Search This Blog

Friday, October 25, 2019

Access to Teams based on our own extension attributes – PowerShell

In the last two post we looked at extending Azure AD with our own attributes https://blog.mindcore.dk/2019/10/azure-ad-extension-attributes.html and how to use this attribute to dynamically grant access to a Microsoft team https://blog.mindcore.dk/2019/10/access-to-teams-based-on-our-own.html.

This time we will create the team and dynamic group using PowerShell instead.

In order to do this we will need the Teams PowerShell module and the AzureADPreview module.

You can always find the latest version of the teams module here:

https://www.powershellgallery.com/packages/MicrosoftTeams/

image

To see your currently installed version of MicrosoftTeams use the command:

Import-Module MicrosoftTeams

Get-Module MicrosoftTeams

image

You can always just uninstall and reinstall the module to be sure you got the latest version. (elevated)

Uninstall-Module MicrosoftTeams

Install-Module MicrosoftTeams

image

Please note that I had to use .Net higher than version 4.6 in order to make the module work.

To find the latest version of the AzureADPreview module you can go here:

https://www.powershellgallery.com/packages/AzureADPreview

image

To see your currently installed version of AzureADPreview use the commands:

Import-Module AzureADPreview

Get-Module AzureADPreview

image

You can always just uninstall and reinstall the module to be sure you got the latest version. (elevated)

Uninstall-Module AzureADPreview

Install-Module AzureADPreview

image

You will need the preview version because otherwise converting to a dynamic group will fail.

With all modules installed let’s import the modules, unless you already did that.

Import-Module AzureADPreview

Import-Module MicrosoftTeams

image

Then connect to Azure AD and Microsoft teams.

Connect-AzureAD –AccountId youradmin@mydomain.com

image

Connect-MicrosoftTeams –AccountId youradmin@mydomain.com

image

Next step is to create the team.

$team = New-Team -MailNickname "NewTeam" -displayname "NewTeam" -Visibility "private" -Description "My New team"

image

Then we get the appid used in the extension and change the group behind the team to a dynamic group.

$Appid = (get-AzureADApplication -SearchString "Mindcore Azure AD Properties").Appid.replace("-","")

Set-AzureADMSGroup -Id $team.GroupId -GroupTypes "DynamicMembership","Unified" -MembershipRuleProcessingState "On" -MembershipRule "(user.extension_$($appid)_MyAttribute -eq ""MyValue"")"

image

We could also do it the other way around, creating the group first and then link a team, right now we cannot create the dynamic group right away with the teams PowerShell module.

Final result is the same as in the last post were it was all done directly in the portal https://blog.mindcore.dk/2019/10/access-to-teams-based-on-our-own.html.

image

No comments:

Post a Comment