Functions/Public/Remove-MsGApplicationPassword.ps1
|
function Remove-MsGApplicationPassword { <# .SYNOPSIS Removes a specified password from an app registration in Entra ID. .DESCRIPTION This function removes a specified password/client secret from an app registration in Entra ID. .PARAMETER DisplayName Display Name of the app registration. .PARAMETER AppId App/Client Id of the app registration. .PARAMETER ObjectId Object Id of the app registration. .PARAMETER KeyId ID of the password/client secret. .PARAMETER Force Bypasses the confirmation check. .PARAMETER Headers Authentication Headers to connect to Microsoft Graph. .PARAMETER Jwt Jwt to connect to Microsoft Graph. .EXAMPLE PS> Remove-MsGApplicationPassword -DisplayName TestApp-01 -KeyId 1b983071-cadb-4430-ba6d-82d5e0f51039 Removes the "1b983071-cadb-4430-ba6d-82d5e0f51039" secret from the TestApp-01 app registration. #> [CmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Name')] param( [parameter(Mandatory = $true, ParameterSetName = 'Name', Position = 0, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)][string]$DisplayName, [parameter(Mandatory = $true, ParameterSetName = 'AppId', Position = 1)][string]$AppId, [parameter(Mandatory = $true, ParameterSetName = 'ObjId', Position = 2)][string]$ObjectId, [parameter(Mandatory = $true, Position = 3)][string]$KeyId, [parameter(Mandatory = $false)][switch]$Force, [parameter(Mandatory = $false)][hashtable]$Headers, [parameter(Mandatory = $false)][string]$Jwt ) BEGIN { # Session Checks if ([string]::IsNullOrEmpty($Headers) -and [string]::IsNullOrEmpty($Jwt)) { if ($null -ne $myGraphToken) { Write-Verbose "Setting Jwt to Global: $myGraphToken" $Jwt = $myGraphToken } } if ([string]::IsNullOrEmpty($Headers) -and -not([string]::IsNullOrEmpty($Jwt))) { $Headers = @{ 'Authorization' = 'Bearer {0}' -f $Jwt 'Content-Type' = 'application/json' } } if ([string]::IsNullOrEmpty($Headers)) { $errorMessage = '{0} : Unable to run command. Headers are empty.' -f $MyInvocation.MyCommand.Name throw $errorMessage } # end Session Checks } PROCESS { # Retrieve Application from Entra ID try { switch ($PSCmdlet.ParameterSetName) { "Name" { $appEndpoint = "applications?`$filter=displayName eq '{0}'&`$select=displayName,appId,id,passwordCredentials" -f $DisplayName } "AppId" { $appEndpoint = "applications?`$filter=appId eq '{0}'&`$select=displayName,appId,id,passwordCredentials" -f $AppId } "ObjId" { $appEndpoint = "applications/{0}?`$select=displayName,appId,id,passwordCredentials" -f $ObjectId } } $application = Invoke-MsGRequest -Method Get -Endpoint $appEndpoint -Headers $Headers -ErrorAction 'Stop' if ([string]::IsNullOrEmpty($application)) { $errorMessage = 'Application not found.' throw $errorMessage } } catch { $errorMessage = Get-MsGErrorMessage $_ $errorException = '{0} : Unable to retrieve application from Entra ID. Error: {1}' -f $MyInvocation.MyCommand.Name, $errorMessage throw $errorException } # end region # Validate Credential Exists if ($application.passwordCredentials.keyId -notcontains $KeyId) { $errorException = '{0} : {1} does not exist on the application.' -f $MyInvocation.MyCommand.Name, $KeyId throw $errorException } # end region # Remove application password if (($PSCmdlet.ShouldProcess($application.displayName, 'Remove Application Password')) -and ($Force.IsPresent -or ($PSCmdlet.ShouldContinue("Remove '$KeyId' from '$($application.displayName)'.", 'Are you sure you want to proceed?')))) { try { $endpoint = 'applications/{0}/removePassword' -f $application.id $body = @{ 'keyId' = $KeyId } Invoke-MsGRequest -Method Post -Endpoint $endpoint -Body $body -Headers $Headers -ErrorAction 'Stop' > $null } catch { $errorMessage = Get-MsGErrorMessage $_ $errorException = '{0} : Unable to remove certificate from the application in Entra ID. Error: {1}' -f $MyInvocation.MyCommand.Name, $errorMessage throw $errorException } } # end region } } |