Azure AD B2B PowerShell Invites

I’ve written about Azure AD B2B before, as well as then giving those invited users access to SharePoint Online, but there’s been a lot of changes since I started using it. Have a read of my original article if you’re interested to see how I’m using B2B and why.

Azure AD B2B is still in preview, but in Feb 2017 a bunch of improvements were added. Part of these changes were around using the new Azure portal rather than the Classic Portal, and with that is the removal of inviting users via CSV file and uploading it to Azure AD. This was exactly the way I was using it, so I had to change to one of the newer methods.

Although CSV support is gone, it’s been replaced by PowerShell which can just call the same CSV file being used before, so it’s not a huge change. There’s a PowerShell example on this technet page which shows how to do it. There is a catch though, the ability to add the user to groups as part of the import is gone.

The other big change that impacted me was the invitation emails. This is the email that gets sent to the recipient when being invited – it was originally a plain text email from a generic Microsoft address, but it’s now changed to a much more professional looking email. The catch with this is, rather than coming from a generic Microsoft email account, it now comes from the user that sends the invites out. I found this out the hard way when invited parties started seeing my details and photo with the invite!

There’s four approaches I can come up with around this new invite method –

1. Leave it as showing the admin user who does the invites (not ideal)

2. Create and use a seperate service account for these invites, so it comes from a generic looking internal email address (quite good)

3. Get the users themselves to send the invites out – by default, all users have access to invite others to their tenant (worst option, users won’t do this themselves, need training and support, can’t automate)

4. Use APIs and send the invites out on behalf of the user (‘best’ option but requires the most work, most complex)

While I look at option 4, option 2 is a good middle ground and will probably do for most companies.

I’ve written and tested the below script, which works on a single user by user basis. This uses just the Azure AD Preview module for PowerShell, which is at version 2.0.0.85 at the time of writing. To use the method mentioned on that page to install, I had to first install Windows Management Framework 5.0.

$group = get-azureadgroup -SearchString "Put your exact search string here" | where {$_.dirsyncenabled -eq $null}
$newuser = New-AzureADMSInvitation -InvitedUserEmailAddress emailaddress@contoso.com -InvitedUserDisplayName "Full Name" -sendinvitationmessage $true -InviteRedirectUrl "http://myapps.microsoft.com"
Add-AzureADGroupMember -objectid $group.objectid -RefObjectId $newuser.InvitedUser.Id

 

This script requires you to first authenticate against Azure AD with the command connect-azuread : the same way you’d use connect-msol for Office 365. More on how to automate that part in an upcoming blog post.

I’ve written this on the basis that you already have a group to add the guest user into, which gives them the permissions required after being invited into your Azure AD tenant. It’s also more a proof of concept script, which shows how to automate these steps enough to then be able to do what you want with it – such as wrap it around a ‘for each’ and feed multiple users into it.

The first thing the script does is get the group name. As objects in Azure AD don’t have to have unique names like on-prem Active Directory, this script will fail if it finds multiple results the same. It’s also making sure the result that comes back is only a cloud based group, because you can only add B2B invited users into Azure AD groups (not ones synced from on-prem).

Next it will send out the invite to the user. This is the important part. If you don’t want an email to go out, you can change the -sendinvitationmessage value to $false.

Finally we’re adding the invited user into the group by ObjectIDs of each object – straight forward.

—-

The end result is a user who will be able to accept their invite, log in and have access to whatever they need to. Note that the way I do this is by having an app and advertising it to the group that also gives permissions to SharePoint Online, so they’ll see the single link on their myapps.microsoft.com page.

If you’re mucking about with Azure AD B2B this should give you somewhere to start. The Microsoft Technet pages for Azure AD are very comprehensive now as well as being easy to read, so check them out.

If you have any questions on Azure AD B2B feel free to ask!

Netwrix Sysadmin Blog Awards Finalist (and Winner!)

Netwrix has picked this blog as one of the finalists in it’s blog awards! As their post on this says, the blogs shortlisted “based on the regularity of blog posts, the variety of topics covered and feedback from readers.” For anyone reading this, and particularly those who have supported, shared or commented; I really appreciate you support, and it’s little nods like this that just give another layer of approval and why I do this.

There isn’t too much else to say, but please continue to give feedback, comment (I really enjoy both the ‘this worked for me!’ or the ‘this didn’t work, but this did’ comments) or start your own blog up if you think of something to share – I’m happy to give advice to anyone, or host a guest blog post if you want to give it a try yourself :)

Here’s the list of all the finalists. Check out their blogs as there’s something for everyone there (I’ve had a look through all of them!)

