Greetings to my fellow Technology Advocates and Specialists.
In this Session, I will demonstrate How to create Catalog and Access Package in Entitlement Management using Microsoft Graph Powershell.
I had the Privilege to talk on this topic in THREE Azure Communities:-
NAME OF THE AZURE COMMUNITY
TYPE OF SPEAKER SESSION
Azure Spring Clean 2023
Virtual
Cloud Lunch and Learn
Virtual
Azure Back To School 2023
Virtual
EVENT ANNOUNCEMENTS:-
VIRTUAL SESSION:-
LIVE DEMO was Recorded as part of my Presentation in CLOUD LUNCH AND LEARN Forum/Platform
Duration of My Demo = 53 Mins 28 Secs
AUTOMATION OBJECTIVES:-
#
TOPICS
1.
Create a Catalog.
2.
Add an existing Azure Active Directory (AAD) Group as an Resource in the Catalog.
3.
Create Azure Active Directory (AAD) Group(s).
4.
Assign the Azure Active Directory (AAD) Group(s) as "Catalog Owner", "Catalog Reader", "Access Package Manager", and "Access Package Client Assignment Manager" respectively.
5.
Create a Access Package.
6.
Add the already added existing Azure Active Directory (AAD) Group in the Catalog to the Access Package as "Member".
7.
Create Access Package Policy.
INTRODUCTION:-
Azure Active Directory (AAD) entitlement management using Microsoft Graph PowerShell enables you to manage access to all the resources that users need, such as groups, applications, and sites. Entitlement management helps to create a package of resources that internal users can use for self-service requests. Requests that does not require approval and user access expires after 365 days.
Here, in this session, resources are just member in a single group, but it could be a collection of groups, applications, or SharePoint Online sites.
REQUIREMENTS:-
Azure Tenant by type "Azure Active Directory (AAD)" with one of the Licenses in order to use "Azure AD Entitlement Management": a.) Azure AD Premium P2, OR b.) Enterprise Mobility + Security (EMS) E5 license.
Microsoft Graph PowerShell SDK.
"User Administrator", "Identity Governance Administrator" or "Global Administrator" PIM role is required to configure catalogs, access packages, or policies in entitlement management.
A test Azure Active Directory (AAD) Group to onboard as a Catalog Resource and Access Package Member.
USE CASES:-
Assigning and Removing one or more users from one or more AAD Groups at the same time.
$catalogid = New-MgEntitlementManagementAccessPackageCatalog -DisplayName $CatalogName -Description $CatalogDesc | Select -ExpandProperty Id
echo "##############################################"
echo "Catalog $CatalogName created successfully."
echo "##############################################"
Create AAD Groups and configure Catalog Roles and Administrator:-
Note:-
The script is paused for 60 secs in order for the newly created AAD Groups to be populated. Later, these AAD Groups were used to assign Catalog Roles and Administrators.
AADGrpCatalogownerid = az ad group create --display-name $AADGrpCatalogowner --mail-nickname $AADGrpCatalogowner --query "id" -o tsv
$AADGrpCatalogreaderid = az ad group create --display-name $AADGrpCatalogreader --mail-nickname $AADGrpCatalogreader --query "id" -o tsv
$AADGrpCatalogaccesspackagemanagerid = az ad group create --display-name $AADGrpCatalogaccesspackagemanager --mail-nickname $AADGrpCatalogaccesspackagemanager --query "id" -o tsv
$AADGrpCatalogaccesspackageassignmentmanagerid = az ad group create --display-name $AADGrpCatalogaccesspackageassignmentmanager --mail-nickname $AADGrpCatalogaccesspackageassignmentmanager --query "id" -o tsv
echo "###################################################################################"
echo "Pausing the Script for 60 Secs for the newly created AAD Group to be populated."
echo "###################################################################################"
Start-Sleep 60
$catalogownerrole = @{
PrincipalId = "$AADGrpCatalogownerid"
RoleDefinitionId = "$roleidCatalogowner"
AppScopeId = "/AccessPackageCatalog/$catalogid"
}
$catalogreaderrole = @{
PrincipalId = "$AADGrpCatalogreaderid"
RoleDefinitionId = "$roleidCatalogreader"
AppScopeId = "/AccessPackageCatalog/$catalogid"
}
$catalogaccesspackagemanagerrole = @{
PrincipalId = "$AADGrpCatalogaccesspackagemanagerid"
RoleDefinitionId = "$roleidAccesspackagemanager"
AppScopeId = "/AccessPackageCatalog/$catalogid"
}
$catalogaccesspackageassignmentmanagerrole = @{
PrincipalId = "$AADGrpCatalogaccesspackageassignmentmanagerid"
RoleDefinitionId = "$roleidAccesspackageassignmentmanager"
AppScopeId = "/AccessPackageCatalog/$catalogid"
}
New-MgRoleManagementEntitlementManagementRoleAssignment -BodyParameter $catalogownerrole
echo "#######################################################################################################################"
echo "AAD Group $AADGrpCatalogowner created successfully and has been added in the Catalog $CatalogName as Catalog Owner."
echo "#######################################################################################################################"
New-MgRoleManagementEntitlementManagementRoleAssignment -BodyParameter $catalogreaderrole
echo "#######################################################################################################################"
echo "AAD Group $AADGrpCatalogreader created successfully and has been added in the Catalog $CatalogName as Catalog Reader."
echo "#######################################################################################################################"
New-MgRoleManagementEntitlementManagementRoleAssignment -BodyParameter $catalogaccesspackagemanagerrole
echo "#######################################################################################################################################################"
echo "AAD Group $AADGrpCatalogaccesspackagemanager created successfully and has been added in the Catalog $CatalogName as Catalog Access Package Manager."
echo "#######################################################################################################################################################"
New-MgRoleManagementEntitlementManagementRoleAssignment -BodyParameter $catalogaccesspackageassignmentmanagerrole
echo "###########################################################################################################################################################################"
echo "AAD Group $AADGrpCatalogaccesspackageassignmentmanager created successfully and has been added in the Catalog $CatalogName as Catalog Access Package Assignment Manager."
echo "###########################################################################################################################################################################"
Add AAD Group to the Catalog Resource:-
$aadgrpid = az ad group show -g "$AADGroupname" --query "id" -o tsv
$accessPackageResource = @{
"originSystem" = "AadGroup"
"OriginId" = $aadgrpid
}
New-MgEntitlementManagementAccessPackageResourceRequest -CatalogId $catalogid -RequestType "AdminAdd" -AccessPackageResource $accessPackageResource | select Id, RequestState | ConvertTo-Json
echo "###################################################################################"
echo "AAD Group $AADGroupname has been added to the Catalog $CatalogName successfully."
echo "###################################################################################"
Oldest comments (0)