Tag Archives: Refreshtoken

Azure, CSP, Powershell

CSP access to tenants using powershell. Part 4

Leave a comment

This is a small script that connects to partnercenter list all customers tenants and let you select one. When one is selected it connects to azuread and az for that customer.

All my credentials are stored in SecretServer . I use a web service request to get those credentials. I will show these modules in a later post. 



import-module partnercenter



#$app = AppID + AppKey

$app=Get-SecretID -secretID xxxx

#rt = refreshtoken.

$rt=Get-SecretID -secretID yyyy

$refreshtoken=$rt.GetNetworkCredential().Password

$tid="'csp tenant directory id'"



   

   

#Connect PartnerCenter

$pcToken = New-PartnerAccessToken -RefreshToken $refreshToken -Resource https://api.partnercenter.microsoft.com -Credential $app -TenantId $tid

Connect-PartnerCenter -AccessToken $pcToken.AccessToken -ApplicationId $app.username -TenantId $tid 



    $customers=get-partnercustomer | sort-object -Property name

    $counter=0

    foreach($cust in $customers){

        Write-Host "$($counter) - $($cust.Name) - $($cust.domain)"

        $counter++

    }

    $custid=Read-Host "Enter customer #"

    $customer=$customers[$custid]

    Write-host " Targeting : $($customer.name) - $($customer.Domain)"



$azureToken = New-PartnerAccessToken -Resource "https://graph.microsoft.com/" -Credential $app -RefreshToken $refreshtoken -TenantId $customer.CustomerId 

$graphToken = New-PartnerAccessToken -RefreshToken $refreshToken -Resource "https://graph.windows.net/" -Credential $app -TenantId $customer.CustomerId  



Connect-Azuread -aadAccessToken $graphToken.AccessToken -msAccessToken $azureToken.AccessToken -TenantId $customer.CustomerId  -AccountId $app.username





$azure2Token = New-PartnerAccessToken -Resource https://management.azure.com/ -Credential $app -RefreshToken $refreshtoken -TenantId $customer.CustomerId 

$graph2Token = New-PartnerAccessToken -RefreshToken $refreshToken -Resource https://graph.windows.net/ -Credential $app -TenantId $customer.CustomerId  



 Connect-AzAccount -AccessToken $azure2Token.AccessToken -GraphAccessToken $graph2Token.AccessToken -TenantId $customer.CustomerId  -AccountId $app.username
Azure, CSP, Office365, Powershell

CSP access to tenants using powershell. Part 3

Leave a comment

In this part 3 of CSP and powershell I will show how you can connect to azureAD of a customer tenant using your CSP app credentials and refreshtoken. This is almost the same procedure as we use to connect to az. We will start with the same variables as in part 2. Remember to keep your credential and secure, as it will give access to all your tenants.



$app=get-credential # Get AppID and Key for out partnecenter app. (created in part 1)

$refreshtoken = 'refreshtoken' # From part 1 or whenever we get a new one.

$CustomerTenantID= 'Azure directory object id'

Struggled for a while to get this to work. The important thing is the endpoints and when to use the customer tenant ID.



$azureToken = New-PartnerAccessToken -Resource "https://graph.microsoft.com/" -Credential $app -RefreshToken $refreshtoken -TenantId $CustomerTenantID 

$graphToken = New-PartnerAccessToken -RefreshToken $refreshToken -Resource "https://graph.windows.net/" -Credential $app -TenantId $CustomerTenantID  



Connect-Azuread -aadAccessToken $graphToken.AccessToken -msAccessToken $azureToken.AccessToken -TenantId $CustomerTenantID  -AccountId $app.username

So now you can use get-azureaduser to get users from this customer tenant.

You could also use the MS online module msol to query for users, this module requires you to use tenantid as an argument.

In part 4 I will wrap this up in a simple script allowing you to select customer tenant.