adds new script for administrator's reference regarding OAuth2 permission grants in Entra ID #6536

tmaestrini · 2024-12-26T00:40:10Z

…ion grants in Entra ID

…estrini/cli-microsoft365 into sample-new-entra-oauth2grant

milanholemans · 2024-12-26T01:16:09Z

Thank you @tmaestrini, could you also link the related issue to this PR?

tmaestrini · 2024-12-26T10:04:47Z

Hey @milanholemans, thanks for getting back to me! It looks like you're always on the go! 😃 That's so cool! 👍
It is a part of a script that I've used while doing some work-related tasks. There is no related issue – the PR only adds a new script sample.

milanholemans · 2024-12-26T10:45:24Z

Since we handle the principle of 1 issue = 1PR, could you create an issue for the completeness?

tmaestrini · 2024-12-26T16:58:15Z

Hey @milanholemans, sorry I missed that. See reference to issue in description field above.

martinlingstuyl

Hi @tmaestrini, my swiss, italian friend 🥂 I really love this sample, well done! I do have some comments to dot the t's and cross the i's. (or was that the other way around 😅) But anyway, let's look at some comments before we merge this!

docs/docs/sample-scripts/entra/entra-remove-oauth2-permission-grants/index.mdx

docs/docs/sample-scripts/entra/entra-remove-oauth2-permission-grants/assets/sample.json

… script

…ription

…mples

tmaestrini · 2025-01-08T22:25:19Z

@martinlingstuyl Muchas gracias, amigo! 🙌 Happy New Years 🥂 – and thank you very much for the review. Great balls of fire!
I've implemented all the fixes. Ready for review again!

martinlingstuyl

OK @tmaestrini, some last really small comments from my side. Let's fix those before we merge it. Very nice work!

martinlingstuyl · 2025-01-09T07:53:28Z

docs/docs/sample-scripts/entra/entra-remove-oauth2-permission-grants/assets/sample.json

+    "updateDateTime": "2024-12-25",
+    "shortDescription": "Find and remove all OAuth2 permission grants that have been assigned to a specific enterprise application (or service principal).",
+    "longDescription": [
+      "Find and remove all OAuth2 permissions assigned to a specific enterprise application by selecting one of the following removal options: **All permissions** / Permissions granted **by an administrator** / Permissions granted **to users**."


I'd suggest rephrasing this slightly:

Suggested change

"Find and remove all OAuth2 permissions assigned to a specific enterprise application by selecting one of the following removal options: **All permissions** / Permissions granted **by an administrator** / Permissions granted **to users**."

"Find and remove all OAuth2 permissions assigned to a specific enterprise application by selecting one of the following removal options: **All permissions** / Permissions granted **by an administrator** / Permissions consented to **by users**."

martinlingstuyl · 2025-01-09T07:55:32Z

docs/docs/sample-scripts/entra/entra-remove-oauth2-permission-grants/index.mdx

+
+Author: [Tobias Maestrini](https://github.com/tmaestrini)
+
+From an administrator's perspective, managing OAuth2 permission grants that have been assigned to an enterprise application (used in a multi-tenant app or your own app registration) can be a challenging task.


Let's swap them around (that's just a feeling, feel free to ignore) and slightly rephrase.

Suggested change

From an administrator's perspective, managing OAuth2 permission grants that have been assigned to an enterprise application (used in a multi-tenant app or your own app registration) can be a challenging task.

From an administrator's perspective, managing OAuth2 permission grants that have been assigned to an enterprise application (based on an app registration or a multi-tenant app) can be a challenging task.

martinlingstuyl · 2025-01-09T07:56:10Z

docs/docs/sample-scripts/entra/entra-remove-oauth2-permission-grants/index.mdx

+    Removes OAuth2 permission grants in a specific enterprise application (or service principal) in Entra ID.
+
+  .DESCRIPTION
+    Find and remove all OAuth2 permissions assigned to a specific enterprise application by selecting one of the following removal options: **All permissions** / Permissions granted **by an administrator** / Permissions granted **to users**.


