Skip to content

Instantly share code, notes, and snippets.

@svarukala
Last active November 28, 2022 14:14
Show Gist options
  • Save svarukala/f23e6ee03e7516b1520469e9730a4515 to your computer and use it in GitHub Desktop.
Save svarukala/f23e6ee03e7516b1520469e9730a4515 to your computer and use it in GitHub Desktop.
This script uses Microsoft Graph PowerShell SDK. It is helpful to identify and inventorize all the Azure AD Applications registered in your tenant. The script enumerates the KeyCredentials (Certificates) and PasswordCredentials (Client Secret) keys, expiration dates, owner and other useful information.
Connect-MgGraph -Scopes "User.Read.All","Group.ReadWrite.All","Application.Read.All", "Application.ReadWrite.All", "Directory.Read.All", "Directory.ReadWrite.All", "Directory.AccessAsUser.All"
$Apps = Get-MgApplication -All
$today = Get-Date
$credentials = @()
$Apps | %{
$aadAppObjId = $_.Id
$app = Get-MgApplication -ApplicationId $aadAppObjId
$owner = Get-MgApplicationOwner -ApplicationId $aadAppObjId
$app.KeyCredentials | %{
#write-host $_.KeyId $_.DisplayName
$credentials += [PSCustomObject] @{
CredentialType = "KeyCredentials";
DisplayName = $app.DisplayName;
AppId = $app.AppId;
ExpiryDate = $_.EndDateTime;
StartDate = $_.StartDateTime;
#KeyID = $_.KeyId;
Type = $_.Type;
Usage = $_.Usage;
Owners = $owner.AdditionalProperties.userPrincipalName;
Expired = if(([DateTime]$_.EndDateTime) -lt $today) {"yes"} else{ "No"};
}
}
$app.PasswordCredentials | %{
#write-host $_.KeyId $_.DisplayName
$credentials += [PSCustomObject] @{
CredentialType = "PasswordCredentials";
DisplayName = $app.DisplayName;
AppId = $app.AppId;
ExpiryDate = $_.EndDateTime;
StartDate = $_.StartDateTime;
#KeyID = $_.KeyId;
Type = 'NA';
Usage = 'NA';
Owners = $owner.AdditionalProperties.userPrincipalName;
Expired = if(([DateTime]$_.EndDateTime) -lt $today) {"yes"} else{ "No"};
}
}
}
$credentials | FT -AutoSize
# Optionally export to a CSV file
#$credentials | Export-Csv -Path "AppsInventory.csv" -NoTypeInformation
@amlijupnandanan
Copy link

Is it possible to do this with C# or python.. like need to implement this in web application level

@svarukala
Copy link
Author

@ashmsport yes, see this: https://dev.to/svarukala/manage-azure-ad-enterprise-applications-permissions-using-microsoft-graph-powershell-222m

@amlijupnandanan yes, you must use MS Graph rest endpoint. The above script essentially doing the same except it's using PS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment