If we are to assign users to a Saas App: Prepare a CSV with user UPNs populated in a single column headed: UserPrincipalName. If we are to assign groups to a Saas App: Prepare a CSV with group ObjectID’s populated in a single column headed: ObjectID. Assign a single User/Group access to the SaaS app via the Azure Portal.

How To:

Install-Module -Name AzureAD

Bulk Assignment PowerShell Module

Import-Module c:\path\bulkSaaSAppAssignment.psm1

Obtain the details of the SaaS Application we would like to assign users permissions to

Connect-AzureAD

Get-AzureADServicePrincipal -SearchString "salesforce" | fl displayname, objectid

DisplayName : Salesforce ObjectId    : a119cf6c-1ea1-4447-a160-b195ba36efb7

Obtain information about the RoleID for the assignment operation

Get-RoleID -UserPrincipalName first.last@contoso.com -ObjectID a119cf6c-1ea1-4447-a160-b195ba36efb7

The RoleID is: 073e08e5-5451-4628-82e6-15a9aa569e7c

The RoleID is: 00000000-0000-0000-0000-000000000000 RoleID does not need to be specified for this user-application assignment.

Get-GroupRoleID -Group "group objectID" -ObjectID a119cf6c-1ea1-4447-a160-b195ba36efb7

Assigning Access

Bulk assign access to Users:

New-AzureADBulkUserAppAssignment -File "Path to CSV" -ObjectID a119cf6c-1ea1-4447-a160-b195ba36efb7 -RoleID 073e08e5-5451-4628-82e6-15a9aa569e7c

Bulk assign access to Groups

New-AzureADBulkGroupAppAssignment -File "Path to CSV" -ObjectID b9c12220-93af-433b-89dc-f441e79f2470

Bulk remove access to Users

Remove-AzureADBulkUserAppAssignment -File "Path to CSV" -ObjectID a119cf6c-1ea1-4447-a160-b195ba36efb7

Bulk remove access to Groups

Remove-AzureADBulkGroupAppAssignment -File "Path to CSV" -ObjectID b9c12220-93af-433b-89dc-f441e79f2470

"Your Organization does not allow you to change your password on this site. Please change your password according to the method recommended by your organization, or ask your admin if you need help"

Obtain ApplicationID for Visual Studio Online {Login to AAD Connected to VSO}

Connect-MsolService

Get-MsolServicePrincipal -ServicePrincipalName Microsoft.VisualStudio.Online

Create Invite CSV

Sample CSV file

Email,DisplayName,InviteAppID,InviteReplyUrl,InviteAppResources,InviteGroupResources,InviteContactUsUrl
wharp@contoso.com,Walter Harp,cd3ed3de-93ee-400b-8b19-b61ef44a0f29,https://azure.microsoft.com/services/active-directory/,,,https://azure.microsoft.com/services/active-directory/
jsmith@contoso.com,Jeff Smith,cd3ed3de-93ee-400b-8b19-b61ef44a0f29,https://azure.microsoft.com/services/active-directory/,,,https://azure.microsoft.com/services/active-directory/
bsmith@contoso.com,Ben Smith,cd3ed3de-93ee-400b-8b19-b61ef44a0f29,https://azure.microsoft.com/services/active-directory/,,,https://azure.microsoft.com/services/active-directory/

Invite User Accounts

1. Login to Azure Management Portal
2. Select Active Directory > Choose Directory that is linked to VSO > Users > Add
3. Select “Users in Partners Companies” and upload CSV File that you created previously.

End User Experience

Add Users to Visual Studio Online Collection Group

1. Login to VSO Admin Portal, Click Settings Cog > Select Collection > Security > “Project Collection Administrators” > Members > Add

• Microsoft Health is an open cloud-based service that helps you live a healthier lifestyle by providing actionable insights based on data gathered from the fitness devices and apps that you use every day. It is designed to work with you, no matter what phone or service you use.  We’ve got some great partnerships including Runkeeper, MyFitnessPal, MapMyFitness, Microsoft Health Vault and in the U.K., we have an exciting partnership with Nuffield Health who are leaders in fitness and wellbeing.  Find out more
• Microsoft Band is the first device powered by Microsoft Health. Live healthier by tracking your heart rate, calorie burn and sleep quality alongside comprehensive fitness features such as on-board GPS for run and cycle tracking.  It also includes Guided Workouts, which is like having a personal trainer on your wrist.   In addition, the Microsoft Band helps you be more productive with calendar alerts, email previews and access to Cortana with Windows Phone³.   And to make it easy to get up and running, the Microsoft Band works with the phone you already own; Windows, iOS and Android.  Find out more here.

