msgraph-training-java/app-auth/RegisterAppForAppOnlyAuth.ps1 at main · microsoftgraph/msgraph-training-java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT license.

# <ScriptBody>
param(
 [Parameter(Mandatory=$true,
HelpMessage="The friendly name of the app registration")]
 [String]
$AppName,

 [Parameter(Mandatory=$true,
HelpMessage="The application permission scopes to configure on the app registration")]
 [String[]]
$GraphScopes,

 [Parameter(Mandatory=$false)]
 [Switch]
$StayConnected=$false
)

$graphAppId="00000003-0000-0000-c000-000000000000"

# Requires an admin
Connect-MgGraph-Scopes "Application.ReadWrite.All AppRoleAssignment.ReadWrite.All User.Read"-UseDeviceAuthentication -ErrorAction Stop

# Get context for access to tenant ID
$context=Get-MgContext-ErrorAction Stop
$authTenant=$context.TenantId

# Create app registration
$appRegistration=New-MgApplication-DisplayName $AppName-SignInAudience "AzureADMyOrg"-ErrorAction Stop
Write-Host-ForegroundColor Cyan "App registration created with app ID"$appRegistration.AppId

# Create corresponding service principal
$appServicePrincipal=New-MgServicePrincipal-AppId $appRegistration.AppId-ErrorAction SilentlyContinue `
-ErrorVariable SPError
if ($SPError)
{
Write-Host-ForegroundColor Red "A service principal for the app could not be created."
Write-Host-ForegroundColor Red $SPError
Exit
}

Write-Host-ForegroundColor Cyan "Service principal created"

# Lookup available Graph application permissions
$graphServicePrincipal=Get-MgServicePrincipal-Filter ("appId eq '"+$graphAppId+"'") -ErrorAction Stop
$graphAppPermissions=$graphServicePrincipal.AppRoles

$resourceAccess=@()

foreach($scopein$GraphScopes)
{
$permission=$graphAppPermissions|Where-Object { $_.Value-eq$scope }
if ($permission)
 {
$resourceAccess+=@{ Id=$permission.Id; Type="Role"}
 }
else
 {
Write-Host-ForegroundColor Red "Invalid scope:"$scope
Exit
 }
}

# Add the permissions to required resource access
Update-MgApplication-ApplicationId $appRegistration.Id-RequiredResourceAccess `
@{ ResourceAppId=$graphAppId; ResourceAccess=$resourceAccess } -ErrorAction Stop
Write-Host-ForegroundColor Cyan "Added application permissions to app registration"

# Add admin consent
foreach ($appRolein$resourceAccess)
{
New-MgServicePrincipalAppRoleAssignment-ServicePrincipalId $appServicePrincipal.Id`
-PrincipalId $appServicePrincipal.Id-ResourceId $graphServicePrincipal.Id`
-AppRoleId $appRole.Id-ErrorAction SilentlyContinue -ErrorVariable SPError |Out-Null
if ($SPError)
 {
Write-Host-ForegroundColor Red "Admin consent for one of the requested scopes could not be added."
Write-Host-ForegroundColor Red $SPError
Exit
 }
}
Write-Host-ForegroundColor Cyan "Added admin consent"

# Add a client secret
$clientSecret=Add-MgApplicationPassword-ApplicationId $appRegistration.Id-PasswordCredential `
@{ DisplayName="Added by PowerShell" } -ErrorAction Stop

Write-Host
Write-Host-ForegroundColor Green "SUCCESS"
Write-Host-ForegroundColor Cyan -NoNewline "Client ID: "
Write-Host-ForegroundColor Yellow $appRegistration.AppId
Write-Host-ForegroundColor Cyan -NoNewline "Tenant ID: "
Write-Host-ForegroundColor Yellow $authTenant
Write-Host-ForegroundColor Cyan -NoNewline "Client secret: "
Write-Host-ForegroundColor Yellow $clientSecret.SecretText
Write-Host-ForegroundColor Cyan -NoNewline "Secret expires: "
Write-Host-ForegroundColor Yellow $clientSecret.EndDateTime

if ($StayConnected-eq$false)
{
Disconnect-MgGraph|Out-Null
Write-Host"Disconnected from Microsoft Graph"
}
else
{
Write-Host
Write-Host-ForegroundColor Yellow `
"The connection to Microsoft Graph is still active. To disconnect, use Disconnect-MgGraph"
}
# </ScriptBody>