OfficeAndAzureTools

9.13.0

Scripts/MgGraph-Stuff.ps1

                                
# Groupmembers

$GroupName = "device_TestBIOSupdate"

$MgGroup = Get-MgGroup -Filter "displayname eq '$($GroupName)'"

$MgGroupMembers = Get-MgGroupMember -GroupId $MgGroup.Id

$MgGroupMembers

Get-MgGroupMember -GroupId 68e01767-ccfd-41fb-9154-8cfbe69a8ff6 | ForEach-Object { $_.AdditionalProperties | Format-Table }

$MgGroupMembers | ForEach-Object { $_.AdditionalProperties | Format-Table }

$Members = @(

    "C3692"

    "C3671"

    "C3707"

    "C3725"

    "C3704"

    "C3706"

    "C3570"

    "C3664"

    "C1799"

    "C3711"

    "C3722"

    "C3705"

    "C3513"

    "C3709"

)

$GroupName = "devices_01"

New-MgGroupMemberCustom -GroupName $GroupName -Members $Members

# Groep aanmaken

$CustomerCode = "KOEK"

$GroupName = "C_$($CustomerCode)_MDM_Devices_Test"

$GroupName = "C_$($CustomerCode)_MDM_Users_Test"

$GroupName = "C_$($CustomerCode)_MDM_Autopilot_Devices_Shared"

$GroupName = "C_$($CustomerCode)_MDM_Devices_Windows11Upgrade"

$GroupName = "LIC_MS365_BusinessPremium_Temp"

$mgGroup = New-MgBetaGroup -DisplayName $GroupName -MailEnabled:$False -MailNickname $GroupName -SecurityEnabled

$GroupName = "C_$($CustomerCode)_MDM_Devices_Windows10"

$MembershipRule = "(device.deviceOSVersion -startsWith `"10.0.1`") and (device.managementType -eq `"MDM`") and (device.deviceOSType -eq `"Windows`")"

$GroupName = "C_$($CustomerCode)_MDM_Devices_Windows11"

$MembershipRule = "(device.deviceOSVersion -startsWith `"10.0.2`") and (device.managementType -eq `"MDM`") and (device.deviceOSType -eq `"Windows`")"

$GroupName = "C_$($CustomerCode)_MDM_AutoPilot_Devices"

$MembershipRule = "(device.devicePhysicalIDs -any _ -contains `"[ZTDId]`")"

$MembershipRule = "(device.devicePhysicalIds -any _ -contains `"[ZTDId]`") or ((device.managementType -eq `"MDM`") and (device.deviceOSType -eq `"Windows`") and (device.deviceOwnership -eq `"Company`"))"

$GroupName = "C_$($CustomerCode)_MDM_AutoPilot_Devices_SelfDeploying"

$MembershipRule = "(device.devicePhysicalIds -any (_ -eq `"[OrderID]:SelfDeploying`"))"

$Params = @{

    MembershipRule                = $MembershipRule

    DisplayName                   = $GroupName

    MailEnabled                   = $false

    MailNickname                  = $GroupName

    SecurityEnabled               = $true

    GroupTypes                    = "DynamicMembership"

    MembershipRuleProcessingState = "On"

}

New-MgBetaGroup @Params

# User aanmaken

$Random = $(Get-Random -Minimum 1 -Maximum 10000)

$UserPrincipalName = "test.$($Random)@youandme.com"

$DisplayName = "Test $($Random)"

$Password = "$(Get-Random)1n3uow8efs@@!#"

Get-MgSubscribedSku | Format-List

New-JAADUser -UserPrincipalName $UserPrincipalName -DisplayName $DisplayName -Password $Password

Set-MgUserLicense -UserId $UserPrincipalName -AddLicenses @{SkuId = "710779e8-3d4a-4c88-adb9-386c958d1fdf" } -RemoveLicenses @()

Update-MgUser -UserId $UserPrincipalName -Surname "Test" -GivenName "User"

# Apps

$Apps = Get-MgBetaDeviceAppManagementMobileApp

$Apps | Where-Object { $_.AdditionalProperties."@odata.type" -ne "#microsoft.graph.managedIOSStoreApp" -and $_.AdditionalProperties."@odata.type" -ne "#microsoft.graph.managedAndroidStoreApp" }