Best Cloud Computing Blog


Best IT Security Blog


Best Tech Tips for System Administrators Blog


Most Humorous Blog


24/7 Tech Support Blog


IT Career Blog

 

Update 17th March 2017

adamfowlerit.com won it’s category for “Best Tech Tips for System Administrators”! Thanks Netwrix and I’m looking forward to playing with the Samsung VR unit :)

Winners list here

Azure AD Group-Based License Management For Office 365

It’s finally here! At least in public preview…

The ability to allocate Office 365 licenses via groups is now available for everyone to use. This has been a long-awaited feature, up until now licenses have either been applied manually via the portal, or via scripts/3rd party software with logic applied for automation.

Now, you can automatically apply and manage license allocation using whatever logic you like. You can create on-premise AD groups, apply a license set to the groups, and members will be allocated the relevant licensing. If that doesn’t work for you, there’s also cloud based Dynamic Groups which let you use whatever logic you can come up with to add members to the group. You could do it on something like a department name, or use an extension attribute and populate that based on what license you want to allocate.

The above link covers a lot of information about how to deploy this. At the time of writing, I couldn’t get to the Azure Licensing page by searching for the word ‘Licensing’, and instead had to use a direct link: https://portal.azure.com/#blade/Microsoft_AAD_IAM/LicensesMenuBlade/Products

I’ve already deployed it, it seems to work quickly and without issue.

 

Once you’re done, you’ll need to remove the Office 365 licenses applied manually. This TechNet article shows the commands to use for removal. I used this:

$Users = Get-MsolUser -All | where {$_.isLicensed -eq $true}; $Users | foreach {Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -RemoveLicenses "litwareinc:ENTERPRISEPACK"}

This removes licenses from all your users, to be more specific add extra criteria to the first ‘Get-MsolUser’ command. Also note you need to swap ‘litwareinc’ with your tenant ID, and ENTERPRISEPACK with whichever license you’re removing. I’d recommend testing on one account first!

To see what your tenant’s license options are just use:

Get-MsolAccountSku

And you’ll see a list of the license options along with existing allocations.

If you have any questions please comment below.

How To Grep in PowerShell

For those who have lived in the Linux/Unix command line, the ‘grep‘ command is a commonly used way of finding something that you want in a chunk of data.

Øyvind Kallstad did a great writeup of comparing a bunch of ways to use PowerShell instead of grep which is worth reading.

The article covers a bunch of scenarios, and is centered around starting with the ‘grep’ command and working with it. However, there’s the other common use case of running a different command, then piping those results to grep to search for something.

This blogpost was triggered by Janet who asked me this fair question:

As with poor cute cats, there’s more than one way to skin PowerShell.

I had to do some research and asking around on this, because normally I’d filter out the property of the object I was looking at, and work with that. Using the get-process example:

get-process | where ProcessName -like "*foo*

That works, but it’s still a lot clunkier than what a grep user would expect. An easier way would be to use the ‘findstr‘ program (which also has a bunch of useful swtiches):

get-process | findstr foo

I say program because ‘findstr’ is not a PowerShell cmdlet, but it’s still native to Windows and works perfectly fine. It’s case sensitive though, so you need to use -i for case insensitive results.

That’s great for simple stuff, but we’re sort of breaking what PowerShell does. You’re no longer dealing with a standard PowerShell object, so further piping and processing won’t really work.

The ‘proper’ PowerShell way would be to use the ‘Where-Object’ command:

Get-Process | Where-Object {$_ | Select-String "foo"}

A bit longer, but you can shorten ‘Where-Object’ to ‘Where’. Although more involved, it’s good to get into the habit of doing it this way, so when you’re piping this to the next command, it still says as a standard object that can be read and manipulated.’

(Update 24th Feb 2017) As Steve_N points out in the comments section, there’s a much shorter way of doing this:

ps *foo*

That’s it. Many PowerShell commands have inbuilt aliases, including ‘get-process’. You can see what this is with the command ‘get-alias -definition get-process’

This shows that ‘gps’ and ‘ps’ are both aliases to the command  ‘get-process’. You can also create your own aliases with the ‘set-alias‘ command.

The ‘*foo*’ part works because the command assumes the -name switch has been used, which lets you define what criteria to search and show in the ProcessName field. This is the same way that many commands don’t need the -identity switch used, because it’s written to assume you’re going to tell it what identity/username/upn to work with.

This can also be piped to something else, so it’s a winner. It’s less ideal for scripts though, because it’s much harder to read, and you can’t assume that everyone will know the short alias of a full command.

Also note that this isn’t grep related at all, so part of the answer to the original question is that you may not even need grep or select-string as it adds unnecessary overhead of getting data and parsing it, whereas this updated example filters the data as it’s obtained.

