If you run into this one when using Delegated or Application authentication in Azure Active Directory, recreate your refresh token and you should be fine 🙂
OnedriveMapper 5.14
Just release 5.14 with the following two new features:
- support directly mapping to subfolders on sites instead of the root
- optionally create a subfolder per user in specific mappings if it doesn’t exist and map that directly
As always, links/doc/info here: https://www.lieben.nu/liebensraum/onedrivemapper/
Easily get access token for Azure Management API
Wrote this little snippet that assumes a logged in session (Connect-AzAccount) and easily/quickly produces an auth header.
function get-azRMAccessHeader(){
$profile = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile
$context = Get-AzContext
$client = New-Object Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient($profile)
$header = @{
"Authorization" = "Bearer $($client.AcquireAccessToken((Get-AzContext).Tenant.TenantId).AccessToken)"
}
return $header
}
LeanLAPS support
As Microsoft has just released LAPS for Azure AD and hybrid joined devices, the usecase for LeanLAPS is more or less gone. This means I will no longer actively develop and/or support LeanLAPS from now on.
Microsoft’s solution also doesn’t rely on proactive remediations, thus lowering the high bar to entry that P2 licensing caused.
Dynamic membership rule for Teams Room accounts
Teams Room accounts are usually excluded from conditional access. To do so, they have to be in a security group, which of course we don’t want to do manually.
Most companies choose to use a naming standard and simply use that as a rule to create an exclusion group. This is easy to circumvent, I can create a guest user / get invited with the right name et voila zero CA policies!
A better way is to identify the accounts based on their assigned licenses, e.g. Teams Rooms Basic (6af4b3d6-14bb-4a2a-960c-6c902aad34f3). This, however, is not supported as an Azure AD group membership rule as this is stored in the AssignedLicenses property which will throw an “Unsupported Property” error.
The assignedPlans property however does contain the GUID we need.
The following Azure AD Group dynamic membership rule only matches users that have a Teams Room Basic, Teams Room Standard or Teams Room Pro license:
(
(
user.assignedPlans -any (
assignedPlan.servicePlanId -eq "8081ca9c-188c-4b49-a8e5-c23b5e9463a8"
-and
assignedPlan.capabilityStatus -eq "Enabled"
)
) -or
(
user.assignedPlans -any (
assignedPlan.servicePlanId -eq "ec17f317-f4bc-451e-b2da-0167e5c260f9"
-and
assignedPlan.capabilityStatus -eq "Enabled"
)
) -or
(
user.assignedPlans -any (
assignedPlan.servicePlanId -eq "92c6b761-01de-457a-9dd9-793a975238f7"
-and
assignedPlan.capabilityStatus -eq "Enabled"
)
)
) -and not (
user.assignedPlans -all (assignedPlan.servicePlanId -eq "")
)
if you want to do something similar for other licenses, here are the options/combinations: