IdAM Thoughts

ADConnect

AzureAD: Get List of all users with a particular license

You might have to do reporting and want a list of all users in Azure AD which have a particular license..

Following is an easy way to do so

Connect-MsolService

Get-MsolAccountSku

Get-MSOLUser -All | where {$_.isLicensed -eq "TRUE" -and $_.Licenses.AccountSKUID -eq "TENANTNAME:AAD_PREMIUM"} | select displayname,userprincipalname | export-CSV C:\licensedusers.csv -NoTypeInformation

1

2

3

4

5

Connect-MsolService

Get-MsolAccountSku

Get-MSOLUser -All | where {$_.isLicensed -eq "TRUE" -and $_.Licenses.AccountSKUID -eq "TENANTNAME:AAD_PREMIUM"} | select displayname,userprincipalname | export-CSV C:\licensedusers.csv -NoTypeInformation

Get-MsolAccountSku will give you a table of all the License Types you have and count

AccountSkuId	ActiveUnits	WarningUnits	ConsumedUnits
TENANTNAME:AAD_BASIC	300000	0	1
TENANTNAME:AAD_PREMIUM	300000	0	200000
TENANTNAME:AAD_PREMIUM_P2	300000	0	200000
TENANTNAME:POWER_BI_STANDARD	1000000	0	200000

You can then choose the AccountSkuId you want to report on and pass that in the “TENANTNAME:AAD_PREMIUM” of the Get-MSOLUser command

It took me about 20 min to run this report for about 155000 users

By Piyush Khandelwal, 7 years ago

MIM

Fixing MIM Error: The dimage indicates an update or replace operation, but the image doesn’t exist.

So there was a delete operation sent to an AD MA. It was deleted successfully but on import (Full / Delta) MIM was still seeing the object with a staging error

Error: The dimage indicates an update or replace operation, but the image doesn’t exist.

Cause: Unknown – The Object Information was corrupted in connector space.

Resolution: Did some digging with Microsoft and came up with the solution

Open SQL Server management studio and logon. Backup FIMSynchronizationService database.
In a new query script, input the below command

USE [FIMSynchronizationService]
GO

SELECT * FROM dbo.mms_connectorspace WHERE RDN ='RDN value'

1

2

3

4

USE [FIMSynchronizationService]

GO

SELECT * FROM dbo.mms_connectorspace WHERE RDN ='RDN value'

You can get the RDN from the object corrupted.
After that, record the object_id from the query result, which we will use in the later statements.
Run the below statements to turn it into a phantom

USE [FIMSynchronizationService]
GO

UPDATE [mms_connectorspace]

SET [creation_date]=NULL,[is_provisioned]=NULL,[disconnection_id]=NULL,[disconnection_modification_date]=NULL,[last_import_modification_date]=NULL,[last_export_modification_date]=NULL,[count_import_modications]=NULL,[count_export_modications]=NULL,[is_connector]=0,[connector_state]=0,[pending]=0,[is_rename_retry]=0,[is_reference_retry]=0,[is_rebuild_in_progress]=0,[is_seen_by_import]=1,[is_phantom_parent]=0,[is_phantom_link]=1,[is_phantom_delete]=0,[is_full_sync]=0,[is_obsoletion]=0,[is_pending_reference_delete]=NULL,[import_operation]=NULL,[export_operation]=NULL,[is_import_error]=0,[count_import_error_retries]=0,[initial_import_error_date]=NULL,[last_import_error_date]=NULL,[import_error_code]=0,[is_export_error]=0,[count_export_error_retries]=0,[initial_export_error_date]=NULL,[last_export_error_date]=NULL,[export_error_code]=0,[current_export_batch_number]=NULL,[current_export_sequence_number]=NULL,[unapplied_export_batch_number]=NULL,[unapplied_export_sequencer_number]=NULL,[original_export_batch_number]=NULL,[original_export_sequencer_number]=NULL,[key_id]=NULL,[hologram]=NULL,[deltas]=NULL,[import_error_detail]=NULL,[export_error_detail]=NULL WHERE object_id='<object ID from the previous statement>'

1

2

3

4

5

6

USE [FIMSynchronizationService]

GO

UPDATE [mms_connectorspace]

