Azure自动化:PowerShell脚本从Azure DevOps组织中删除暂停的Microsoft 365用户

wr98u20j  于 11个月前  发布在  Shell
关注(0)|答案(1)|浏览(161)

我需要创建一个自动化程序,该程序与处于“暂停”状态的用户列表保持同步,这些用户在Microsoft 365中被阻止访问,并将其从Azure DevOps组织中删除,包括当前和未来在365中标记为暂停的用户。
目前,我正试图通过Azure门户中的自动化帐户使用PowerShell 5.1实现这一目标。我愿意接受实现此项目的其他建议,这些建议不一定需要使用自动化帐户。
目前,Runbook运行时没有错误,但什么也没有发生-换句话说,没有从Azure DevOps组织中删除365的暂停用户。下面是当前代码:

# Microsoft 365 authentication parameters
$clientId = "ClientID"
$tenantId = "TenantID"
$clientSecret = "ClientSecret"
$scope = "https://graph.microsoft.com/.default"

# Get an access token
$tokenUrl = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"
$tokenBody = @{
    client_id     = $clientId
    scope         = $scope
    client_secret = $clientSecret
    grant_type    = "client_credentials"
}

try {
    $tokenResponse = Invoke-RestMethod -Uri $tokenUrl -Method Post -Body $tokenBody
    $accessToken = $tokenResponse.access_token
} catch {
    Write-Output "Error obtaining access token: $_"
}

# Get suspended users
$graphUrl = "https://graph.microsoft.com/v1.0/users?$filter=accountEnabled eq false"
$graphHeaders = @{Authorization = "Bearer $accessToken"}

try {
    $users = Invoke-RestMethod -Uri $graphUrl -Headers $graphHeaders
} catch {
    Write-Output "Error obtaining suspended users: $_"
}

# Azure DevOps credentials
$patToken = "patToken"
$devOpsOrg = "DevOpsOrg"

# Loop through suspended users and remove them from Azure DevOps organization
foreach ($user in $users.value) {
    $email = $user.mail

    # Get user identity in Azure DevOps
    $uri = "https://vssps.dev.azure.com/$devOpsOrg/_apis/graph/users?api-version=6.0-preview.1&subjectDescriptor=" + [System.Web.HttpUtility]::UrlEncode("aad:$($user.id)")
    $base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f "",$patToken)))
    $headers = @{Authorization=("Basic {0}" -f $base64AuthInfo)}

    try {
        $userToRemove = Invoke-RestMethod -Uri $uri -Headers $headers -Method Get
    } catch {
        Write-Output "Error getting user identity in Azure DevOps: $_"
        continue
    }

    if ($userToRemove.Count -eq 1) {
        # Remove the user from Azure DevOps organization
        $uri = "https://vssps.dev.azure.com/$devOpsOrg/_apis/graph/users/" + $userToRemove[0].Id + "?api-version=6.0-preview.1"

        try {
            Invoke-RestMethod -Uri $uri -Headers $headers -Method Delete
            Write-Output "User $email removed from Azure DevOps organization."
        } catch {
            Write-Output "Error removing user from Azure DevOps organization: $_"
        }
    }
}

# List all users in Azure DevOps organization
$uri = "https://vssps.dev.azure.com/$devOpsOrg/_apis/graph/users?api-version=6.0-preview.1"
$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f "",$patToken)))
$headers = @{Authorization=("Basic {0}" -f $base64AuthInfo)}

try {
    $allUsers = Invoke-RestMethod -Uri $uri -Headers $headers -Method Get
    Write-Output "All users in Azure DevOps organization:"
    $allUsers.value | ForEach-Object {
        Write-Output ("Name: " + $_.displayName)
        Write-Output ("User: " + $_.principalName)
    }
} catch {
    Write-Output "Error getting all users in Azure DevOps: $_"
}

字符串

lp0sw83n

lp0sw83n1#

要在Azure DevOps中删除用户,我们可以使用User Entitlements - Delete。您可以从User Entitlements - Search User Entitlements中找到userId
下面是我的测试脚本:

# Define parameters
$organization = ""
$PAT=""
$userId=""

# Define headers
$PATGetBytes = [System.Text.Encoding]::ASCII.GetBytes(":$PAT")
$Authentication = [System.Convert]::ToBase64String($PATGetBytes)
$Headers = @{Authorization = ("Basic {0}" -f $Authentication) }

#Get user list
$url1= "https://vsaex.dev.azure.com/$organization/_apis/userentitlements?api-version=7.1-preview.3"
$response1 = Invoke-RestMethod -Uri $url1 -Method GET -Headers $headers
$response1| ConvertTo-Json

#Delete user
$url2 = "https://vsaex.dev.azure.com/$organization/_apis/userentitlements/"+$userId+"?api-version=7.1-preview.3"
# Send the DELETE request
$response2 = Invoke-RestMethod -Uri $url -Method Delete -Headers $headers
$response2| ConvertTo-Json

字符串

相关问题