Secure Score information is available through Microsoft Graph. This means a partner can easily obtain this information for each customer. This functionality makes it possible to identify which customers have a security posture that is less than desirable. Using this information, a partner can rapidly perform a security assessment for all their customers that have Office 365 services. Also, it can be utilized to determine which customer could benefit from the following services

Microsoft Azure AD Multifactor Authentication

Microsoft Enterprise Mobility + Security

Microsoft Office 365 Advanced Threat Protection

If you would like to provide this purposed solution for your customers, then you can take advantage of the Partner Smart Office opensource project. This project leverages Azure Functions to capture Secure Score information for each customer and stores it in an instance of Azure Cosmos DB. Using this information, you can easily create Power BI reports like the following

If there is a new feature you would like for us to add to this project, then please log a request using the issue tracker. Microsoft is committed to our partners and is eager to help build new solutions. Please reach out to your account team if you would like help enhancing your Office 365 service offering.

Walkthrough

Token Management

PartnerCenter = [
    Authentication = [
        OAuth = [
            FinishLogin = FinishLogin,
            Logout = Logout,
            Refresh = Refresh,
            StartLogin = StartLogin
        ]
    ],
    Label = Extension.LoadString("DataSourceLabel")
];

// OAuth Implementation
 
FinishLogin = (context, callbackUri, state) =>
    let
        parts = Uri.Parts(callbackUri)[Query],
        result = if (Record.HasFields(parts, {"error", "error_description"})) then 
                    error Error.Record(parts[error], parts[error_description], parts)
                 else
                    TokenMethod("authorization_code", "code", parts[code])
    in
        result;
 
Logout = (token) => logout_uri;
 
Refresh = (resourceUrl, refresh_token) => TokenMethod("refresh_token", "refresh_token", refresh_token);
 
StartLogin = (resourceUrl, state, display) =>
    let
        authorizeUrl = authorize_uri & "?" & Uri.BuildQueryString([
            client_id = client_id,  
            redirect_uri = redirect_uri,
            resource = "https://api.partnercenter.microsoft.com",
            state = state,
            response_type = "code",
            response_mode = "query",
            login = "login"    
        ])
    in
        [
            LoginUri = authorizeUrl,
            CallbackUri = redirect_uri,
            WindowHeight = 720,
            WindowWidth = 1024,
            Context = null
        ];
 
TokenMethod = (grantType, tokenField, code) =>
    let
        queryString = [
            client_id = client_id,
            grant_type = grantType,
            redirect_uri = redirect_uri
        ],
        queryWithCode = Record.AddField(queryString, tokenField, code),
 
        tokenResponse = Web.Contents(token_uri, [
            Content = Text.ToBinary(Uri.BuildQueryString(queryWithCode)),
            Headers = [
                #"Content-type" = "application/x-www-form-urlencoded",
                #"Accept" = "application/json"
            ],
            ManualStatusHandling = {400} 
        ]),
        body = Json.Document(tokenResponse),
        result = if (Record.HasFields(body, {"error", "error_description"})) then 
                    error Error.Record(body[error], body[error_description], body)
                 else
                    body
    in
        result;

Paging

PC.ContinuationRequest = (relativePath as text, continuationToken as text) =>
    let 
        source = Json.Document(Web.Contents("https://api.partnercenter.microsoft.com/v1/",
            [
                Headers = [
                    #"Accept" = "application/json",
                    #"MS-ContinuationToken" = continuationToken,
                    #"MS-PartnerCenter-Application" = application_name
                ], 
                RelativePath = relativePath
            ]
        ))
    in 
        source;
 
PC.GetPagedResources = (relativePath as text) => 
    let
        GetResources = 
            (relativePath as text) as record =>
            let
                data = PC.Request(relativePath),
                items = try data[items] otherwise null, 
                next = try data[links][next] otherwise null,
                res = [Items = items, Next = next]
            in 
                res,
 