SET [creation_date]=NULL,[is_provisioned]=NULL,[disconnection_id]=NULL,[disconnection_modification_date]=NULL,[last_import_modification_date]=NULL,[last_export_modification_date]=NULL,[count_import_modications]=NULL,[count_export_modications]=NULL,[is_connector]=0,[connector_state]=0,[pending]=0,[is_rename_retry]=0,[is_reference_retry]=0,[is_rebuild_in_progress]=0,[is_seen_by_import]=1,[is_phantom_parent]=0,[is_phantom_link]=1,[is_phantom_delete]=0,[is_full_sync]=0,[is_obsoletion]=0,[is_pending_reference_delete]=NULL,[import_operation]=NULL,[export_operation]=NULL,[is_import_error]=0,[count_import_error_retries]=0,[initial_import_error_date]=NULL,[last_import_error_date]=NULL,[import_error_code]=0,[is_export_error]=0,[count_export_error_retries]=0,[initial_export_error_date]=NULL,[last_export_error_date]=NULL,[export_error_code]=0,[current_export_batch_number]=NULL,[current_export_sequence_number]=NULL,[unapplied_export_batch_number]=NULL,[unapplied_export_sequencer_number]=NULL,[original_export_batch_number]=NULL,[original_export_sequencer_number]=NULL,[key_id]=NULL,[hologram]=NULL,[deltas]=NULL,[import_error_detail]=NULL,[export_error_detail]=NULL WHERE object_id='<object ID from the previous statement>'

Stop the FIM service.
Delete the record via the below commands

DELETE FROM mms_cs_link WHERE object_id='<object ID from the previous statement>'

DELETE FROM mms_csmv_link WHERE cs_object_id='<object ID from the previous statement>'

DELETE FROM mms_connectorspace WHERE object_id='<object ID from the previous statement>'

1

2

3

4

5

DELETE FROM mms_cs_link WHERE object_id='<object ID from the previous statement>'

DELETE FROM mms_csmv_link WHERE cs_object_id='<object ID from the previous statement>'

DELETE FROM mms_connectorspace WHERE object_id='<object ID from the previous statement>'

Restarted the FIM Services
Run the FIM Sync to see if the issue fixed.

By Piyush Khandelwal, 7 years ago

ADConnect

Quick Tip: Get local time for next AzureAD Sync

When you run the command

Get-ADSyncScheduler

1	Get-ADSyncScheduler

You get an output similar to

AllowedSyncCycleInterval : 00:30:00
CurrentlyEffectiveSyncCycleInterval : 01:00:00
CustomizedSyncCycleInterval : 01:00:00
NextSyncCyclePolicyType : Delta
NextSyncCycleStartTimeInUTC : 18/05/2017 10:55:42 PM
PurgeRunHistoryInterval : 7.00:00:00
SyncCycleEnabled : True
MaintenanceEnabled : True
StagingModeEnabled : False
SchedulerSuspended : False
SyncCycleInProgress : False

You will notice that the time is in UTC..

Quick one-liner can show you local time

(Get-ADSyncScheduler).NextSyncCycleStartTimeInUTC.ToLocalTime()

1	(Get-ADSyncScheduler).NextSyncCycleStartTimeInUTC.ToLocalTime()

Output is more sane

Friday, 19 May 2017 8:55:42 AM

By Piyush Khandelwal, 7 years ago

ADConnect

Extending Azure AD Schema via Graph API – The n00b Guide

I’ve been playing recently on try to figure out how I can extend the Azure AD Schema for my tenant.

In my endeavor, I have come across (till now) two way to do it:

Using AADConnect and selecting directory extension to create the attribute in AzureAD in the form of “extension_{AppClientId}_{attributeName}“. This method works only if I have the custom attribute already in my on prem AD.
Using Graph API to create it directly in Azure AD

Will expand on point 2 in this post. In our scenario, we have some custom attributes which are stored in AD LDS. For security and other reasons we didn’t want those attributes to be in our AD.

Goal

Create custom attributes in Azure AD when they are not available to be done via AADConnect Interface

Solution

Whenever AADConnect is installed for your tenant, it creates an app called “Tenant Schema Extension App”. You can find it in Azure Portal AAD Blade.