Suggested change

Find and remove all OAuth2 permissions assigned to a specific enterprise application by selecting one of the following removal options: **All permissions** / Permissions granted **by an administrator** / Permissions granted **to users**.

Find and remove all OAuth2 permissions assigned to a specific enterprise application by selecting one of the following removal options: **All permissions** / Permissions granted **by an administrator** / Permissions consented to **by users**.

martinlingstuyl · 2025-01-09T07:57:12Z

docs/docs/sample-scripts/entra/entra-remove-oauth2-permission-grants/index.mdx

+    - User must have appropriate permissions in Entra ID to manage OAuth2 permission grants (e.g. Global Admin)
+
+  .LINK
+    https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/manage-application-permissions


Suggested change

https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/manage-application-permissions

https://learn.microsoft.com/azure/active-directory/manage-apps/manage-application-permissions

martinlingstuyl · 2025-01-09T07:57:33Z

docs/docs/sample-scripts/entra/entra-remove-oauth2-permission-grants/index.mdx

+
+  .NOTES
+    Prerequisites:
+    - Microsoft 365 CLI (m365) must be installed and configured


Suggested change

- Microsoft 365 CLI (m365) must be installed and configured

- CLI for Microsoft 365 (m365) must be installed and configured

martinlingstuyl · 2025-01-09T08:00:22Z

docs/docs/sample-scripts/entra/entra-remove-oauth2-permission-grants/index.mdx

+  .NOTES
+    Prerequisites:
+    - Microsoft 365 CLI (m365) must be installed and configured
+    - User must have appropriate permissions in Entra ID to manage OAuth2 permission grants (e.g. Global Admin)


I think the role "Cloud Application Administrator" can also be used. Let's mention that one as well to show you dont always need god mode.

And let's add one extra prerequisite:

- The Entra app registration used to sign into the CLI for Microsoft 365 must have an appropriate permission scope to manage permissions of other apps (e.g. Directory.ReadWrite.All).

You could also try to find out the least permissive scope to use here. I don't know it by heart, but Directory.ReadWrite.All is a bit massive for this.

martinlingstuyl · 2025-01-09T08:05:48Z

docs/docs/sample-scripts/entra/entra-remove-oauth2-permission-grants/index.mdx

+  function Remove-PermissionsGrants {
+    param(
+      [Parameter(Mandatory = $true)]
+      [string]$enterpriseAppName,


Let's capitalize this one, just like GrantType.

Suggested change

[string]$enterpriseAppName,

[string]$EnterpriseAppName,

You could also rename it to AppDisplayName. It's not really important here that it is called an 'enterprise' application.

Tobias Maestrini added 3 commits December 26, 2024 01:14

add new script for administrator's reference

d5f3ffe

add new script for administrator's reference regarding OAuth2 permiss…

54a95bd

…ion grants in Entra ID

Merge branch 'sample-new-entra-oauth2grant' of https://github.com/tma…

5110d4f

…estrini/cli-microsoft365 into sample-new-entra-oauth2grant

milanholemans added the pr-sample label Dec 26, 2024

tmaestrini changed the title ~~new script sample: add new script for administrator's reference regarding OAuth2 permission grants in Entra ID~~ adds new script for administrator's reference regarding OAuth2 permission grants in Entra ID Dec 26, 2024