        GetResourcesContinuation = 
            (nextData) as record =>
            let
                relativePath = nextData[uri],
                data = PC.ContinuationRequest(relativePath, nextData[headers]{0}[value]),
                items = try data[items] otherwise null, 
                next = try data[links][next] otherwise null,
                res = [Items = items, Next = next]
            in 
                res,
 
        resourcesList = 
            List.Generate(
                () => [result = GetResources(relativePath)], 
                each [result][Items] <> null, 
                each [result = GetResourcesContinuation([result][Next])],
                each [result][Items])
    in
        resourcesList;
 
PC.Request = (relativePath as text) =>
    let 
        source = Json.Document(Web.Contents("https://api.partnercenter.microsoft.com/v1/",
            [
                Headers = [
                    #"Accept" = "application/json",
                    #"MS-PartnerCenter-Application" = application_name
                ], 
                ManualStatusHandling = {400},
                RelativePath = relativePath
            ]
        ))
    in 
        source;

PC.Customers = () =>
    let
        customersList = PC.GetPagedResources("customers"), 
        customersListTable = Table.FromList(customersList, Splitter.SplitByNothing(), null, null, ExtraValues.Error),
        customersRecordTable = Table.ExpandListColumn(customersListTable, "Column1"),
        customersTable = Table.ExpandRecordColumn(customersRecordTable, "Column1", {"companyProfile", "relationshipToPartner"}, {"companyProfile", "relationshipToPartner"}),
        customersInfoTable = Table.ExpandRecordColumn(customersTable, "companyProfile", {"tenantId", "domain", "companyName"}, {"tenantId", "domain", "companyName"})
    in
        customersInfoTable;

Outcome

Partner Center

Partner Center API

Restrictions

Integration Sandbox

Regional Authorization

1. The customer will not have access to the newly created Azure AD tenant until the entire provisioning process has been completed. Since they will not have access, yet, the company administrator is unable to consent to the application utilized to access the ARM API and Microsoft Graph. This will prevent you from being able to deploy the solution into the customer’s Azure subscription, and the portal will not be able to access the Microsoft Graph on the customer's behalf.
2. While it is possible to perform an admin consent it is difficult to ensure each customer has performed the operation and that it was done correctly.

In order to help Cloud Solution Provider partners who find themselves in this type of scenario I have put together the HEX Migration Toolkit. It is a web portal protected by Azure AD authentication that enables individuals from a customer to add new environments to be migrated and create migration batches. When a migration batch is created the customer has to specify a date for when the batch migration should start. This enables the customer to schedule the cutover migration. This toolkit is an open source project that only has community based support. Additional functionality will be added to this tool over time, but I wanted to take this opportunity to introduce it and allow partners to provide feedback through the issue tracker.

Whenever a user logins into the portal the necessary validation tasks are performed to verify the authenticating user belongs to a customer that has a relationship with the configured partner, and that the user has the necessary privileges to access this portal (these privileges are configurable by the partner when the solution is implemented). After the user has successfully authenticated they can create new environments or manage existing ones.

When an environment is created the toolkit will enqueue a request to create a migration endpoint in Exchange Online and request a list of mailboxes from the configured endpoint. All of this is accomplished by an Azure WebJob that leverages PowerShell Remoting to perform the specified tasks. It worth noting that the customer will not need to enter Office 365 details at this point because the partner should have already provisioned the appropriate Office 365 subscription for the customer, and the partner has delegated administrative privileges over the tenant which enables this toolkit to perform operations in Exchange Online on the customers behalf. Since credentials for the customer’s environment are required to perform additional operations it is vital that those credentials be protected. In order to provide the proper protection all passwords are stored in an instance of Azure Key Vault. Key Vault utilizes hardware security modules to protect this sensitive information.

