extension_9c0741cdf21149d1bcee83ccd513b92f_extensionAttribute9

extension_9c0741cdf21149d1bcee83ccd513b92f_extensionAttribute4

extension_9c0741cdf21149d1bcee83ccd513b92f_extensionAttribute15

extension_9c0741cdf21149d1bcee83ccd513b92f_extensionAttribute

#Get an extensionAttribute property from the 'Tenant Schema Extension App' - this will be used to check user extension properties
$ExtAttribute = (Get-AzureADApplication -SearchString "Tenant Schema Extension App" | 
                 Get-AzureADApplicationExtensionProperty | 
                 Where-Object {$_.Name -like "*extensionAttribute*"} | 
                 Select-Object -First 1).Name.Substring(0,61)

#If we have an extenstionAttribute property then proceed with the user search
if ($ExtAttribute) {

    #Get all Azure AD users
    Get-AzureADUser -All $true | ForEach-Object {

        #Variable for current user
        $User = $_.UserPrincipalName

        #Variable for extension properties
        $ExtProperties = $_.ExtensionProperty

        #Check for presence of extension attribute
        switch -Wildcard ($ExtProperties.Keys) {

            "$ExtAttribute*" {Write-Output "$User,$($_.substring(43)),$($ExtProperties.Item($_))"}

        } #end switch

    } #end foreach-object

} #end if

It's been some time,

It's been 271 days,

This feels GOOD.

This feels like...

A reacquaintance,

1. Fetched every user from MS Graph and selected the ‘UserPrincipalName’ and ‘onPremisesExtensionAttributes’ properties.
2. For each user, looped through the properties of the ‘onPremisesExtensionAttributes’ object and checked each ‘extensionAttribute’, i.e. 1 to 15.
3. When an ‘extensionAttribute’ was found to be populated, wrote the output to screen, showing the ‘UserPrincipalName’ with the ‘extensionAttribute’ and its value.

Leverage the Microsoft Graph with Azure Active Directory Identity Protection to Identify Network Threats

function Get-AzureADGraphAppToken {

    [CmdletBinding()]

    Param (
        #Target domain, e.g. contoso.com
        [Parameter(Mandatory=$false,
                   Position=0)]
        [string]$TenantDomain,

        #Client ID for app used to access graph
        [Parameter(Mandatory=$false,
                   Position=1)]
        [string]$ClientId,

        #Client secret used by app to access graph
        [Parameter(Mandatory=$false,
                   Position=2)]
        [string]$ClientSecret,

        #Switch for Azure AD graph token
        [switch]$AzureADGraph

    )
    

    #Nullify existing header
    $Header = $null
    
    if ($AzureADGraph) {

        #Azure AD Graph URL
        $Resource = "https://graph.windows.net/"

    }
    else {

        #MS Graph URL
        $Resource = "https://graph.microsoft.com"

    }

    
    #Login URL
    $LoginUrl = "https://login.microsoft.com"
    
    #Get a token
    $Body = @{grant_type="client_credentials";resource=$Resource;client_id=$ClientID;client_secret=$ClientSecret}
    $Oauth = Invoke-RestMethod -Method Post -Uri $LoginURL/$TenantDomain/oauth2/token?api-version=1.0 -Body $Body

    return $OAuth


}   #end of function



#Get a token
$OAuth = Get-AzureADGraphAppToken -TenantDomain "add_your_tenant_domain_here" `
                                  -ClientId "add_your_web_app_client_id_here" `
                                  -ClientSecret "add_your_client_secret_here_but_dont_leave_it_permanently_saved_here_at_rest"


    
#Header variable for REST call
$Header = @{'Authorization'="$($OAuth.token_type) $($OAuth.access_token)"}


#MS Graph Query
$Query = "https://graph.microsoft.com/beta/users?`$select=UserPrincipalName,onPremisesExtensionAttributes"


