Azure has a very nice feature called ‘Dynamic Groups‘. We use these in our customer tenants to dynamically generate a group with actual users, excluding Guest accounts (marked with #EXT#).

As I couldn’t find any articles detailing how to create a Dynamic Group through the Graph API, I’m posting this for whoever it helps 🙂

<br />
$dynamicGroupProperties = @{<br />
    &quot;description&quot; = &quot;Dynamic Group Created through the Graph API&quot;;<br />
    &quot;displayName&quot; = &quot;Dynamic Group Created through the Graph API&quot;;<br />
    &quot;groupTypes&quot; = @(&quot;DynamicMembership&quot;);<br />
    &quot;mailEnabled&quot; = $False;<br />
    &quot;mailNickname&quot; = &quot;testnickname&quot;;<br />
    &quot;membershipRule&quot; = &quot;(user.userPrincipalName -notContains `&quot;#EXT#@`&quot;) -and (user.userType -ne `&quot;Guest`&quot;)&quot;;<br />
    &quot;membershipRuleProcessingState&quot; = &quot;On&quot;;<br />
    &quot;securityEnabled&quot; = $True<br />
}</p>
<p>invoke-webrequest -Headers $headerParams -uri &quot;https://graph.microsoft.com/beta/groups&quot; -Body (ConvertTo-Json $dynamicGroupProperties) -method POST -Verbose<br />

If you’re not yet used to working with the Graph API, read up on how to connect to the Graph API using Powershell.

A handy Powershell function to lock / unlock using .NET, to prevent concurrent read/writes to files or anything else you like.

<br />
function handleThreadLock{<br />
    Param(<br />
        [switch]$setLock,<br />
        [switch]$releaseLock,<br />
        [string]$lockName=&quot;defaultLockName&quot;,<br />
        [int]$timeOut=600<br />
    )<br />
    if($setLock){<br />
        #register a thread lock<br />
        $script:threadLock = New-Object System.Threading.Mutex($false, $lockName)<br />
        $waited = 0<br />
        while($true){<br />
            try{$lockState = $script:threadLock.WaitOne(1000)}catch{$lockState=$False}<br />
            if($lockState){<br />
                break<br />
            }else{<br />
                $waited+=1<br />
                if($waited -gt $timeOut){<br />
                    Throw &quot;failed to get a thread within $timeOut seconds!&quot;<br />
                }<br />
            }<br />
        }<br />
    }<br />
    if($releaseLock){<br />
        #release a thread lock<br />
        [void]$script:threadLock.ReleaseMutex()<br />
    }<br />
}<br />

In your script, call it like this:

<br />
try{<br />
    handleThreadLock -setLock<br />
}catch{Throw &quot;Failed to set lock!&quot;}</p>
<p>try{<br />
    add-content -Path &quot;c:\yourfile.txt&quot; -Value &quot;log entry&quot; -ErrorAction Stop<br />
}finally{<br />
    handleThreadLock -releaseLock<br />
}<br />

While building some multithreading Azure Runbooks that log into multiple subscriptions simultaneously, I noticed that these multiple concurrent runs often end up on the same Azure Automation Host.

Apparently, these runbooks then don’t run in full isolation, and the following error may occur:

The running command stopped because the preference variable “ErrorActionPreference” or common parameter is set to Stop: The process cannot access the file ‘C:\Windows\system32\config\systemprofile\AppData\Roaming\Windows Azure Powershell\TokenCache.dat’ because it is being used by another process.

AzureProfile.json may also get locked. I resolved this by doing a retry on the Save-AzureRMContext, and using a randomized file name for the azure json profile:

</p>
<p>$randomProfileName = [System.IO.Path]::GetRandomFileName()</p>
<p>Save-AzureRmContext -Path .\$randomProfileName -Force -Confirm:$False</p>
<p>

And for my full Azure Login code snippet:

<br />
$randomProfileName = [System.IO.Path]::GetRandomFileName()<br />
 $tries=0<br />
    while($true){<br />
        $tries++<br />
        try{<br />
            Write-Output &quot;Logging in to Azure $azureSubscription&quot;<br />
            $res = Login-AzureRmAccount -Credential $azureCreds -SubscriptionId $azureSubscription -TenantId $tenantId -ErrorAction Stop<br />
            Select-AzureRmSubscription -SubscriptionId $azureSubscription -ErrorAction Stop -TenantId $tenantId<br />
            if($res.Context.Subscription.Id -eq $azureSubscription){<br />
                Write-Output &quot;Logged in to Azure subscription $($res.Context.Subscription.Id)&quot;<br />
            }else{<br />
                Throw &quot;Failed, we were logged in to $($res.Context.Subscription.Id) while trying to log in to $azureSubscription&quot;<br />
            }<br />
            Save-AzureRmContext -Path .\$randomProfileName -Force -Confirm:$False<br />
            break<br />
        }catch{<br />
            if($tries -ge 30){<br />
                Throw<br />
                Exit<br />
            }<br />
            #sleep on failed attempts, as the azure token cache gets locked by concurrent jobs<br />
            sleep -s (Get-Random -minimum 1 -maximum 6)<br />
        }<br />
    }<br />