Since there is a chance new mailboxes might be added after the creation of the environment the ability to refresh an environment is important. When a customer clicks on the Refresh link the toolkit will ensure the migration endpoint has been created and request a complete list of the current mailboxes from the configured endpoint. When a customer clicks on the Delete link it will delete all migration batches and the environment information from the toolkit. When a customer clicks on the Batches link they will be taken to page that allows them to create, delete, and view existing migration batches.

When a new migration batch is added the customer must select which mailboxes they would like to be a member of the batch. Currently the ability to modify members of a batch after it has been created is not supported.

It is recommended that the value for the target delivery domain be set to the [tenant-name].mail.onmicrosoft.com. Be sure to replace the tenant-name value with the appropriate value based on the customer Azure AD tenant. As an example if the customer’s Azure AD tenant is fabrikam.onmicrosoft.com then the target delivery domain value should be configured to fabrikam.mail.onmicrosoft.com.

If you would like information on how to deploy this project then checkout the deployment documentation. Additional functionality will be added to the toolkit overtime. There are certain elements that I have already identified, such as reporting, that needs to be added in order to make this a more complete solution. If you would like to utilize this toolkit prior toolkit before I can get reporting added you can leverage Power BI to construct the reports that you need. Since this toolkit utilizes Azure storage tables to store all migration details (except credentials) you can easily construct any report that you see fit.

The open source project, Partner Center Bot, demonstrates how to leverage the Microsoft Bot Framework to construct a bot that interacts with the Partner Center API. Most customers want the ability to resolve issues on their own, and this project provides a tool that can help fulfill that desire. The intent of this project is not to provide a fully functional bot, but rather to demonstrate how this technology can be utilized to support customers. This initial release has limited features such as the ability to list customers and subscriptions, and answer commonly asked questions through integration with the QnA Maker service. Additional abilities will be added over time. It is worth mentioning that this project includes a framework that makes it simple to add additional features in a secure manner.

In the event there is a feature you would like to see added to the project then please log a feature request here. If you are interested in learning more I would recommend that you check out Deploying and Adding New Features to the bot.

Azure Utilization Records

Prerequisites

Website Name

Web Portal Azure AD Application

1. Browse to the Azure Management portal, https://portal.azure.com, and login using credentials that have global admin privileges
2. Open the Azure AD management experience and then click on App registrations –> Add
3. Complete the new application wizard. The value for the Sign-on URL should match the value you would like to use for the websiteName parameter
4. Document the Application ID value it will be the webPortalClientId
5. Click Required permissions, then click Windows Azure Active Directory (Microsoft.Azure.Active.Directory), and add the Access the directory as the signed-in user permission
6. Click on Keys, specify a description, select an appropriate expiration and then click Save
7. Document the key value, that is displayed after you click Save. This value will be the webPortalClientSecret

Partner Center Azure AD Application

1. Browse to Partner Center, https://partnercenter.microsoft.com, and login using credentials that have admin agent and global admin privileges
2. Click on the following Dashboard –> Account Settings –> App Management
3. Click Add new web app to create the application
4. Document the following values

   Field	Values
   App ID	partnerCenterApplicationId
   Account ID	webPortalAadTenatId and partnerCenterAadTenantId
   Key	partnerCenterApplicationSecret

   

Deploying using Visual Studio

1. Right click on the CustomerPortal solution in the Solution Explorer and then click Restore NuGet Packages
2. Right click on the CustomerPortal.Deployment project then click on Deploy –> New…
3. Complete the Deploy to Resource Group wizard and then click Ok
4. Modify the parameters accordingly in the Edit Parameters wizard and then click Save
5. Review the data in the Output window to confirm the storefront was successfully deployed. Please note this could take a couple of minutes.

Configuring the Storefront

1. Browse to the website (e.g. https://websiteName.azurewebsites.net) and login using credentials that belong to the CSP partner that have global admin privileges
2. Complete each of the configuration steps for the storefront to be functional. The storefront will display a message stating it is under construction until all three configuration tasks have been completed