Browsed by
Tag: Automation

Connect to Exchange Online PowerShell with an Azure Managed Identity

Connect to Exchange Online PowerShell with an Azure Managed Identity

Recently the Exchange Online Module v2 came out with support for connecting to Exchange Online via a managed identity. The module has several parameters:

  1. ManagedIdentity
  2. ManagedIdentityAccountId
  3. Organization

When using the ManagedIdentity parameter you must also call the Organization parameter which is the initial, or ‘.onmicrosoft’ domain.

What You Will Need

  • PowerShell
  • Az PowerShell Module (install-module az)
  • The Microsoft Graph SDK (install-module Microsoft.Graph

Create the Managed Identity, Permissions, and Runbook

Connect to Azure

First thing we must do is connect to Azure using the Az module. Open a PowerShell window and run

Connect-AzAccount

Create a Resource Group

After we are connected we need to create a Resource Group to house everything. In my example I will create a new Resource Group in the Central US region.

$rgname = "rg-exchangeautomation"
$location = "centralus"
New-AzResourceGroup -Name $rgname -Location $location

Create the Automation Account

Next, we need to create the Automation Account that runs … Continue...

Creating a Microsoft 365 Automated Off-boarding Process with SharePoint, Graph API, and PowerShell

Creating a Microsoft 365 Automated Off-boarding Process with SharePoint, Graph API, and PowerShell

In this write-up I will be creating a basic off-boarding automation that uses SharePoint as the front end, and PowerShell, the Graph API, and Azure Runbooks as the back-end. HR will input the users UPN or Email, offboard date/time, and a forwarding address to forward email to. Once the off-boarding datetime is within 1hr the automation will check the user in Azure AD to ensure its valid, the forwarding user is valid in Azure AD, document in SharePoint the users e-mail address, any and all licenses, and all group memberships. After that, it will proceed with the off-boarding where it will remove all licenses from the user, remove all group memberships, and forward email to our forwarding user. It will log everything back to SharePoint where one can review it.

Off-Boarding Stages

Pending

In Pending we have just submitted our user and the automation has not seen it, or it … Continue...

In-Depth Look at Azure Bicep Syntax

In-Depth Look at Azure Bicep Syntax

If you have not checked out my other series, “Getting Started with Bicep” then I would highly suggest starting there so you can familiarize yourself with Azure Bicep including some basic syntax and how to write your first template. This article will walk you through more advanced syntax topics including output variables, loops and more!

Comments

Comments in code help you or others figure out what something may do or why it’s there in the first place. While it does not replace full documentation, it is a great way to get a picture of what your code does.

Single Line Comment

You can comment a single line of bicep code by adding ‘//’ to it. In the example below you can see my comment added to the tagging resource that we will go over next!

Multi-line Comments

Instead of adding ‘//’ to every line you want to comment … Continue...

Get Early Voting Locations, Drop Off Ballot Sites, and Election Polling Places with PowerShell

Get Early Voting Locations, Drop Off Ballot Sites, and Election Polling Places with PowerShell

The 2020 Election is happening on November 3rd, and many people have been lining up to vote early due to COVID-19. Now using PowerShell, you can get your registered polling places based on your address, all early voting locations around you, and drop off ballot locations. All of the information is retrieved using Google’s Civic Information API.

Features

Early Voting Locations

To get early voting locations you can use Get-EarlyVotingPlaces or Get-EarlyPollingPlaces. It will return as many results as the API gets and show you the starting date of the location, Name, Polling hours for each day, address, city, state, and zip code.

Ballot Drop Off Locations

If you got a Mail-in ballot, you can look up drop off locations by using, Get-BallotDropOffLocations or Get-DropOffBallotLocations. Note: Not all states publish this data. You will get a max of 10 results back and it will show you the start … Continue...

Deploy and Manage Azure Infrastructure Using Terraform, Remote State, and Azure DevOps Pipelines (YAML)

Deploy and Manage Azure Infrastructure Using Terraform, Remote State, and Azure DevOps Pipelines (YAML)

Overview

In this article, I will be showing you how to create an Azure DevOps CI/CD (continuous integration / continuous deployment) Pipeline that will deploy and manage an Azure environment using Terraform. Terraform is a tool for building, changing, and versioning infrastructure safely and efficiently.

Configuration files (In our case, it will be named ‘Main.tf’) describe to Terraform how you want your environment constructed. “Terraform generates an execution plan describing what it will do to reach the desired state, and then executes it to build the described infrastructure. As the configuration changes, Terraform can determine what changed and create incremental execution plans which can be applied.”1

By creating an entire CI/CD pipeline, we can automate our infrastructure-as-code (IaC) deployment. When we have made a change to our Terraform code (adding something, removing something, changing something), the Pipeline will automatically log in to our Azure environment, add any new … Continue...

