Category Archives: Azure DevOps
DriftMaester 1.2.0
A nicer installer!
And more changes:
- Installer hardening: storage security baseline, lifecycle retention policy, root-elevation cleanup by object id, access report output, and optional RunNow workflow.
- Invoke runbook reliability: token refresh before post-processing, report-delivery modes, severity gating, failure notifications, retention cleanup, summary blobs for trend reads, and optional Teams webhook notifications.
- Update runbook reliability: target runtime resolution now stays scoped to driftmaester runtime and adds Maester dependency compatibility auto-bump behavior.
- Added Remove-DriftMaester uninstaller script for full or scoped cleanup.
Enumerating organizations and projects in Azure DevOps using a Service Principal
Azure DevOp’s API’s still have a slight preference for delegated api calls (calls from users). For M365permissions scans run through a managed identity, which as a type of service principal cannot normally enumerate the organizations in a tenant. Not knowing the orgs, you also can’t enumerate projects etc.
I tried a year ago and failed. Coming back to it now in some spare time, after struggling a lot with Fiddler & PowerShell, I finally figured out how to get orgs without delegated authentication.
It was actually quite simple, as always…just a single GET to:
https://vsaex.dev.azure.com/_apis/EnterpriseCatalog/Organizations?tenantId=YOURTENANTIDHERE&api-version=7.1-preview.1This returns a csv type formatted string with all orgs your SPN has permissions to! Isn’t that cool?
Oh and don’t forget, the token you get should be for the audience 499b84ac-1321-427f-aa17-267ca6975798