1. Evangelize the top pillars for Microsoft Health and Microsoft Band: 

• Follow @MicrosoftBand on Twitter and Like www.Facebook.com/MicrosoftBand
• Go and tell your friends and more information can be found at Microsoft Band

2. Developers should check out the SDK Preview

1. An Account Administrator will become the Account Administrator of each subscription they create and be the initial Service Administrator.
2. It is good practice to ensure that your Account Administrators are 'Service Accounts' as oppose to Individuals so I would recommend you creating 3 service accounts

• Your users get a faster sign-in experience free of extra hops.
• The sign-in user experience includes several new features. Examples are the ability to maintain multiple actively signed-in users and a more responsive UI that behaves appropriately across more devices and screens.
• We can enable a number of features in our engineering systems that will lead to an even more reliable service.

• Applications that send requests to https://login.windows.net will continue to be supported. The redirect to https://login.microsoftonline.com will occur earlier in the authentication flow than before, and will maintain protocol consistency. For example, OAuth2 authorization requests will now redirect to https://login.microsoftonline.com/common/oauth2/authorize rather than https://login.microsoftonline.com/login.srf.
• Any tokens issued, errors displayed or errors reported will now come from https://login.microsoftonline.com.
• The HTML markup and scripts for the new sign-in experience are significantly different even though the visual appearance may be the same. Any tests that rely on exact markup may break and need to be updated.
• The discovery endpoint https://login.windows.net/contoso.com/.well-known/openid-configuration will continue to return legacy https://login.windows.net based endpoints. Those endpoints will then follow the appropriate redirects. The new discovery endpoint https://login.microsoftonline.com/contoso.com/.well-known/openid-configuration will return equivalent https://login.microsoftonline.com endpoints.

• The behavior of both token endpoints will remain precisely the same.
• The value of the "issuer" both in metadata and in tokens issued by Azure AD will remain the same – it will continue to be https://sts.windows.net/ based.

Connect-MsolService

Confirm-MsolDomain -DomainName contoso.com

Power Bi Individual Signup

1. open a support incident with Microsoft and ask them to perform an Account Admin Ownership Transfer which updates you billing account admin & service admin and also changes the default directory associated to the subscription to be your existing directory.
2. Follow the article that have written last year, although I personally would recommend you remove the MSA from the equation altogether and do it properly! :-) https://www.edutech.me.uk/microsoft/identity-and-access-management/active-directory/link-microsoft-office-365-organization-account-to-windows-azure-subscription/

https://graph.windows.net/tenant.onmicrosoft.com/servicePrincipals?api-version=1.5

"objectId": "2f37a4ce-893f-4392-b4ae-e0df9fbfe365",

"appRoles": [ { "allowedMemberTypes": [ "User" ], "description": "msiam_access", "displayName": "msiam_access", "id": "d84db298-28e2-4b2c-ab52-e70012cbabbf", "isEnabled": true, "value": null } ],

Import-Module c:scriptsGraphAddUserToApplication.psm1

Load-ActiveDirectoryAuthenticationLibrary

$global:authenticationResult = Get-AuthenticationResult

$csv = Import-CSV C:ScriptsAADUser.csv | % {$user = get-aaduser -Id $_.UserPrincipalName;Set-AppRoleAssignments -userId $user.Objectid}

The Module (functions) Explained!.... 

function Load-ActiveDirectoryAuthenticationLibrary(){
  $moduleDirPath = [Environment]::GetFolderPath("MyDocuments") + "WindowsPowerShellModules"
  $modulePath = $moduleDirPath + "AADGraph"
  if(-not (Test-Path ($modulePath+"Nugets"))) {New-Item -Path ($modulePath+"Nugets") -ItemType "Directory" | out-null}
  $adalPackageDirectories = (Get-ChildItem -Path ($modulePath+"Nugets") -Filter "Microsoft.IdentityModel.Clients.ActiveDirectory*" -Directory)
  if($adalPackageDirectories.Length -eq 0){
    Write-Host "Active Directory Authentication Library Nuget doesn't exist. Downloading now ..." -ForegroundColor Yellow
    if(-not(Test-Path ($modulePath + "Nugetsnuget.exe")))
    {
      Write-Host "nuget.exe not found. Downloading from https://www.nuget.org/nuget.exe ..." -ForegroundColor Yellow
      $wc = New-Object System.Net.WebClient
      $wc.DownloadFile("https://www.nuget.org/nuget.exe",$modulePath + "Nugetsnuget.exe");
    }
    $nugetDownloadExpression = $modulePath + "Nugetsnuget.exe install Microsoft.IdentityModel.Clients.ActiveDirectory -Version 2.14.201151115 -OutputDirectory " + $modulePath + "Nugets | out-null"
    Invoke-Expression $nugetDownloadExpression
  }
  $adalPackageDirectories = (Get-ChildItem -Path ($modulePath+"Nugets") -Filter "Microsoft.IdentityModel.Clients.ActiveDirectory*" -Directory)
  $ADAL_Assembly = (Get-ChildItem "Microsoft.IdentityModel.Clients.ActiveDirectory.dll" -Path $adalPackageDirectories[$adalPackageDirectories.length-1].FullName -Recurse)
  $ADAL_WindowsForms_Assembly = (Get-ChildItem "Microsoft.IdentityModel.Clients.ActiveDirectory.WindowsForms.dll" -Path $adalPackageDirectories[$adalPackageDirectories.length-1].FullName -Recurse)
  if($ADAL_Assembly.Length -gt 0 -and $ADAL_WindowsForms_Assembly.Length -gt 0){
    Write-Host "Loading ADAL Assemblies ..." -ForegroundColor Green
    [System.Reflection.Assembly]::LoadFrom($ADAL_Assembly[0].FullName) | out-null
    [System.Reflection.Assembly]::LoadFrom($ADAL_WindowsForms_Assembly.FullName) | out-null
    return $true
  }
  else{
    Write-Host "Fixing Active Directory Authentication Library package directories ..." -ForegroundColor Yellow
    $adalPackageDirectories | Remove-Item -Recurse -Force | Out-Null
    Write-Host "Not able to load ADAL assembly. Delete the Nugets folder under" $modulePath ", restart PowerShell session and try again ..."
    return $false
  }
}