martinlingstuyl self-assigned this Jan 8, 2025

martinlingstuyl requested changes Jan 8, 2025

View reviewed changes

martinlingstuyl marked this pull request as draft January 8, 2025 20:36

Tobias Maestrini added 8 commits January 8, 2025 22:25

change title and descriptions to clarify purpose and behaviour of the…

b20bce2

… script

change reference to correct function name in examples and script desc…

601a0d4

…ription

change script documentation to clarify scope and functionality

98f34d8

change parameter names in function declaration, function body and exa…

28a65d6

…mples

change retrieval of given enterprise app with appropriate error handling

941a3ed

change output format to JSON for every m365 cli command

f8da79e

change output messages to improve readability on console

62b74e2

add missing opening tag for comment block

0275ede

tmaestrini marked this pull request as ready for review January 8, 2025 22:25

martinlingstuyl requested changes Jan 9, 2025

View reviewed changes

martinlingstuyl marked this pull request as draft January 9, 2025 08:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

adds new script for administrator's reference regarding OAuth2 permission grants in Entra ID #6536

adds new script for administrator's reference regarding OAuth2 permission grants in Entra ID #6536

tmaestrini commented Dec 26, 2024 •

edited

Loading

milanholemans commented Dec 26, 2024

tmaestrini commented Dec 26, 2024

milanholemans commented Dec 26, 2024

tmaestrini commented Dec 26, 2024

martinlingstuyl left a comment

tmaestrini commented Jan 8, 2025

martinlingstuyl left a comment

martinlingstuyl Jan 9, 2025

martinlingstuyl Jan 9, 2025 •

edited

Loading

martinlingstuyl Jan 9, 2025

martinlingstuyl Jan 9, 2025

martinlingstuyl Jan 9, 2025

martinlingstuyl Jan 9, 2025

martinlingstuyl Jan 9, 2025

	"Find and remove all OAuth2 permissions assigned to a specific enterprise application by selecting one of the following removal options: All permissions / Permissions granted by an administrator / Permissions granted to users."
	"Find and remove all OAuth2 permissions assigned to a specific enterprise application by selecting one of the following removal options: All permissions / Permissions granted by an administrator / Permissions consented to by users."


		Author: [Tobias Maestrini](https://github.com/tmaestrini)

		From an administrator's perspective, managing OAuth2 permission grants that have been assigned to an enterprise application (used in a multi-tenant app or your own app registration) can be a challenging task.

	Find and remove all OAuth2 permissions assigned to a specific enterprise application by selecting one of the following removal options: All permissions / Permissions granted by an administrator / Permissions granted to users.
	Find and remove all OAuth2 permissions assigned to a specific enterprise application by selecting one of the following removal options: All permissions / Permissions granted by an administrator / Permissions consented to by users.

	https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/manage-application-permissions
	https://learn.microsoft.com/azure/active-directory/manage-apps/manage-application-permissions

	- Microsoft 365 CLI (m365) must be installed and configured
	- CLI for Microsoft 365 (m365) must be installed and configured

adds new script for administrator's reference regarding OAuth2 permission grants in Entra ID #6536

Are you sure you want to change the base?

adds new script for administrator's reference regarding OAuth2 permission grants in Entra ID #6536

Conversation

tmaestrini commented Dec 26, 2024 • edited Loading

milanholemans commented Dec 26, 2024

tmaestrini commented Dec 26, 2024

milanholemans commented Dec 26, 2024

tmaestrini commented Dec 26, 2024

martinlingstuyl left a comment

Choose a reason for hiding this comment

tmaestrini commented Jan 8, 2025

martinlingstuyl left a comment

Choose a reason for hiding this comment

martinlingstuyl Jan 9, 2025

Choose a reason for hiding this comment

martinlingstuyl Jan 9, 2025 • edited Loading

Choose a reason for hiding this comment

martinlingstuyl Jan 9, 2025

Choose a reason for hiding this comment

martinlingstuyl Jan 9, 2025

Choose a reason for hiding this comment

martinlingstuyl Jan 9, 2025

Choose a reason for hiding this comment

martinlingstuyl Jan 9, 2025

Choose a reason for hiding this comment

martinlingstuyl Jan 9, 2025

Choose a reason for hiding this comment

tmaestrini commented Dec 26, 2024 •

edited

Loading

martinlingstuyl Jan 9, 2025 •

edited

Loading