% of times. Usually, it's hard to provide such level of services on a local server. It may require a big investment for few scripts execution time mostly without any SLA and without service guarantee. You may also need, to open some ports, to configure a proxy, to harden your server security, to configure some antivirus, and to maintain your local server. In Azure, most services allow you to only focus on your PowerShell script because all the infrastructure, the SLAs and security is taken care by Microsoft. You only pay for what you consume in Azure. Some services presented below might be less expensive than running a local server which is consuming power supply all day long. To finish, when hosting your scripts in Azure may rely on all other Azure services (SQL, Big Data, Data Factory etc) and get some flexibility for any scripts improvements or complexity.

Services in Azure for hosting and executing PowerShell

Via a Azure VM :
- Overview: https://azure.microsoft.com/en-us/services/virtual-machines/
- Pricing: https://azure.microsoft.com/en-us/pricing/details/virtual-machines/windows/
- Usage : I recommend to only use this solution for migration project or script development.

Via Azure Function App :
- Overview: https://azure.microsoft.com/en-us/services/functions/
- Pricing: https://azure.microsoft.com/en-us/pricing/details/functions/
- You may rely on the below procedure to create une Azure Function running PowerShell :
  - https://docs.microsoft.com/en-us/sharepoint/dev/declarative-customization/site-design-pnp-provisioning#create-the-azure-function
- Note: PowerShell language is experimental in Azure Function. That's why I do not recommend this services for production use yet.

Via Azure Automation account (recommended solution):
- Overview: https://docs.microsoft.com/en-us/azure/automation/automation-intro
- Tarification : https://azure.microsoft.com/en-us/pricing/details/automation/
- Blog : https://blogs.technet.microsoft.com/dominiquevives/2018/05/11/azure-automation-for-spo-tasks/
- Note: This so

Via Azure Web Jobs (in Azure App Services) :
- Overview: https://azure.microsoft.com/en-us/pricing/details/app-service/windows/
- Pricing: https://azure.microsoft.com/en-us/pricing/details/app-service/windows/
- Procedure : Exécuter des tâches en arrière-plan avec WebJobs dans Azure App Service - en-ushttps://docs.microsoft.com/fr-fr/azure/app-service/web-sites-create-web-jobs

Consume SPO REST API in PowerShell with ACS App Only Credentials

Dominique Vives [MSFT] — Thu, 21 Jun 2018 23:00:34 GMT

I was working with customer who wanted to quickly test his App permissions. He first created the App Credentials (Client ID & Client Secret) via https://tenant.sharepoint.com/sites/yoursite/_layouts/15/appregnew.aspx page.

Then it gave it some permissions via the https://tenant.sharepoint.com/sites/yoursite/_layouts/15/appinv.aspx page.

After having created his App, my customer did save its client ID and client secret but didn't save its permissions . He wanted a simple way to check the App permissions and scope : "Scope="https://sharepoint/content/sitecollection" Right="Read". I proposed him to use the following PowerShell script, which consume SPO REST API via the App credentials :


	####################################################################################
	#This script is provided as an example. It must not be used in Production environment.
	#It shows how to obtain a Token to log into the Graph API. The token must be acquired once
	#and then stored on the server. Everytime the Graph API is used, it is refreshed before
	#being used.
	####################################################################################

	Import-Module SharePointPnPPowerShellOnline

	Connect-PnPOnline https://<your-tenant>.sharepoint.com/sites/<your-site> -AppId <your_client_id> -AppSecret <your_client_secret>
	$PnPAccessToken = Get-PnPAppAuthAccessToken \| Clip

	$uri = "https://.sharepoint.com/sites//_api/web/lists/getbytitle('Documents')"

	$contentType = 'application/json;odata=verbose'
	$Headers = @{}
	[Microsoft.PowerShell.Commands.WebRequestMethod]$Method = [Microsoft.PowerShell.Commands.WebRequestMethod]::Get
	$Headers["Accept"] = "application/json;odata=verbose"
	$Headers.Add('Authorization','Bearer ' + $PnPAccessToken)
	$Body = $null


	Invoke-RestMethod -Method $Method -Uri $Uri -ContentType $contentType -Headers $Headers -Body $Body

Indeed, you can modify the REST API : ex: "_api/web/title" to get the title of the spweb and only check the permissions at the Web level. As you can see this script rely on PnP PowerShell module.

install it directly in PowerShell :

Install-Module SharePointPnPPowerShellOnline -SkipPublisherCheck -AllowClobber

install it via an executable file :

https://github.com/SharePoint/PnP-PowerShell/releases

Note: The above script won't work with AAD App Only credentials. You may use the following script for App declared in AAD (and not in ACS).