#Use do / while to repeat the query to fetch next 100 records
do {
    #Call REST method
    $Result = (Invoke-Restmethod -UseBasicParsing -Headers $Header -Uri $Query -Method Get)

    #For every user returned check each extension attribute for a value
    $Result.Value | ForEach-Object {

        #Variables for the current user and their attribute set
        $User = $_
        $Extensions = $User.onPremisesExtensionAttributes

        #Loop through each extension attribute and check for a value
        1..15 | ForEach-Object  {
    
            if ($Extensions."extensionAttribute$_") {
    
                #If an attribute is populated return it
                Write-Output "$($User.UserPrincipalName),extensionAttribute$_,$($Extensions."extensionAttribute$_")"

            }  

        }   

    }   
    
    $Query = $Result.'@odata.nextLink'
}
while($Query -ne $null)

• Consistently in top 3% of TechNet blogs
• Consistently over 14,000 page views per month
• Average 881 page views per day for lifetime of Blog
• 193 four star + ratings
• 332 comments
• 4 posts rated by MSDN as "Has possibly gone viral. This is full of win!"
• Associated scripts on TechNet repository have 50,000+ downloads

*one for my manager!

(Get-ChildItem Cert:\Currentuser\My\ | Select -Property SignatureAlgorithm -ExpandProperty SignatureAlgorithm).FriendlyName

Get-ADGroup -Filter {members -like "*"} -Properties members | Where-Object {$_.members.count -le 1} | Measure-Object

(Get-Acl -Path "AD:CN=Distribution Group,OU=Groups").access

#ObjectType / SchemaIdGuid
[GUID]$RyuObjectType = "d7c53242-724e-4c39-9d4c-2df8c9d66c7a" 

Get-ADObject -SearchBase (Get-ADRootDSE).SchemaNamingContext -Filter {schemaidguid -eq $RyuObjectType} -Properties LdapDisplayName,SchemaIdGuid 

#ObjectType / RightsGuid
$VboyObjectType = "ab721a55-1e2f-11d0-9819-00aa0040529b"

Get-ADObject -SearchBase (Get-ADRootDSE).ConfigurationNamingContext -Filter {(objectclass -eq "controlAccessRight") -and (rightsguid -eq $VboyObjectType)} -Properties RightsGuid,DisplayName

Use PowerShell to List Active Directory Extended Rights

Get-ADObject -SearchBase (Get-ADRootDSE).ConfigurationNamingContext -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties RightsGuid,DisplayName | ForEach-Object {

    $RightsGuid = [pscustomobject]@{

        Name = $_.Name
        RightsGuid = [GUID]$_.RightsGuid
        DisplayName = $_.DisplayName

    }

    [array]$ExtendedRightsGuids += $RightsGuid

}

$ExtendedRightsGuids

Get-ADObject -SearchBase (Get-ADRootDSE).SchemaNamingContext -LDAPFilter "(schemaidguid=*)" -Properties LdapDisplayName,SchemaIdGuid | ForEach-Object {

    $SchemaGuid = [pscustomobject]@{

        Name = $_.LdapDisplayName
        SchemaIdGuid = [GUID]$_.SchemaIdGuid

    }

    [array]$TotalGuids += $SchemaGuid

} 

$TotalGuids

Get-ADObject -SearchBase (Get-ADRootDSE).SchemaNamingContext -Filter {name -like "User"} -Properties MayContain,SystemMayContain |
Select-Object @{n="Attributes";e={$_.maycontain + $_.systemmaycontain}} | 
Select-Object -ExpandProperty Attributes |
Sort-Object

Get-ADObject -SearchBase (Get-ADRootDSE).SchemaNamingContext -ldapfilter '(systemFlags:1.2.840.113556.1.4.803:=4)' -Properties systemFlags |
Select-Object Name |
Sort-Object Name

Coming Soon

• aka/ms/cloudshell
• aka.ms/az-clidocs
• try these commands:
  • help
  • builtin help
  • az help
  • az account show

Cloud Shell Feedback