Click on the App and note its “Object ID”
Open https://graphexplorer.azurewebsites.net/
Login with the credentials which have write access to AAD (Global Admin or sorts).
In the main window select GET and put in the following URL :

https://graph.windows.net/myorganization/applications/<ObjectID>

You will see the App details in the window

To look at its extensionProperties (which shows the custom attributes created) goto the following link

https://graph.windows.net/myorganization/applications/<ObjectID>/extensionProperties

As you would see that it has some custom attributes I have created. The “name” tag has the attribute name with is “extension_{AppClientId}_{attributeName}“.

To create a new attribute change the GET to POST and put in the following code to create a new attribute called “newAttribute”

{
    "name": "newAttribute",
    "dataType": "String",
    "targetObjects": [
        "User"
		
    ]
}

1

2

3

4

5

6

7

8

{

"name": "newAttribute",

"dataType": "String",

"targetObjects": [

"User"

]

}

Press GO and it will create the new attribute for you

There you go. newAttribute is created and your schema has been extended in Azure AD. You can simply delete that by changing the type to DELETE and putting the URL

https://graph.windows.net/myorganization/applications/<ObjectID of App>/extensionProperties/<ObjectID of attribute>

Limitations

Now here is the bummer. For my scenario I thought when I do then and “Refresh Schema” in AADConnect for AzureAD MA, it will be visible and then I can create custom rules and flows from AD LDS (via Generic LDAP MA). BUT you still can’t see it (tested as of v1.1.524.0) . Microsoft says that this is as per design at the moment. They are thinking of future enhancements or even integrating AD LDS as an option in GUI.

Moreover, if you had directory extension done even by using the GUI (using custom attributes from AD), and you do a refresh schema – it looses those as well saying

The Attribute ‘extension_<GUID>_customAttribute’ could not be located in the schema.

I call this a bug rather than design.

Well, in the end, I couldn’t get to reach my end goal (provisioning values from AD LDS to AzureAD via custom schema) but atleast got there half way and understood how to create custom Attributes in Azure AD via Graph API.

There is more cool stuff you can do with graphAPI and for the people who are hardcore programmers.. not me atm.. Hit up the links below..

References

By Piyush Khandelwal, 7 years ago

MIM

FIM/MIM Powershell: XPath Demystified

I have been promising to get this post out there.. So here it is..

If you make extensive use of Lithnet ResourceManagement Powershell for MIM/FIM (You should if you don’t) you will probably be using the cmdlets “Search-Resources” or “Search-ResourcesPaged” which require an “-XPATH” input.

Now my xpath is real bad in for a complicated search.

Thankfully Ryan (Lithnet God) has written a few tools to make it easier for us to write xpath queries. We would use his cmdlets like New-XPathQuery , New-XPathQueryGroup and New-XPathExpression

Let’s start with simple query: Find everyone whose AccountName (string) starts with “P”

Import-Module lithnetrma
Set-ResourceManagementClient -BaseAddress "http://fimservice:5725"

$a = New-XPathQuery -AttributeName AccountName -Operator StartsWith -Value "P"
$b = New-XPathExpression -ObjectType Person -QueryObject $a
$b.ToString()

1

2

3

4

5

6

Import-Module lithnetrma

Set-ResourceManagementClient -BaseAddress "http://fimservice:5725"

$a = New-XPathQuery -AttributeName AccountName -Operator StartsWith -Value "P"

$b = New-XPathExpression -ObjectType Person -QueryObject $a

$b.ToString()

Output

/Person[(starts-with(AccountName, ‘P’))]

Easy yeah?

