Automating Azure AD

Up until this point, we’ve focused on using Power Automate as a workflow engine from a user’s perspective. We’ve focused on processing email, SharePoint lists and documents, files and folders, and approval workflows.

Shifting gears away from purely business application automation, we’re going to look at Power Automate’s capabilities when it comes to working directly with Azure Active Directory (Azure AD or AAD) administration. Azure AD is the identity storage used for applications and services across the Microsoft 365 ecosystem. When it comes to reporting or group management there are a number of routine operational tasks that hold potential for automation. From an administrative perspective, they can be important tasks that come at a high labor cost if you need to continuously task switch between a ticketing system and one or more administrative interfaces.

While Azure AD does have a lot of native group management and...

Technical requirements

Since we’re going to be working with Azure AD to retrieve user data, you’ll need an account that has global administrator access to configure your Azure AD and Microsoft 365 environments. If you’re following along using a trial tenant that you created, you should already have all of the required permissions. However, if you’re working on this in a production tenant where you don’t have the required rights, you’ll need to work with administrators who can configure the appropriate delegated permissions in the Configuring prerequisites section.

In addition to required permissions, you’ll need to walk through a procedure to configure MFA in your tenant. Configuring MFA is outside the scope of this book. However, if you are interested in learning more about it or configuring it, you can visit https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted.

While MFA doesn...

Learning about connectors and actions

In this chapter, we’re going to build on knowledge gained in other chapters, such as working with conditions, dynamic content tokens, and sending emails. We’re going to then layer on several new concepts surrounding Azure AD, including the HTTP, Parse JSON, and Create CSV table actions.

HTTP action

While working with Azure AD can typically be done using the standard Azure AD connector objects (such as the Azure AD connector and the Office 365 Groups connector), the property that stores MFA registration information is not exposed through those connectors.

In order to retrieve this data, we’ll need to look to another source: the Microsoft Graph API (commonly referred to as just the Graph API). The Microsoft Graph API is a REST-based API that allows you to interact with data stored in Azure AD. Since the data we’re looking for is stored in Azure AD, the Graph API is the natural choice for working with this...

Configuring prerequisites

Since the HTTP flow that we’re going to configure doesn’t have a way to enter a traditional username and password as the authentication mechanism, we’re going to create or register a special application with the appropriate permissions.

In addition, you’ll also need to configure a client secret, which is the application’s equivalent to a password. Together, the tenant information, application information, and client secret will be used to provide the necessary authentication to execute the flow.

Configuring an Azure AD application

To register a new Azure AD application for this flow, follow these steps:

1. Log in to the Azure AD portal (https://portal.azure.com) using an identity with global administrator privileges.
2. In the search bar, search for App registrations and select it:

Figure 15.1: Navigating the Azure portal

3. Click New registration:

Figure 15.2: Creating...

Creating an HTTP flow

In this section, we’re going to create the flow to retrieve the MFA registration data. Let’s begin!

Gathering the data

The first part of creating the flow is going to require connecting to Azure AD to retrieve the data necessary for building a report. We’ll use an HTTP action to query Azure AD.

In this chapter, we’re just going to focus on one of the REST resources in the Microsoft Graph API endpoint. There are hundreds of different resources that you can work with to retrieve and modify data. For a complete list of Graph API resources, see https://docs.microsoft.com/en-us/graph/api/overview.

To configure the HTTP action, follow these steps:

1. Navigate to the Power Automate web portal (https://flow.microsoft.com) and click Create.
2. Click Scheduled cloud flow.
3. Configure a Flow name.
4. Configure the schedule settings under Run this flow to execute weekly, and click Create when finished...

Testing the flow

To test this flow, you can click Test in the upper-right hand corner of the Power Automate canvas area, as shown in Figure 15.32:

Figure 15.32: Testing the flow

Select the options to manually kick off a test flow. After successfully launching a test, you can watch the active run history in the Power Automate canvas area, as shown in Figure 15.33:

Figure 15.33: Watching a flow run

If any of the actions or steps return errors, you can expand the step and review the output.

Verifying the flow

The final step is going to be reviewing the email that was sent. To do so, log into the mailbox that was used as the recipient for the Send an email (V2) action and look for the message:

Figure 15.34: Reviewing the email message with the attached report

You can open the attachment and view the details, as shown in Figure 15.35:

Figure 15.35: Examining the attachment

If everything worked correctly, you should have a report that includes all users in your Microsoft 365 tenant that do not have MFA enabled.

Expanding further

In addition to just creating CSV output, you can also explore richer data alternatives. One such option is to create an HTML table to include directly in the email.

The Create HTML table data action functions identically to the Create CSV table action, with the exception that the output is basic HTML-formatted data instead of comma-separated data. You can potentially improve your email’s usability by including the HTML output in the body of the email message.

Summary

Being able to work with Azure AD opens up a lot of administration and reporting tasks to automation. Using Power Automate to help process reporting data or other administrative tasks can potentially free up precious time to work on other high-value tasks.

In this chapter, you learned how to start working with Azure AD directly. You learned how to interact with the Microsoft Graph API to retrieve data about MFA information, parse and filter it, and then add the output as a CSV attachment to an email. You were introduced to several new actions (including HTTP, Parse JSON, and Create CSV table) and used them to retrieve and format data in a way that could be easily interpreted by a person.

In the next chapter, we’re going to start working with robotic process automation.

Learn more on Discord

To join the Discord community for this book – where you can share feedback, ask questions to the author, and learn about new releases – follow the QR...