Private/PartnerActions/Set-SAMConsent.ps1
|
function Set-SAMConsent { [CmdletBinding()] param ( [Parameter(Mandatory)] [String] $CustomerTenantId, [Parameter()] [bool]$Retry ) # Get SAM tokens if not already available begin { if (!$SAMTokens) { $SAMTokens = Get-SAMTokens } } process { # Get the access token needed for subsequent requests $AccessToken = New-CustomPartnerAccessToken -Scopes "https://api.partnercenter.microsoft.com/user_impersonation" -TenantId $PartnerTenantId $AuthHeader = @{ Authorization = "Bearer $($AccessToken.access_token)" Accept = 'application/json' } try { # Get the relevant customer $Customers = (Invoke-RestMethod -Uri "https://api.partnercenter.microsoft.com/v1/customers?size=9999" -Headers $AuthHeader).items $Customer = $Customers | Where-Object { $_.companyProfile.tenantId -eq $CustomerTenantId } } catch { throw "Failed to find customer with ID $($CustomerTenantId): $_" } # We create the initial applicaiton, which has permissions to add other permissions later. $ConsentBody = @{ ApplicationId = $SAMTokens.ApplicationId ApplicationGrants = @( @{ EnterpriseApplicationId = '00000003-0000-0000-c000-000000000000' Scope = @( 'DelegatedPermissionGrant.ReadWrite.All', 'Directory.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All' ) -Join ',' } ) } | ConvertTo-Json $AppCreationResponse = Invoke-RestMethod -Uri "https://api.partnercenter.microsoft.com/v1/customers/$CustomerTenantId/applicationconsents" -Method POST -ContentType 'application/json' -Body $ConsentBody -Headers $AuthHeader -SkipHttpErrorCheck -StatusCodeVariable StatusCode switch($StatusCode) { {$_ -eq "200" -or $_ -eq "201"} { Write-Host "Successfully created consent for $($Customer.companyProfile.companyName)" -ForegroundColor Green Write-Host "Waiting 60 seconds for consent to propogate fully..." -foregroundcolor yellow Start-Sleep -Seconds 60 } 409 { Write-Host "Consent already exists for $($Customer.companyProfile.companyName)" -ForegroundColor Yellow if(!$Retry) { Write-Host "Trying to delete and recreate, in case customer has gotten new licenses (e.g. Teams, Exchange Online)..." -ForegroundColor Yellow $ConsentUri = "https://api.partnercenter.microsoft.com/v1/customers/$CustomerTenantId/applicationconsents/$($SAMTokens.ApplicationId)" Invoke-Restmethod -Uri $ConsentUri -Method DELETE -ContentType 'application/json' -Headers $AuthHeader -SkipHttpErrorCheck | Out-Null Set-SAMConsent -CustomerTenantId $CustomerTenantId -Retry:$true } } 400 { # This just means, that one of the applications we are trying to get consent for, does not exist in the tenant. # Microsoft still creates the consent for the applications that do exist, so we can ignore this error. if($AppCreationResponse.message -like "*doesnt exist in customer tenant*") { Write-Host "Successfully created consent for $($Customer.companyProfile.companyName)" -ForegroundColor Green Write-Host "Waiting 60 seconds for consent to propogate fully..." -foregroundcolor yellow Start-Sleep -Seconds 20 } else { throw "Failed to create consent for $($Customer.companyProfile.companyName): $($_)" } } default { throw "Failed to create consent for $($Customer.companyProfile.companyName): $AppCreationResponse" } } # NOT YET # Service principals Connect-CustomerGraph -CustomerTenantId $CustomerTenantId $ServicePrincipals = Get-MgServicePrincipal -All $AppServicePrincipal = $ServicePrincipals | Where-Object { $_.appId -eq $SAMTokens.ApplicationId } if(!$AppServicePrincipal) { Write-Host "Failed to find service principal for application $($SAMTokens.ApplicationId), sleeping 5 seconds and retrying..." -ForegroundColor Yellow Start-Sleep -Seconds 5 $ServicePrincipals = Get-MgServicePrincipal -All $AppServicePrincipal = $ServicePrincipals | Where-Object { $_.appId -eq $SAMTokens.ApplicationId } } $RequiredResourceAccess = (Get-Content "$PSScriptRoot\SAMManifest.json" | ConvertFrom-Json).requiredResourceAccess # Add application permissions $CurrentRoles = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $AppServicePrincipal.id $Grants = foreach($App in $RequiredResourceAccess) { $ServicePrincipal = $ServicePrincipals | Where-Object { $_.appId -eq $App.resourceAppId } if(!