function Get-AuthenticationResult($tenant = "common", $env="prod"){
  $clientId = "1950a258-227b-4e31-a9cf-717495945fc2"
  $redirectUri = "urn:ietf:wg:oauth:2.0:oob"
  $resourceClientId = "00000002-0000-0000-c000-000000000000"
  $resourceAppIdURI = "https://graph.windows.net/"
  $authority = "https://login.windows.net/" + $tenant
  if($env.ToLower() -eq "china"){$resourceAppIdURI = "https://graph.chinacloudapi.cn/"; $authority = "https://login.chinacloudapi.cn/" + $tenant}
  $authContext = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext" -ArgumentList $authority,$false
  $authResult = $authContext.AcquireToken($resourceAppIdURI, $clientId, $redirectUri, [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Always)
  return $authResult
}

function Get-AADObject([string]$type) {
  $objects = $null
  if($authenticationResult -ne $null){
    $header = $authenticationResult.CreateAuthorizationHeader()
    $uri = [string]::Format("https://graph.windows.net/{0}/{1}?api-version=2013-04-05",$authenticationResult.TenantId, $type)
    Write-Host HTTP GET $uri -ForegroundColor Cyan
    $result = Invoke-RestMethod -Method Get -Uri $uri -Headers @{"Authorization"=$header;"Content-Type"="application/json"}
    if ($result -ne $null) {
      $objects = $result.Value
    }
  }
  else{
    Write-Host "Not connected to an AAD tenant. First run Connect-AAD." -ForegroundColor Yellow
  }
  return $objects
}

function Get-AADObjectById([string]$type, [string]$id) {
  $object = $null
  if($global:authenticationResult -ne $null){
    $header = $authenticationResult.CreateAuthorizationHeader()
    $uri = [string]::Format("https://graph.windows.net/{0}/{1}/{2}?api-version=2013-04-05",$authenticationResult.TenantId, $type.Trim(), $id.Trim())
    Write-Host HTTP GET $uri -ForegroundColor Cyan
    $object = Invoke-RestMethod -Method Get -Uri $uri -Headers @{"Authorization"=$header;"Content-Type"="application/json"}
  }
  else{
    Write-Host "Not connected to an AAD tenant. First run Connect-AAD." -ForegroundColor Yellow
  }
  return $object
}

function Get-AADUser {
  [CmdletBinding()]
  param (
    [parameter(Mandatory=$false,
    ValueFromPipeline=$true,
    HelpMessage="Either the ObjectId or the UserPrincipalName of the User.")]
    [string]
    $Id
  )
  PROCESS {
    if($Id -ne "") {
      Get-AADObjectById -Type "users" -Id $id
    }
    else {
      Get-AADObject -Type "users"
    }
  }
}

function Set-AppRoleAssignments($userID) {
  $objects = $null
  if($authenticationResult -ne $null){
    $header = $authenticationResult.CreateAuthorizationHeader()
    $uri = [string]::Format("https://graph.windows.net/{0}/users/{1}/appRoleAssignments?api-version=1.5",$authenticationResult.TenantId, $userID)

#ResourceId is the objectId of the application servicePrincipal that get created in the tenant in the previous command.#
#ID is the default role id of SaaS Application. The value is d84db298-28e2-4b2c-ab52-e70012cbabbf in all tenants.########
#PrincipalId is the objectId of the principal (user or group) that is being assigned to the app.###################
#You need to replace the ID and Resource ID in the 'Body'##########################################################