#####################################################################################This script is provided as an example. It must not be used in Production environment.#It shows how to obtain a Token to log into the Graph API. The token must be acquired once#and then stored on the server. Everytime the Graph API is used, it is refreshed before#being used.####################################################################################

Import-Module SharePointPnPPowerShellOnline

#Connect-PnPOnline

$arrayOfScopes = @("Reports.Read.All")

$ConnectPnPGraph = Connect-PnPMicrosoftGraph -Scopes $arrayOfScopes

$PnPAccessToken = Get-PnPAccessToken

$uri = "https://graph.microsoft.com/beta/" + "/reports/SharePointActivity(view='Detail',period='D7')/content"

# $authHeader = @{

# 'Content-Type'='application\json'

# 'Authorization'= $PnPAccessToken

# }

Invoke-RestMethod -Uri $uri -Headers @{Authorization = "Bearer $PnPAccessToken"}

Leverage Azure Automation for SPO Administration Tasks - Part 1

Dominique Vives [MSFT] — Fri, 11 May 2018 07:58:33 GMT

Today, I worked on a quick demo for one of my customer on how to use Azure Automation for SharePoint Online administration tasks. In this demo, I will run a sample PowerShell Script (available in the Gallery) to list all SPO sites that I will customize. I will also upload the SharePoint Online Module required to execute the PowerShell script in Azure Automation. In the "Part 2" of the script, I will use PnP Module to go further in task. First create a Azure Automation account : [caption id="attachment_105" align="aligncenter" width="451"] Create Azure Automation Account[/caption] Then browse the gallery to find an existing scripts: Once the sample script is imported, Edit & Publish it: As you may have noticed, this script required some parameters but also used SPO cmdlets available in the SPO official PowerShell module. So we will upload the required module and create a the credential variable for the script execution in the next steps. First zip your SharePoint PowerShell Module on your local machine. To identify your SPO module location, use the following command :

Get-Module -ListAvailable

Then zip your module folder :

Go to your Azure Automation Account, then go into the module menu: Add the Zip Module. Click Ok twice. You should see your module imported after few minutes. Now the SPO Module is imported and available, let's focus on the PSCredName script parameter. This parameter actually refer the a PSCredential object stored in the specific menu of the Azure Automation. To define this parameter, go into the "Credentials" Menu of your Automation account and click on "Add Credential". Note the Credential Name "SPOAdmin" as it will be required in the next steps. It's time to play with our sample script. In the "Run Book" menu, click on your "Display-AllSites", then select "Edit" and click on "Test Pane" in the horizontal menu. You should land on the following screen : Now, specify your SPO Admin URL (https://yourtenant-admin.sharepoint.com) and specify the credential name created above ("SPOAdmin") in the "PSCredName" parameter. You should see as above, all your existing sites. Now that the script run correctly, you may schedule this script to run on a regular basis. To do so, just go into your Run Book "Display-AllSites" and select "Schedules" to define a new schedule with the parameter above. Define your frequency : Specify the parameter as tested above : Then click OK. Now your SPO PowerShell script should run automatically on your scheduled frequency thanks to Azure Automation.

Quick introduction of myself

Dominique Vives [MSFT] — Wed, 18 Apr 2018 14:17:57 GMT

Dominique VIVES, I'm 33 years old and I work at Microsoft for 7 years in Paris. Before joining MS, I worked for Orange Business Services as SharePoint Architect for 4 years. When I joined MS, I started at Customer Services Support as a "SharePoint Support Engineer" for 2 Years. Then I evolved to a "Support Escalation Engineer" role for 2 years where I was helping customers on-boarding on SharePoint Online, Yammer and OneDrive. Since three years, I decided to meet our customers and move to a "Premier Field Engineer" role on O365. I mostly assist them on collaboration workloads (SPO, Teams, O365 Groups, Yammer & OneDrive) by providing "Best Practices", delivering workshops or auditing/assessing customers services or helping on-boarding new O365 features. I'm also helping some of my customers on developments projects or POC (Client Side Web Parts, SharePoint Framework, Site provisioning solutions, Development Migration etc). Because Azure is the best companion for O365, I also work on Azure on different topics (ARM templates, Azure Function, Azure Automation, Azure CDN).