$Apps | Where-Object { $_.AdditionalProperties."@odata.type" -eq "#microsoft.graph.win32LobApp" }

$iosApps = $Apps | Where-Object { $_.AdditionalProperties."@odata.type" -eq "#microsoft.graph.iosVppApp" }

$iosApps | Where-Object { $_.AdditionalProperties."@odata.type" -eq "#microsoft.graph.iosVppApp" } | Select-Object DisplayName, Publisher | Export-Excel

# Voeg nieuwe Autopilot device toe aan een groep

$ApDevices = Get-MgDeviceManagementWindowAutopilotDeviceIdentity -All | Where-Object DeploymentProfileAssignedDateTime -GT (Get-Date).AddDays(-7) | Select-Object AzureAdDeviceId

$AzDevices = Get-MgDevice -All

$ApDevices | ForEach-Object {

    $Device = $AzDevices | Where-Object DeviceId -EQ $_.AzureAdDeviceId

    $Device

    New-MgGroupMember -GroupId "68e01767-ccfd-41fb-9154-8cfbe69a8ff6" -DirectoryObjectId $Device.Id

}

# Teams WERKT NIET

Get-MgTeam

Get-MgTeamChannel -TeamId xxx

$Params = @{

    Body = @{

        ContentType = "html"

        Content     = "<h3>Hello World</h3>"

    }

}

New-MgTeamChannelMessage -TeamId "18d13f92-3f90-4f40-9411-fb6427f3ddee" -ChannelId "19:b585106cccd744b98b2a1cf96229afc5@thread.skype" -BodyParameter $Params

# PS Intune Scripts

# $Scripts = Get-MgDeviceManagementScript -All

$Scripts = Invoke-GraphRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts/"

$ScriptContent = $Scripts.value | ForEach-Object -ThrottleLimit 10 -Parallel {

    Invoke-GraphRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts/$($_.Id)"

}

$Output = @()

$ScriptContent | ForEach-Object {

    $obj = [PSCustomObject]@{

        displayName   = $_.displayName

        fileName      = $_.fileName

        scriptContent = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($($_.scriptContent)))

    }

    $Output += $obj

    #

}

$Output | Sort-Object displayName | Format-Table

$FolderPath = "$($env:TEMP)\$((Get-MgBetaOrganization).DisplayName)-PsScripts"

mkdir $FolderPath -Force

code $FolderPath

$Output | ForEach-Object {

    $_.scriptContent | Out-File -Encoding ASCII -FilePath $(Join-Path $FolderPath $($_.fileName))

}

# Azure Groups Owners and Members

$Groups = Get-MgGroup -All #| Where-Object GroupTypes -EQ 'Unified'

$Result = @()

foreach ($g in $Groups) {

    $g.Id

    $g.DisplayName

    $Team = Get-MgTeam -TeamId $g.Id -ea 0

    Get-MgGroupMember -GroupId $g.Id | ForEach-Object {

        $obj = [PSCustomObject]@{

            GroupId           = $g.Id

            DisplayName       = $g.DisplayName

            GroupMail         = $g.Mail

            TeamsSite         = $null

            UserType          = "Member"

            UserName          = $_.AdditionalProperties.displayName

            UserMail          = $_.AdditionalProperties.mail

            UserPrincipalName = $_.AdditionalProperties.userPrincipalName

            UserJobTitle      = $_.AdditionalProperties.jobTitle

        }

        if ($Team) {

            $obj.TeamsSite = "Yes"

        }

        $Result += $obj

    }

    Get-MgGroupOwner -GroupId $g.Id | ForEach-Object {

        $obj = [PSCustomObject]@{

            GroupId           = $g.Id

            DisplayName       = $g.DisplayName

            GroupMail         = $g.Mail

            TeamsSite         = $null

            UserType          = "Owner"

            UserName          = $_.AdditionalProperties.displayName

            UserMail          = $_.AdditionalProperties.mail

            UserPrincipalName = $_.AdditionalProperties.userPrincipalName

            UserJobTitle      = $_.AdditionalProperties.jobTitle

        }

        if ($Team) {

            $obj.TeamsSite = "Yes"

