{"id":492,"date":"2024-08-01T14:23:31","date_gmt":"2024-08-01T04:23:31","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/?p=492"},"modified":"2024-08-01T14:32:52","modified_gmt":"2024-08-01T04:32:52","slug":"automating-access-to-microsoft-graph-api-using-azure-pipelines","status":"publish","type":"post","link":"https:\/\/cloudproinc.com.au\/index.php\/2024\/08\/01\/automating-access-to-microsoft-graph-api-using-azure-pipelines\/","title":{"rendered":"Automating Access to Microsoft Graph API Using Azure Pipelines"},"content":{"rendered":"\n

This Azure DevOps pipelines article will show how we automate access to Microsoft Graph API using Azure DevOps pipelines. <\/p>\n\n\n\n\n\n\n\n

Azure pipelines is an Azure DevOps service that allows us to automate the deployment of applications, services and changes to cloud environments. <\/p>\n\n\n\n

Microsoft Graph API is the underlining API service that allows us to interact programmatically with every Microsoft 365, Intune<\/a>, Entra ID, and Power Automate service using C#, JavaScript, Python, PHP, Java, Go, Azure CLI, and PowerShell. <\/p>\n\n\n\n

To connect the two services, we need to create a service connection inside an Azure DevOps project. The service connection will use a managed identity. An Azure-managed identity is like a service principal without the need to manage and rotate secrets and certificates. <\/p>\n\n\n\n

Create a Service Connection<\/h2>\n\n\n\n

To create a service connection, Open an Azure DevOps project, click on Settings, and select Service Connections from the list. Then, click Create Service connection<\/strong>.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

From the list of connections, select Azure Resource Manager<\/strong> and Workload Identity Federation (automatic)<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

From the connection configuration page, select your Azure subscription details, Resource Group, and name, then save the connection.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Next, we need to assign the Managed-Identity account API permissions.<\/p>\n\n\n\n

Grant Graph API permissions <\/h2>\n\n\n\n

To grant the newly created Managed-Identity account access to manage resources in Entra or other Microsoft 365 services. we need to grant it API permissions. <\/p>\n\n\n\n

Open the Entra console and search for the newly created Managed-Itentiy. the name will include the Azure DevOps organisation name, project name and object ID. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

After you locate the new identity, click on it and select API Permissions<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Click on Add a permission and add all the Application permissions that are needed. <\/p>\n\n\n\n

Note: Make sure you use Application and not Delegated permissions.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

After completing this step, we can move to the final step and connect to Graph API from an Azure pipeline.<\/p>\n\n\n\n

Automating Access to Microsoft Graph API Using Azure Pipelines<\/h2>\n\n\n\n

The final step will be connecting and using Graph API from an Azure Pipeline. In the following example, I use Azure PowerShell to request an access token and the Graph API Powershell module to run Graph API calls. <\/p>\n\n\n\n

trigger:\n- none\n \npool:\n  vmImage: ubuntu-latest\n \nsteps:\n- task: AzurePowerShell@5\n  displayName: 'Get Entra access token using Azure PowerShell'\n  inputs:\n    azureSubscription: 'YOUR-SERVICE-CONNECTION-NAME'\n    azurePowerShellVersion: LatestVersion\n    ScriptType: 'InlineScript'\n    inline: |\n      $token = Get-AzAccessToken -ResourceUrl \"https:\/\/graph.microsoft.com\"\n      $accessToken = $token.Token\n      Write-Host \"##vso[task.setvariable variable=secretToken;issecret=true]$accessToken\"\n- task: PowerShell@2\n  displayName: 'Connect to Graph API using the token from the above task'\n  inputs:\n    targetType: 'inline'\n    script: |\n      # Connect to Graph API and get Entra ID user info\n      $secureToken = ConvertTo-SecureString -String $(secretToken) -AsPlainText\n      Install-Module Microsoft.Graph.Authentication\n      Install-Module Microsoft.Graph.Users\n      Connect-MgGraph -AccessToken $secureToken\n      Get-MgUser -UserId \"some upn\"\n<\/code><\/pre>\n\n\n\n
More articles <\/h2>\n\n\n\n