Intune + Chocolatey: A Match Made in Heaven

Intune + Chocolatey: A Match Made in Heaven

Recently, I have been doing a lot of Microsoft Intune deployments and write up’s. One of the most time-consuming tasks with Intune is the application portion, where you package applications up to deploy to your end-user machines. Currently, if the application is bundled as an executable (exe), the steps to get it into Intune is as follows:

  • Grab the installation executable
  • Find the install switches – most common one is the silent switch, but some applications may have other switches you will need as well
  • Find the install directory or registry key to tell Intune if it installed correctly or not
  • Find the uninstall executable and any switches it has as well
  • Wrap the executable in an ‘INTUNEWIN’ format
  • Import file into Intune
  • Configure the application with the install and uninstall switches as well as the directory it creates to Intune knows if it installed correctly or not

This process … Continue...

Backup and Restore your Intune Configuration using PowerShell

Backup and Restore your Intune Configuration using PowerShell

I found this fantastic PowerShell module from jseerden that queries Microsoft Graph, and allows for cross-tenant Backup & Restore of your Intune Configuration. The Intune Configuration is backed up as JSON files in a given directory. The module allows an administrator to backup, restore and even compare different Intune backup sets.

Pre-Requisites

The module requires a total of 3 modules to be present, you can install them by running the following commands in an administrative PowerShell prompt:

AzureAD Module

  1. AzureAD (Install-Module -Name AzureAD)

MSGraphFunction Module

  1. MSGraphFunction (Install-Module -Name MSGraphFunctions)

IntuneBackupandRestore Module

The IntuneBackupandRestore PowerShell module is hosted on the PowerShell Gallery. You can install it by running the following command in an administrative PowerShell prompt:

Install-Module -Name IntuneBackupAndRestore

Connect to Microsoft Graph

Next, we will connect to Microsoft Graph using the “Microsoft Intune PowerShell” application in AzureAD, so you don’t need to create your own … Continue...

Post Notifications About Unused Office 365 Licenses to Teams using Azure Runbooks

Post Notifications About Unused Office 365 Licenses to Teams using Azure Runbooks

I have written several articles on using PowerShell to send alerts and notifications to Microsoft Teams, but up until now they were set up using only the task scheduler. As more and more companies move to the cloud I wanted to see how I could do cloud infrastructure alerting as well. In this article I am using an Azure RunBook to connect to my Office 365 tenant, parse my licenses, and return any that need reconciliation. If you get your Office 365 licenses from a CSP or any other kind of reseller, you may get charged for all of your licenses, applied or not. So it’s a good thing to make sure you don’t have any extra ones lying around.

Set Up the Azure Environment

Resource Group, Runbook and Automation Account Creation

I created a script that you can just change the variables for and it will create the following … Continue...

Set Corporate Lock Screen Wallpaper with Intune for Non Windows 10 Enterprise or Windows 10 Education Machines

Set Corporate Lock Screen Wallpaper with Intune for Non Windows 10 Enterprise or Windows 10 Education Machines

In my previous article I showed you how you can leverage PowerShell and Intune to set a computers wallpaper even if the OS was not Enterprise or Education. Currently, If you want to set the wallpaper or lock screen wallpaper via Intune Policies, you must be on either Enterprise or Education. In this article I will show you how you can leverage PowerShell and Intune, and set your own lock screen wallpaper no matter the version.

In my example I will use Intune to set the lock screen image of my end user machines to the following image:

First, we need to create a PowerShell script that will do the following:

  • Download the wallpaper
  • Store the wallpaper locally on the target machine
  • Set the lock screen wallpaper

In my example, I want to set my wallpaper as the following image: https://www.thelazyadministrator.com/wp-content/uploads/2019/07/nicewall.jpg, which will be named wallpaper_LazyAdmin.jpg and stored at … Continue...

Get a Teams Notification the Moment an Active Directory User gets Locked Out with PowerShell Using Webhooks

Get a Teams Notification the Moment an Active Directory User gets Locked Out with PowerShell Using Webhooks

I have been recently using Teams as a central location for my organizations technical notifications instead of email as it provides a way for an entire Help Desk team to openly collaborate on the message and its contents. I recently got a request to get a Teams notification when a user gets locked out of their Active Directory account. By setting up a Webhook connector we can make it happen. The script will be triggered from Task Scheduler on Event ID 4740 which is created when a user gets locked out. By using “Search-ADAccount -LockedOut” we can return an array of locked out accounts, but by ordering it by lockout time we can ensure that we grab the most recent locked out user that corresponds to the security event.

I set the script and scheduled task up on my PDC because as far as I know, the actual lockout event … Continue...