(Update ends)

PowerShell isn’t a Linux/Unix command line, but Microsoft have incorporated many of the concepts from bash. If you still can’t bear to use PowerShell on Windows, there’s always the Linux Bash Shell on Windows.

Thanks again to Steve Mclnerey for the grep advice :)

Why Haven’t You Deployed LAPS Yet?

LAPS – Local Administrator Password Solution is an official Microsoft solution for doing exactly what it’s called – managing local administrator passwords on the computers you manage (both desktops and servers).

The solution is fairly simple – have a tiny client rolled out on each PC, that gets told by Group Policy to generate a random password. The local admin account gets set to that password, and Active Directory also gets told what that password is. That changes on a 30 day cycle

The end result is that anyone who obtains local admin access through that account, can’t access anything beyond that single computer – and, that’s only for 30 days maximum before it gets changed. Even if the computer is taken off the domain, your Active Directory will have a record against the computer of what the last set password was.

There’s a great overview, demo, and install files available from TechNet with Jessica Payne going into great detail on how it all works and showing you exactly what to do which I highly recommend after watching it personally.

As she says, it only takes 10 minutes or so to set up, and it’s that much more secure than using Group Policy to set everyone’s local administrator account to the same password (which by the way, doesn’t securely save the password in the Group Policy anyway) and running into issues when someone needs the local administrator password for one reason or another.

Oh, there is a tiny AD schema update, but it’s a single command and nothing to worry about :)

Once you’ve got LAPS set up, you use the LAPS UI program to view passwords:

Chris Brown has also written up a nice ‘how-to’ guide on setting up LAPS from end to end which is worth following too.

LAPS is easy to deploy, easy to manage and provides several security benefits… and it’s free. If you’re not using LAPS yet, it’s time to do it! Grab it from Microsoft here.

Gaming PC Build 2017

My 5+ year old PC was finally ageing – Battlefield 1 was maxing out the Intel i5 CPU! It’s time to upgrade to a whole new kit. After some research and help from PC Part Picker, this is what I bought:

Intel Core i7-7700K 4.2GHz Quad-Core Processor

Deepcool Gammaxx 400 CPU Cooler

MSI Z270 GAMING M5 ATX LGA1151 Motherboard

Corsair Vengeance LPX 16GB (2 x 8GB) DDR4-3200C16 Memory

Intel 600p Series 512GB M.2-2280 Solid State Drive

Corsair 300R ATX Mid Tower Case Windows Edition

Corsair CS650M Modular 80 Plus Gold ATX Power Supply

You may notice there’s no GPU. I’ll be re-using my NVIDIA GTX970 as that was more recently updated. If I didn’t have that, I would have probably chosen a GTX1070. I also added in an old DVD drive and 1.5TB HDD because why not.

 

Notes from during the build:

Lining up the motherboard back panel into the case, and then getting the motherboard to line up with it. It looked like it was in place, but not enough to have the screws in the case line up with all the holes in the motherboard.

CPU Fan – Completely my fault, I put the wrong brackets on. I was still thinking of my old 1155 pin CPU when I followed the back of the box instructions, rather than the 1151 pins that my new CPU was. Then I had to work out how the weird clips worked, as there was a single line of instruction: “Well note: turn before push”. Apparently that means don’t turn at all, which took some trial and error to discover.

Working out how to install M.2 SSDs – this wasn’t really a problem, just something I hadn’t done before. It’s held in place with a screw and screw holder, which I eventually found already in the motherboard, but in a hole designed for the largest M.2 card possible.

This case is pretty good for HDDs and DVD Drives – it’s a screwless solution for both, but you do need to access both sides of the case. Both sides also come off easily with 2 thumb screws.

I did a bit of cable management, which previously I hadn’t bothered with as I’d be changing things around every couple of months (I remember adding my 9th 320GB HDD to my PC years ago, and then trying to juggle SATA and power cables around to make it all work). The case again was pretty good for this, I just fed the cables through to the bottom side of the motherboard, then brought them back out again where they needed to go.

CPU was just a drop in the right way, have the arrows line up job. Pushing the bracket back onto the CPU to hold it into place is a little worrying, more force is required then I was comfortable applying.

PSU is modular, so you can have just the cables you need coming out of it which reduces clutter. 650w is overkill I’m sure for this, as I could have bought a 550w for half the price but it wouldn’t have been modular, and I also like keeping my options open for future changes. Installation of the unit was sliding in and putting a couple of screws on.

The GPU I already had fits in with lots of room – it looks like they’ve changed the design of the PCI-E slot which used to have a plastic tab to bend to insert or remove the card – that’s changed to a tab that’s the same style as the RAM sockets.

RAM hasn’t changed at all installation wise :) The only trick is to make sure you populate the right slots – check the manual, but usually it’s also on the motherboard too (which it was in this case).