Lets do a boolean: Find every user for whom accountDisabled (Boolean) is present

Import-Module lithnetrma
Set-ResourceManagementClient -BaseAddress "http://fimservice:5725" 

$a = New-XPathQuery -AttributeName accountDisabled -Operator IsPresent
$b = New-XPathExpression -ObjectType Person -QueryObject $a
$b.ToString()

1

2

3

4

5

6

Import-Module lithnetrma

Set-ResourceManagementClient -BaseAddress "http://fimservice:5725"

$a = New-XPathQuery -AttributeName accountDisabled -Operator IsPresent

$b = New-XPathExpression -ObjectType Person -QueryObject $a

$b.ToString()

Output

/Person[((accountDisabled = true) or (accountDisabled = false))]

Lets do a complex one: Find all users who Email Starts with “P” and are not disabled

Import-Module lithnetrma
Set-ResourceManagementClient -BaseAddress "http://fimservice:5725" 

$a = New-XPathQuery -AttributeName Email -Operator StartsWith -Value "P"
$b = New-XPathQuery -AttributeName accountDisabled -Operator Equals -Value $false
$group = New-XPathQueryGroup -Operator And -Queries @($a,$b)

$result = New-XPathExpression -ObjectType Person -QueryObject $group
$result.ToString()

1

2

3

4

5

6

7

8

9

Import-Module lithnetrma

Set-ResourceManagementClient -BaseAddress "http://fimservice:5725"

$a = New-XPathQuery -AttributeName Email -Operator StartsWith -Value "P"

$b = New-XPathQuery -AttributeName accountDisabled -Operator Equals -Value $false

$group = New-XPathQueryGroup -Operator And -Queries @($a,$b)

$result = New-XPathExpression -ObjectType Person -QueryObject $group

$result.ToString()

Output

/Person[((starts-with(Email, ‘P’)) and (accountDisabled = False))]

You can see how you can build on this..

One final one: Find all accounts which have an email address starting with P and are not disabled or which have an AccountName and have Email containing “p@”

Import-Module lithnetrma
Set-ResourceManagementClient -BaseAddress "http://fimservice:5725" 

$a = New-XPathQuery -AttributeName Email -Operator StartsWith -Value "P"
$b = New-XPathQuery -AttributeName accountDisabled -Operator Equals -Value $false
$c = New-XPathQuery -AttributeName AccountName -Operator IsPresent
$d = New-XPathQuery -AttributeName Email -Operator Contains -Value "p@"

$group1 = New-XPathQueryGroup -Operator And -Queries @($a,$b)
$group2 = New-XPathQueryGroup -Operator And -Queries @($c,$d)

$finalgroup = New-XPathQueryGroup -Operator Or -Queries @($group1,$group2)

$result = New-XPathExpression -ObjectType Person -QueryObject $finalgroup
$result.ToString()

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

Import-Module lithnetrma

Set-ResourceManagementClient -BaseAddress "http://fimservice:5725"

$a = New-XPathQuery -AttributeName Email -Operator StartsWith -Value "P"

$b = New-XPathQuery -AttributeName accountDisabled -Operator Equals -Value $false

$c = New-XPathQuery -AttributeName AccountName -Operator IsPresent

$d = New-XPathQuery -AttributeName Email -Operator Contains -Value "p@"

$group1 = New-XPathQueryGroup -Operator And -Queries @($a,$b)

$group2 = New-XPathQueryGroup -Operator And -Queries @($c,$d)

$finalgroup = New-XPathQueryGroup -Operator Or -Queries @($group1,$group2)

$result = New-XPathExpression -ObjectType Person -QueryObject $finalgroup

$result.ToString()

Output

/Person[(((starts-with(Email, ‘P’)) and (accountDisabled = False)) or ((starts-with(AccountName, ‘%’)) and (contains(Email, ‘p@’))))]

Above searches might not make sense logically in real world scenarios but what I am trying to show here is that how easy it is to build complex XPath search strings without knowing the XPath language and doing it pretty easily on Powershell.. (And don’t get me started how many times I have messed up the brackets 😛 )

Enormous potential and implantation capabilities if you come to think of it..

By Piyush Khandelwal, 7 years05/15/2017 ago

Braindump in Progress...

ADConnect

AzureAD: Get List of all users with a particular license

Like this:

MIM

Fixing MIM Error: The dimage indicates an update or replace operation, but the image doesn’t exist.

Like this:

ADConnect

Quick Tip: Get local time for next AzureAD Sync

Like this:

ADConnect

Extending Azure AD Schema via Graph API – The n00b Guide

Goal

Solution

Limitations

References

Like this:

MIM

FIM/MIM Powershell: XPath Demystified

Like this:

Braindump in Progress...

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Goal

Solution

Limitations

References

Share this:

Like this:

Share this:

Like this: