Category Archives: Azure

Automation, Azure, EntraID

Replacing MemberOf in Entra after it is deprecated

Leave a comment

Microsoft is phasing out the memberOf option in Entra Dynamic Groups, in November.

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-rule-member-of

This was in preview, but thousands upon thousands of tenants are of course using this in production. Microsoft thus may delay, but in either case, this called for a replacement. A good plan and Claude to the rescue!

A simple azure runbook you can plug and play into your environment, readme and code are here:

https://github.com/jflieben/assortedFunctionsV2/tree/main/EntraMemberOfSync

It basically completely replaces this functionality in Entra 🙂

Example of output of the runbook:

Azure, Security

Bypassing the IMDS cache

Leave a comment

The IMDS service allows retrieving tokens for e.g. the Graph API, assuming your managed identity has permissions for it.

But what if you forgot to assign permissions? If you already requested a token, you’ll have to wait an hour because IMDS caches its responses, and there is no documented way to bypass the IMDS cache.

By digging into some old MS modules, I accidentally discovered an undocumented parameter you can add to our IMDS call, which immediately mints a new token. Imagine my surprise, no idea why this isn’t documented as it is useful in all kinds of rollout or escalation scenario’s!

Anyway, to bypass the cache, add bypass_cache=true to your GET params! Example:

http://169.254.169.254/metadata/identity/oauth2/token?api-version=2019-08-01&resource=$($resource)&bypass_cache=true

Automation, Azure, DriftMaester, Powershell, Security

DriftMaester sending mail with least privileges

Leave a comment

By default, the broad Mail.Send graph api permission was/is often used for applications/managed identities to send emails.

Obviously it is quite rarely the case that an SPN has to be able to send email as ANY user in your tenant…

So for DriftMaester at least, this has now been corrected by removing the Mail.Send permission and instead using an Exchange Online custom RBAC assignment scoped to only the email you specify 🙂

https://github.com/jflieben/DriftMaester

Azure, M365Permissions

Azure VM Spot Pricing API

Leave a comment

The Azure Retail Prices API does not give correct prices for SPOT VM’s (which can change at any time).

As I use SPOT VM’s a lot to scan largers tenants with M365Permissions to avoid throttling and get results FAST, I needed a reliable way to get the lowest priced F-series VM to temporarily finish a scan queue before getting discarded again.

I created an initial function using the ‘hidden’ retail billing API which calls the ‘https://s2.billing.ext.azure.com/api/Billing/Subscription/GetSpecsCosts?SpotPricing=true’ endpoint.

My post on Linked then got some advice Morten which I now finally got around into creating a function for, using an official instead of ‘hidden’ API!

This resulted in the Get-VmSpotPrices function, which I’m sharing for free through Github:

https://github.com/jflieben/assortedFunctionsV2/blob/main/Get-VmSpotPrices.ps1

Automation, Azure, Exchange Online, Identity, M365Permissions, Microsoft Teams, Office 365, OneDrive for Business, PowerBI, Powershell, Security, Sharepoint Online

M365Permissions v1.2.3

Leave a comment

Performance improvements and Onenote Notebooks.

Today’s release has a ‘special guest’; Morten (blog)! He completely rewrote the entra user and group retrieval code, greatly improving both performance and total capacity!

Other changes of note:

  1. Add support for Onenote Notebook sharing permissions
  2. Treat anonymous sharing links as ‘deleted’ if the sharing level at the site forbids anonymous sharing

Full changelog here

Download / Use:

M365Permissions module page | Github | PSGallery