$body = @"
{
    "id":  "d84db298-28e2-4b2c-ab52-e70012cbabbf",
    "principalId":  "$userID",
    "resourceId":  "2f37a4ce-893f-4392-b4ae-e0df9fbfe365"
}
"@

    Write-Host HTTP GET $uri -ForegroundColor Cyan
    $result = Invoke-RestMethod -Method Post -Uri $uri -Headers @{"Authorization"=$header;"Content-Type"="application/json"} -Body $Body
    if ($result -ne $null) {
      $objects = $result.Value
    }
  }
  else{
    Write-Host "Not connected to an AAD tenant. First run Connect-AAD." -ForegroundColor Yellow
  }
  return $objects
}

Connect-Service [-All Services -AzureAD -Exchange -Lync -SharePoint]

Function Connect-Service{
param(
[Parameter(ParameterSetName='IndividualService')][switch]$AzureAD,
[Parameter(ParameterSetName='IndividualService')][switch]$Exchange,
[Parameter(ParameterSetName='IndividualService')][switch]$Lync,
[Parameter(ParameterSetName='IndividualService')][switch]$SharePoint,
[Parameter(ParameterSetName='AllServices')][switch]$AllServices
)

switch ($psCmdlet.ParameterSetName){
'IndividualService' {
if (!($AzureAD -or $Exchange -or $Lync -or $SharePoint)){
throw("You must choose at least one service to connect to. Run Get-Help Connect-Service to see available parameters")
}
}

'AllServices'{}

default {throw("You must choose at least one service to connect to. Run Get-Help Connect-Service to see available parameters")}
}

#Gather credentials
#==================
Write-Host "Gathering installed modules. Please wait...." -ForegroundColor Cyan
$Modules = Get-Module -ListAvailable -Refresh
Write-Host ""
Write-Host "Please Enter your Azure Active Directory credentials into the popup window" -ForegroundColor Yellow
$UserCredentials = Get-Credential -Message "Please enter your Azure AD credentials"

#Validate username is of UPN format
#==================================
if ($UserCredentials.UserName -notmatch '.*@.*'){
throw("Username must be entered in UserPrincipalName format (i.e. admin@contoso.onmicrosoft.com). Please re-run this function and try again")
}

#Connect to SharePoint
#=====================
if ($SharePoint -or $AllServices){
if (($Modules | Select-Object -ExpandProperty Name) -contains 'Microsoft.Online.SharePoint.PowerShell'){
$SPOTenant = Read-Host -Prompt "Please enter the SharePoint admin url (i.e. https://contoso-admin.sharepoint.com)"
Write-Host "Logging into SharePoint Online" -ForegroundColor Cyan
Import-Module Microsoft.Online.SharePoint.PowerShell
Connect-SPOService -Url $SPOTenant -Credential $UserCredentials
} else {
Write-Warning "Could not connect to SharePoint. Microsoft.Online.SharePoint.PowerShell module is not installed"
}
}

#Connect to Azure AD
#===================
if ($AzureAD -or $AllServices){
if (($Modules | Select-Object -ExpandProperty Name) -contains 'MSOnline'){
Write-Host "Logging into Azure AD" -ForegroundColor Cyan
Import-Module MSOnline
Connect-MSOLService -Credential $UserCredentials
} else {
Write-Warning "Could not connect to Azure AD. MSOnline module is not installed"
}
}

#Connect to Exchange
#===================
if ($Exchange -or $AllServices){
Write-Host "Logging into Exchange Online" -ForegroundColor Cyan
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredentials -Authentication Basic -AllowRedirection
if ($Session -ne $null){
Import-PSSession $Session
} else {
Write-Warning "Unable to connect to Exchange Online. Please check credentials, and that you have admin privileges to Exchange service"
}
}

#Connect to Lync
#===============
if ($Lync -or $AllServices){
if (($Modules | Select-Object -ExpandProperty Name) -contains 'LyncOnlineConnector'){
Write-Host "Logging into Lync Online" -ForegroundColor Cyan
Import-Module LyncOnlineConnector
$Session = New-CsOnlineSession -Credential $UserCredentials
if ($Session -ne $null){
Import-PSSession $Session
} else {
Write-Warning "Unable to connect to Lync Online. Please check credentials, and that you have admin privileges to Exchange service"
}
} else {
Write-Warning "Could not connect to Lync. LyncOnlineConnector module is not installed"
}
}

}

In the Office 365 Administration Portal if you click on Purchase Services you will now find Azure AD Premium is available to purchase and is payable on a per user, per month basis.

All of those amazing new features that are only available to users whom have an Azure AD Premium License can now have access to this instantly by purchasing a license as per above.

I hope that this allows you to adopt and use the great features that are available as part of the Premium License!

If you have any questions let me know,

Thanks

James.