        }

        $Result += $obj

    }

}

$Result | Export-Excel

# User inventarisatie

$Users = Get-MgBetaUser -All -Property id, UserprincipalName, DisplayName, Usertype | Where-Object UserPrincipalName -Match "rubbercompounding.nl"

$NewUsers = $Users | Where-Object UserType -EQ Member | ForEach-Object {

    $License = Get-MgBetaUserLicenseDetail -UserId $_.id

    [PSCustomObject]@{

        UserPrincipalName = $_.UserPrincipalName

        DisplayName       = $_.DisplayName

        License           = $License.SkuPartNumber

    }

}

$NewUsers | Format-Table -AutoSize

## Drivers update ring

(Invoke-GraphRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/windowsDriverUpdateProfiles/7f81ecb1-84dd-47d6-8061-97f3530a217a/driverInventories?`$filter=category%20eq%20%27recommended%27").value | ConvertTo-Json | ConvertFrom-Json | Export-Excel

$driverIds = @(

    "b7412646efbe6c5f812917e6126824a3be652bf86be9e0aaced13b27b35bdaf1_c2f2105e-780a-435b-bb86-4039f9c243b2"

    "013394dd187ab514885805265ea380264a2e212629657e0b258bde532816706b_c2f2105e-780a-435b-bb86-4039f9c243b2"

    "300b0bf98bcd7b2b8417df705d52483c99fa538327f1c44b89172d73582313e3_c2f2105e-780a-435b-bb86-4039f9c243b2"

    "c82d34e7b4ded5d160bcd8d950ff25abd2373800cec2107b0cf6236663e4527d_c2f2105e-780a-435b-bb86-4039f9c243b2"

    "20513f5ace30eef8c5e4db65dc28e362fe06b30024646757b46eb89558e1720a_c2f2105e-780a-435b-bb86-4039f9c243b2"

    "876f6c44f29a6e4d36ae6345a0318714a4fe12e6171a8ed08bb6450b8d31ec02_c2f2105e-780a-435b-bb86-4039f9c243b2"

    "4f3d42c0e323da95a9f375aa0942bbfb65dc71e0a69039363cb14925c22cbb0a_c2f2105e-780a-435b-bb86-4039f9c243b2"

    "74779ad1670cf975d7285d2ed6c0e349a3a772d60c670fe0e56a41c2e9521f25_c2f2105e-780a-435b-bb86-4039f9c243b2"

    "0d7a8d95c80e73829ddd53c0e0a319cf0d76d8cd45be3f738662e2f7a40e9d97_c2f2105e-780a-435b-bb86-4039f9c243b2"

    "65e7ddc2c21ec0a1a3601a68529f798f9838a554140da8400793285f1ffbf3c7_c2f2105e-780a-435b-bb86-4039f9c243b2"

    "8c11bf2b8575672c95c74df6ee6d28086858ac5a358cdf5afa9bfa4e61621ec9_c2f2105e-780a-435b-bb86-4039f9c243b2"

)

# Approve

$driverIds | ForEach-Object { Invoke-MgBetaExecuteDeviceManagementWindowsDriverUpdateProfileAction -WindowsDriverUpdateProfileId 7f81ecb1-84dd-47d6-8061-97f3530a217a -ActionName 'approve' -DeploymentDate 10/09/2023 -DriverIds $_ }

# Group members and owners

$mgGroups = Get-MgBetaGroup -GroupId afc77666-75c9-422e-a185-640dfedc400a

$mgUnifiedGroups = $mgGroups #| Where-Object grouptypes -Match Unified

$result = @()

$mgGroups | ForEach-Object {

    $members = ""

    Get-MgBetaGroupMember -GroupId $_.Id | ForEach-Object {

        $members += $_.AdditionalProperties.userPrincipalName

        $members += ", "

    }

    $owners = ""

    Get-MgBetaGroupOwner -GroupId $_.Id | ForEach-Object {

        $owners += $_.AdditionalProperties.userPrincipalName

        $owners += ", "

