英文:
Find AzureAD IDP Enterprise Apps with Users/Groups AND Owners
问题
尝试导出所有Azure AD IDP企业应用程序以及它们关联的用户、组和所有者。我能够获取用户和组,但无法获取所有者,代码如下:
foreach ($servicePrincipal in $ServicePrincipalList) {
Get-AzureADServiceAppRoleAssignment -ObjectId $ServicePrincipal.objectId | Select-Object ResourceDisplayName, ResourceId, PrincipalDisplayName, PrincipalType | Export-Csv -Path "C:\\PSReports\\AzureAD_IDP_Apps - $date.csv" -NoTypeInformation -Append
}
这将生成以下结果:AzureAD_IDP_Apps导出截图
即使应用程序没有分配任何所有者,我希望报告也能显示它。
尝试查找“所有者”值的PrincipalType,但未能找到。
英文:
Trying to export all Azure AD IDP Enterprise applications with their associated Users and Groups and Owners. I'm able to grab the Users and Groups but not the owners with this:
foreach($servicePrincipal in $ServicePrincipalList){
Get-AzureADServiceAppRoleAssignment -ObjectId $ServicePrincipal.objectId | Select-Object ResourceDisplayName, ResourceId, PrincipalDisplayName, PrincipalType | Export-Csv -Path "C:\\PSReports\\AzureAD_IDP_Apps - $date.csv" -NoTypeInformation -Append
}
which produces this:
AzureAD_IDP_Apps Export Screenshot (https://i.stack.imgur.com/U002O.png)
Even if the application does not have any owners assigned, I'd like the report to show it.
Tried finding the PrincipalType for the "Owners" value but was unable to find it
答案1
得分: 0
无法找到“Owners”值的PrincipalType,但找不到它。
您可以使用以下代码获取服务主体的所有者,并导出所有Azure AD IDP企业应用程序以及它们关联的用户、组和所有者。
命令:
$date = Get-Date -Format "yyyyMMddHHmmss"
$ServicePrincipalList = Get-AzureADServicePrincipal -All $true
foreach($servicePrincipal in $ServicePrincipalList){
$owners = Get-AzureADServicePrincipalOwner -ObjectId $servicePrincipal.ObjectId | Select-Object DisplayName, UserPrincipalName
$appRoles = Get-AzureADServiceAppRoleAssignment -ObjectId $servicePrincipal.ObjectId | Select-Object ResourceDisplayName, ResourceId, PrincipalDisplayName, PrincipalType
$report = $appRoles | Select-Object ResourceDisplayName, ResourceId, PrincipalDisplayName, PrincipalType
$owners | ForEach-Object {
$owner = $_
$report | Add-Member -MemberType NoteProperty -Name "OwnerDisplayName" -Value $owner.DisplayName
$report | Add-Member -MemberType NoteProperty -Name "OwnerUserPrincipalName" -Value $owner.UserPrincipalName
}
$report | Export-Csv -Path "C:\\Users\\Documents\\folder1\\important-$date.csv" -NoTypeInformation -Append -Force
}
文件:
英文:
> Tried finding the PrincipalType for the "Owners" value but was unable to find it
You can use the below code to get the owner of the service principal and you can export all Azure AD IDP Enterprise applications with their associated Users and Groups and Owners.
Command:
$date = Get-Date -Format "yyyyMMddHHmmss"
$ServicePrincipalList = Get-AzureADServicePrincipal -All $true
foreach($servicePrincipal in $ServicePrincipalList){
$owners = Get-AzureADServicePrincipalOwner -ObjectId $servicePrincipal.ObjectId | Select-Object DisplayName, UserPrincipalName
$appRoles = Get-AzureADServiceAppRoleAssignment -ObjectId $servicePrincipal.ObjectId | Select-Object ResourceDisplayName, ResourceId, PrincipalDisplayName, PrincipalType
$report = $appRoles | Select-Object ResourceDisplayName, ResourceId, PrincipalDisplayName, PrincipalType
$owners | ForEach-Object {
$owner = $_
$report | Add-Member -MemberType NoteProperty -Name "OwnerDisplayName" -Value $owner.DisplayName
$report | Add-Member -MemberType NoteProperty -Name "OwnerUserPrincipalName" -Value $owner.UserPrincipalName
}
$report | Export-Csv -Path "C:\\Users\\Documents\\folder1\\important-$date.csv" -NoTypeInformation -Append -Force
}
file:
答案2
得分: 0
这个修复了它。当添加了 -join
选项后,如果有多个所有者,它会将它们添加为一个由分号分隔的单个字符串:
Connect-AzureAD
$date = Get-Date -Format “yyyyMMddHHmmss”
$ServicePrincipalList = Get-AzureADServicePrincipal -All $true
foreach($servicePrincipal in $ServicePrincipalList){
$owners = Get-AzureADServicePrincipalOwner -ObjectId $servicePrincipal.ObjectId | Select-Object DisplayName, UserPrincipalName
$appRoles = Get-AzureADServiceAppRoleAssignment -ObjectId $servicePrincipal.ObjectId | Select-Object ResourceDisplayName, ResourceId, PrincipalDisplayName, PrincipalType
$report = $appRoles | Select-Object ResourceDisplayName, ResourceId, PrincipalDisplayName, PrincipalType
$report | Add-Member -MemberType NoteProperty -Name “OwnerDisplayName” -Value ($owners.DisplayName -join ‘;’)
$report | Add-Member -MemberType NoteProperty -Name “OwnerUserPrincipalName” -Value ($owners.UserPrincipalName -join ‘;’)
$report | Export-Csv -Path “C:\PSReports\AzureAD_IDP_Apps-$date.csv” -NoTypeInformation -Append -Force
}
英文:
This fixed it. When adding -join if there are multiple owners and it adds it as a single string separated by a semi-colon:
Connect-AzureAD
$date = Get-Date -Format “yyyyMMddHHmmss”
$ServicePrincipalList = Get-AzureADServicePrincipal -All $true
*foreach($servicePrincipal in $ServicePrincipalList){ *
$owners = Get-AzureADServicePrincipalOwner -ObjectId $servicePrincipal.ObjectId | Select-Object DisplayName, UserPrincipalName*
$appRoles = Get-AzureADServiceAppRoleAssignment -ObjectId
$servicePrincipal.ObjectId | Select-Object ResourceDisplayName, ResourceId, PrincipalDisplayName, PrincipalType*
$report = $appRoles | Select-Object ResourceDisplayName, ResourceId, PrincipalDisplayName, PrincipalType*
$report | Add-Member -MemberType NoteProperty -Name “OwnerDisplayName” -Value ($owners.DisplayName -join ‘;’)*
$report | Add-Member -MemberType NoteProperty -Name “OwnerUserPrincipalName” -Value ($owners.UserPrincipalName -join ‘;’)*
$report | Export-Csv -Path “C:\PSReports\AzureAD_IDP_Apps-$date.csv” -NoTypeInformation -Append -Force*
}
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论