andyrobbins

$URI = 'https://graph.microsoft.com/beta/auditLogs/signIns?api-version=beta&source=kds'
$Count = 0
do {
    #$AppToken = (Get-MSGraphTokenWithClientCredentials `
    #    -ClientID "..." `
    #    -ClientSecret "..." `
    #    -TenantName "...").access_token
    $AppToken = $GlobalAdminToken.access_token
    Write-Host "Enumerating page" $Count
    $Results = Invoke-RestMethod `

andyrobbins

Function Get-AllEntraDevices {
    <#
    .SYNOPSIS
        Retrieves all JSON-formatted Entra device objects using the MS Graph API
    
        Author: Andy Robbins (@_wald0)
        License: GPLv3
        Required Dependencies: None
    
    .DESCRIPTION

andyrobbins

apiVersion: v1
kind: Pod
metadata:
  name: command-demo-2
  labels:
    purpose: demonstrate-command
spec:
  containers:
  - name: command-demo-container
    image: debian

andyrobbins

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx:1.14.2
    ports:
    - containerPort: 8123

andyrobbins

# Function for getting an MS Graph Token
Function Get-MSGraphToken {
    <#
    .DESCRIPTION
    Requests a token from STS with the MS Graph specified as the resource/intended audience
    #>
    [cmdletbinding()]
    param(
        [Parameter(Mandatory = $True)]
        [string]

andyrobbins

Function Get-ARMAPIToken {
    <#
    .DESCRIPTION
    Requests a token from STS with the MS Graph specified as the resource/intended audience
    #>
    [cmdletbinding()]
    param(
        [Parameter(Mandatory = $True)]
        [string]
        $ClientID,

andyrobbins

$psversiontable

andyrobbins

## Granting Global Admin rights by chaining AppRoleAssignment.ReadWrite.All into RoleManagement.ReadWrite.Directory

# Helper function to let us parse Azure JWTs:
function Parse-JWTtoken {
    <#
    .DESCRIPTION
    Decodes a JWT token. This was taken from link below. Thanks to Vasil Michev.
    .LINK
    https://www.michev.info/Blog/Post/2140/decode-jwt-access-and-id-tokens-via-powershell
    #>

andyrobbins

## Find dangerous API permissions as a user

$AzureTenantID = '<Your tenant ID>'
$AccountName = '<Username>@<Domain.com>'
$Password = ConvertTo-SecureString '<Your password>' -AsPlainText -Force
$Credential = New-Object System.Management.Automation.PSCredential($AccountName, $Password)
Connect-AzAccount -Credential $Credential -TenantID $AzureTenantID

function Get-AzureGraphToken
{

andyrobbins