$ServicePrincipal) { continue } foreach ($SingleResource in $App.ResourceAccess | Where-Object -Property Type -EQ 'Role') { if ($SingleResource.id -In $CurrentRoles.appRoleId) { continue } [pscustomobject]@{ principalId = $($AppServicePrincipal.id) resourceId = $($ServicePrincipal.id) appRoleId = "$($SingleResource.Id)" } #Write-Host "role $($SingleResource.Id) for $($ServicePrincipal.displayName)" } } $counter = 0 foreach ($Grant in $Grants) { try { $Request = New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $AppServicePrincipal.Id -BodyParameter (ConvertTo-Json -InputObject $Grant -Depth 5) -ErrorAction Silentlycontinue $counter++ } catch { Write-Host "Failed to grant $($Grant.appRoleId) to $($Grant.resourceId): $ErrorMessage" } } Write-Host "Added $counter Application permissions to $($AppServicePrincipal.displayName)" # Add delegated permissions $AdditionalPermissions = Get-Content "$PSScriptRoot\AdditionalPermissions.json" | ConvertFrom-Json $RequiredResourceAccess = (Get-Content "$PSScriptRoot\SAMManifest.json" | ConvertFrom-Json).requiredResourceAccess $RequiredResourceAccess = $RequiredResourceAccess | Where-Object { $_.resourceAppId -ne 'fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd' } $RequiredResourceAccess = $RequiredResourceAccess + ($AdditionalPermissions | Where-Object { $RequiredResourceAccess.resourceAppId -notcontains $_.resourceAppId }) $Translator = Get-Content "$PSScriptRoot\PermissionsTranslator.json" | ConvertFrom-Json $ServicePrincipals = Get-MgServicePrincipal -All $AppServicePrincipal = $ServicePrincipals | Where-Object { $_.appId -eq $SAMTokens.ApplicationId } $CurrentDelegatedScopes = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $AppServicePrincipal.Id foreach($App in $RequiredResourceAccess) { $ServicePrincipal = $ServicePrincipals | Where-Object -Property AppId -EQ $App.resourceAppId $AdditionalScopes = ($AdditionalPermissions | Where-Object -Property resourceAppId -EQ $App.resourceAppId).resourceAccess if (!$ServicePrincipal) { continue } if ($AdditionalScopes) { $NewScope = (@(($Translator | Where-Object { $_.id -in $App.ResourceAccess.id }).value) + @($AdditionalScopes.id | Select-Object -Unique)) -join ' ' } else { if ($NoTranslateRequired) { $NewScope = $App.resourceAccess | ForEach-Object { $_.id } -join ' ' } else { $NewScope = ($Translator | Where-Object { $_.id -in $App.resourceAccess.id }).value -join ' ' } $NewScope = ($Translator | Where-Object { $_.id -in $App.ResourceAccess.id }).value -join ' ' } $OldScope = ($CurrentDelegatedScopes | Where-Object -Property Resourceid -EQ $ServicePrincipal.id) if (!$OldScope) { $Createbody = @{ clientId = $AppServicePrincipal.id consentType = 'AllPrincipals' resourceId = $ServicePrincipal.id scope = $NewScope } | ConvertTo-Json -Compress $CreateRequest = New-MgOauth2PermissionGrant -BodyParameter $Createbody #Write-Host "Successfully added permissions for $($ServicePrincipal.displayName)" } <# Updating permissions is not working as expected, so we will just create new permissions for now else { $compare = Compare-Object -ReferenceObject $OldScope.scope.Split(' ') -DifferenceObject $NewScope.Split(' ') if (!$compare) { Write-Host "All delegated permissions exist for $($svcPrincipalId.displayName)" continue } $Patchbody = @{ scope = "$NewScope" } | ConvertTo-Json -Compress $PatchRequest = Update-MgOauth2PermissionGrant -Oauth2PermissionGrantId $OldScope.id -BodyParameter $Patchbody Write-Host "Successfully updated permissions for $($ServicePrincipal.displayName)" } #> } } } |