Idling temps after install were around the 39oC – but after overclocking and leaving it a few days, it seemed to settle lower at 37oC.

 

Getting the software going:

Thankfully after getting it all together and installing Windows 10, there were no issues. Lucky I installed that DVD drive, as the network device wasn’t installed with a default driver, and I had to load it off the included CD-ROM. Yep, 2017 and we’re still loading base drivers that way.

The amount of utilities provided by MSI is a bit silly, and it’s really hard to tell what any of them do until you install them. I’ve got one that claims to give a fast boot – the few seconds it takes without that is fast enough already. The MSI Command Center is useful as it shows CPU/RAM settings and speeds, as well as system temp. The MSI Gaming App was the one that let me turn off the motherboard’s LED, rather than setting it to ‘breathe’ where it would fade in and out in one of 7 amazing colours.

I also used the motherboard’s inbuilt overclocking ‘gaming mode’ option – it upped the CPU from 4.2Ghz to 4.8Ghz. I found another option around the RAM where I set that to 3200Mhz, and it did it’s thing on changing settings to match that RAM speed. If you’re not going to do this by the way, don’t get the ‘K’ series Intel I7, or RAM faster than 2400Mhz because that’s all it will run at out of the box.

Also, if you have a look at some comprehensive reviews you’ll see that there’s barely any benefit in the 7th generation Kaby Lake Intel CPUs vs the 6th generation Skylake (don’t ask me why Skylake is one word, and Kaby Lake is two words either), if you aren’t using the onboard GPU which gets the biggest gains. Right now, the price is pretty much identical between the 6700K and 7700K which is why you might as well go the newer one – there’s no negatives there.

This setup is very quiet too, there’s minimal noise from any fans which is great.

 

Here’s some pictures of the build process. I’m happy to report that after a few days and testing Battlefield 1, I’ve had zero blue screens, and CPU sits around 60% max when playing.

 


 

 

 

PowerShell – ‘While’ Loop Statement

There’s a lot of different ways to loop commands in PowerShell, and here’s one I just learnt (thanks Nathan Kewley for spending the time talking me through this!):

Scenario: You create a brand new user in Active Directory, but need to wait for things to sync before you make a change to the user. If you want to automate these steps, you want to check that the user exists before running more commands against it.

Answer: The ‘While‘ statement. This lets you loop a command ‘while’ something is a certain value. For example, you may want a script to loop for two minutes, or until a certain value is true or false.

With my script below, it will check if the value $running is nothing (null), which it is because we just made it up. Because it’s true, it’ll then continue on to do whatever is in the curly brackets. Here, I’m running a command the enable a user in Skype for Business, but also setting the result of that as the variable $running.

If the command works, $running now has a value of the created user, so as it loops again to see if $running is null, it won’t be, and the ‘while’ statement is done.

If the command fails however, and shows the dangerous red warning around the user not existing, nothing gets set to the $running variable. That means, when it loops again, $running will still be null so it’ll try again and again and again.

while($running -eq $null){
 $running = Enable-CsUser -Identity testuser -SipAddress testuser@contoso.com
}

That’s rather dangerous of course, what if it’s forever $null? It’ll run forever, so we’d better put in some failsafes.

while($running -eq $null){
 if($CheckUser -le '10'){
  $CheckUser++
  start-sleep -s 10
  $running = Enable-CsUser -Identity testuser -SipAddress testuser@contoso.com
}
}

OK, this time we’re doing a couple more things. We’ve got two curly bracketed things to run now, the first is an ‘If’. If $CheckUser is less or equal to 10, then do the next curly bracket thing. The first time this runs that value again doesn’t exist because we just made it up, and nothing is less or equal to 10. The If statement is true, so it moves onto the next segment.

The $CheckUser++ command just adds ‘1’ to the value of $CheckUser – starting off at null or 0, so will turn into 1. As the statement loops, that number will increment all the way up to 11. Once it’s 11, the If statement is no longer true, so bombs out.

We’ve also added the start-sleep command, which is just a 10 second wait before doing anything. If we didn’t have that there, the 11 loops before it fails would be over incredibly quickly.

The last thing we can add is an event to occur once the ‘If’ statement is no longer true:

while($running -eq $null){
 if($CheckUser -le '10'){
  $CheckUser++
  start-sleep -s 10
  $running = Enable-CsUser -Identity testuser -SipAddress testuser@contoso.com
}else{
Throw "Unable to create SfB User"
}
}

All we’ve done here is added the ‘Else’ section, which only runs when the ‘If’ isn’t true. Once the $CheckUser variable hits 11, the ‘Else’ command runs and throws up an error, with the aptly named ‘Throw’ command.

Hopefully this is enough to explain the basics of the ‘While’ command.