anwather

Param($TenantId, $LogicAppName)

# Microsoft Graph App ID (DON'T CHANGE)
$GraphAppId = "00000003-0000-0000-c000-000000000000"

# Check the Microsoft Graph documentation for the permission you need for the operation
switch -Regex ($LogicAppName) {
    "group" { $PermissionNames = @("User.Read.All", "GroupMember.ReadWrite.All") }
    "licence" { $PermissionNames = @("User.ReadWrite.All") }
}

anwather

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "input": {
      "value": {
        "Name": "Deploy-VNET-HubConnection",
        "ResourceType": "Microsoft.Authorization/policyDefinitions",
        "Properties": {
          "Description": "This policy deploys a virtual wan hub network connection",

anwather

{
    "mode": "All",
    "policyRule": {
        "if": {
            "allOf": [
                {
                    "field": "type",
                    "equals": "Microsoft.Resources/subscriptions"
                }
            ]

anwather

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        {

anwather

$app_id = ""
$tenant_id = ""
$app_key = ""

function Get-GraphToken {
    Param([string]$ApplicationId, $TenantName, $AppPassword)

    $Url = "https://login.microsoftonline.com/$TenantName/oauth2/v2.0/token"

    $Body = @{

anwather

Connect-MgGraph -ClientId $app_id -TenantId $tenant_id -CertificateThumbprint $cert.Thumbprint

Select-MgProfile -Name beta

$roleDefinitionHash = @{}

Get-MgRoleManagementDirectoryRoleDefinition | ForEach-Object {
    $roleDefinitionHash.Add($_.Id, $_.DisplayName)
}

anwather

Pre-Requisites

1. Create a key vault
2. Generate a self signed certificate in the key vault - ensure that the private key is marked as exportable
3. Export the certificate as a .cer file
4. Upload the certificate to the Azure DevOps SPN

Azure DevOps

1. Create a new variable group

anwather

enum Ensure {
    Absent
    Present
}

[DscResource()]
class classFeature {


    [DscProperty(Key)]

anwather

{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# Security assessment recommendations workbook\r\n\r\n![alt text](https://docs.microsoft.com/en-us/learn/modules/azure-well-architected-introduction/media/pillars.png \"Well-architected framework pillars\")\r\n\r\nFor more information visit [Microsoft Azure Well-Architected Framework](https://docs.microsoft.com/en-us/azure/architecture/framework/security/)"
      },
      "name": "text - 9"
    },

anwather

function Get-GraphTokenWithCertificate {
    Param([string]$ApplicationId, $TenantName, $CertificatePath)

    # Create base64 hash of certificate
    $Certificate = Get-Item $CertificatePath
    $CertificateBase64Hash = [System.Convert]::ToBase64String($Certificate.GetCertHash())

    # Create JWT timestamp for expiration
    $StartDate = (Get-Date "1970-01-01T00:00:00Z" ).ToUniversalTime()
    $JWTExpirationTimeSpan = (New-TimeSpan -Start $StartDate -End (Get-Date).ToUniversalTime().AddMinutes(2)).TotalSeconds