PowerShell-Scripts/NewAppRegistrationGraphAPI.ps1

146 lines
4.7 KiB
PowerShell

# Ensure Microsoft.Graph module is installed
if (-not (Get-Module -ListAvailable -Name Microsoft.Graph)) {
Write-Host "Installing Microsoft.Graph module..."
Install-Module -Name Microsoft.Graph -Force -AllowClobber
}
# Import necessary modules
Import-Module Microsoft.Graph.Authentication
Import-Module Microsoft.Graph.Applications
# Connect to Microsoft Graph with required permissions
Connect-MgGraph -Scopes "Application.ReadWrite.All", "Directory.ReadWrite.All", "AppRoleAssignment.ReadWrite.All" -NoWelcome
# Application details
$Name = "GraphAPI"
$Scope = "User.Read.All", "User.ReadWrite.All", "Group.Read.All", "Group.ReadWrite.All"
# Fetch Microsoft Graph Service Principal
$graphSp = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"
$graphRoles = $graphSp.AppRoles
# Debugging: Confirm AppRoles permissions
# Write-Host "`n🔍 Retrieved AppRoles from Microsoft Graph:"
# $graphRoles | Format-Table DisplayName, Id, Value -AutoSize
# Build required resource access list
$resourceAccess = @()
foreach ($perm in $Scope) {
$permId = ($graphRoles | Where-Object { $_.Value -eq $perm }).Id
if ($permId) {
$resourceAccess += @{
"id" = $permId
"Type" = "Role" # Use "Scope" if using delegated permissions
}
} else {
Write-Host "⚠️ Skipping $perm - Role ID not found in Microsoft Graph."
}
}
# Debugging: Confirm matched permissions
# Write-Host "`n✅ Final Mapped Permissions:"
# $resourceAccess | Format-Table -AutoSize
# Define app creation body
$body = @{
DisplayName = $Name
SignInAudience = "AzureADMyOrg"
RequiredResourceAccess = @(
@{
ResourceAppId = "00000003-0000-0000-c000-000000000000" # Microsoft Graph
ResourceAccess = $resourceAccess
}
)
}
# Convert body to JSON
$payload = $body | ConvertTo-Json -Depth 4
# Create the application
Write-Host "Creating Azure AD application..."
$app = New-MgApplication -BodyParameter $payload
if (-not $app) {
Write-Host "❌ Failed to create application. Exiting."
exit
}
Write-Host "✅ Application Created: $($app.Id)"
# Wait for the application to propagate
Start-Sleep -Seconds 10
Write-Host "⏳ Waiting for application propagation..."
# Create Service Principal
Write-Host "Creating Service Principal..."
$servicePrincipal = New-MgServicePrincipal -AppId $app.AppId
if (-not $servicePrincipal) {
Write-Host "❌ Failed to create Service Principal. Exiting."
exit
}
Write-Host "✅ Service Principal created: $($servicePrincipal.Id)"
# Wait for service principal to propagate
Start-Sleep -Seconds 10
Write-Host "⏳ Waiting for application permissions to propagate..."
# Grant Admin Consent
foreach ($access in $resourceAccess) {
# Write-Host "`n🔹 About to grant admin consent for:"
# Write-Host " ➜ AppRoleId: $($access.id)"
# Write-Host " ➜ ServicePrincipalId: $($servicePrincipal.Id)"
# Write-Host " ➜ PrincipalId: $($servicePrincipal.Id)"
# Write-Host " ➜ ResourceId: $($graphSp.Id)"
try {
$null = New-MgServicePrincipalAppRoleAssignment `
-ServicePrincipalId $servicePrincipal.Id `
-PrincipalId $servicePrincipal.Id `
-ResourceId $graphSp.Id `
-AppRoleId $access.id
Write-Host "✅ Successfully granted admin consent for AppRoleId: $($access.id)"
} catch {
Write-Host "❌ Failed to grant admin consent for AppRoleId: $($access.id) - $_"
}
}
Write-Host "`n🎉 Admin consent process completed!"
# -------------------------------
# CREATE CLIENT SECRET
# -------------------------------
Write-Host "`n🔐 Creating Client Secret..."
$secretStartDate = Get-Date
$secretEndDate = $secretStartDate.AddYears(1) # Secret valid for 1 year
$clientSecret = Add-MgApplicationPassword -ApplicationId $app.Id -PasswordCredential @{
DisplayName = "GraphAPI-ClientSecret"
StartDateTime = $secretStartDate
EndDateTime = $secretEndDate
}
if (-not $clientSecret) {
Write-Host "❌ Failed to create client secret. Exiting."
exit
}
Write-Host "✅ Client Secret Created!"
# -------------------------------
# PRINT CREDENTIALS (STORE SECURELY!)
# -------------------------------
$tenantId = (Get-MgOrganization).Id
Write-Host "`n🚀 **Application Credentials**"
Write-Host "----------------------------------"
Write-Host "🌐 Tenant ID: $tenantId"
Write-Host "🔑 Client ID: $($app.AppId)"
Write-Host "🕵️‍♂️ Client Secret: $($clientSecret.SecretText)"
Write-Host "----------------------------------"
Write-Host "`n⚠️ **IMPORTANT:** Store the Client Secret securely. It will not be retrievable after this session."