    }

    $obj = [PSCustomObject]@{

        Name    = $_.DisplayName

        Owner   = $owners

        Members = $members

    }

    $result += $obj

}

$result

# User export inclusief proxyaddress

Get-MgBetaUser -All -Filter "usertype eq 'member'" -OutVariable mgUsers

$users = @()

$users = $mgUsers | Where-Object UserType -eq "member" | Sort-Object UserPrincipalName | Select-Object DisplayName, Id, Mail, UserPrincipalName, AccountEnabled, @{name = "onmicrosoft"; expression = { $_.ProxyAddresses | ForEach-Object { if ($_ -match "onmicrosoft") {

                $_ -replace "smtp:"

            } } }

}, @{name = "proxyaddresses"; expression = { ($_.ProxyAddresses | ForEach-Object { if ($_ -notmatch "X500") {

                    $_

                } } ) -join ";" }

}, @{name = "licenses"; expression = { (Get-MgBetaUserLicenseDetail -UserId $_.Id).SkuPartNumber -join ";" }

}

$users | Format-Table

$users[0..10] | Format-List

# Passwords and AD Entra ID Sync

$user = "jan.klaassen@pietjepuk.nl"

Get-MgBetaUser -UserId $user -Property UserPrincipalName, PasswordPolicies | Select-Object UserPrincipalName, PasswordPolicies | ConvertTo-Json | clip

Get-MgBetaUser -All -Filter "usertype eq 'member'" -Property UserPrincipalName, DisplayName, PasswordPolicies | Sort-Object DisplayName | Select-Object UserPrincipalName, DisplayName, PasswordPolicies

Get-MgBetaUser -All -Filter "usertype eq 'member' and OnPremisesSyncEnabled eq true" -Property UserPrincipalName, DisplayName, PasswordPolicies, OnPremisesSyncEnabled | Sort-Object DisplayName | Select-Object UserPrincipalName, DisplayName, PasswordPolicies

# $params = @{

#     passwordProfile = @{

#         forceChangePasswordNextSignIn = $true

#     }

# }

# Update-MgBetaUser -UserId $user -BodyParameter $params

$OnPremSync = Get-MgBetaDirectoryOnPremiseSynchronization

$OnPremSync | ConvertTo-Json

$OnPremSync.Features.CloudPasswordPolicyForPasswordSyncedUsersEnabled = $true

$OnPremSync.Features.UserForcePasswordChangeOnLogonEnabled = $true

Update-MgBetaDirectoryOnPremiseSynchronization -OnPremisesDirectorySynchronizationId $OnPremSync.Id -Features $OnPremSync.Features

#

$user = "jan.klaassen@pietjepuk.nl"

Update-MgBetaUser -UserId $user -PasswordPolicies None

$passwordprofile = @{}

$passwordprofile["forceChangePasswordNextSignIn"] = $true

$passwordprofile["forceChangePasswordNextSignInWithMfa"] = $true

Update-MgBetaUser -UserId $user -PasswordProfile $passwordprofile -Verbose

# Set user Immutable ID

$UserPrincipalName = "test.user@domain.com"

$SamAccountName = "test.user"

$guid = (Get-ADUser $SamAccountName).ObjectGUID

$immutableID = [System.Convert]::ToBase64String($guid.ToByteArray())

Write-Output "Update-MgBetaUser -UserId `"$UserPrincipalName`" -OnPremisesImmutableId `"$($immutableID)`""

$adUsers = Get-ADUser -Filter * -SearchBase "OU=Accounts,$((Get-ADDomain).DistinguishedName)"

$adUsers = Get-ADUser -Filter * -SearchBase "OU=Mail,$((Get-ADDomain).DistinguishedName)"

foreach ($u in $adusers) {

    $guid = $u.ObjectGUID

    $immutableID = [System.Convert]::ToBase64String($guid.ToByteArray())

    Write-Output "Update-MgBetaUser -UserId `"$($u.UserPrincipalName)`" -OnPremisesImmutableId `"$($immutableID)`""

}

Get-MgBetaUser -All -Filter "usertype eq 'member'" -OutVariable mgUser

foreach ($u in $mgUser) {

    Update-MgBetaUser -UserId $($u.UserPrincipalName) -OnPremisesImmutableId $null

}