I was recently informed that my scripts for the secure application model no longer worked. This is due to Microsoft updating the PartnerCenter module with some breaking changes. To make sure you can use the Secure App Model script I’ve made a new version below.
The changes in this script are in the way the access token is generated, Normally you’d get a Windows Authentication pop-up to allow consent. This is no longer possible with the PartnerCenter 2.0 module. This also requires us to add an extra return-URI to the Azure Application. To fix these issues, use the script below.
The script
<# .SYNOPSIS This script will create the require Azure AD application. .EXAMPLE .\Create-AzureADApplication.ps1 -ConfigurePreconsent -DisplayName "Partner Center Web App" .\Create-AzureADApplication.ps1 -ConfigurePreconsent -DisplayName "Partner Center Web App" -TenantId eb210c1e-b697-4c06-b4e3-8b104c226b9a .\Create-AzureADApplication.ps1 -ConfigurePreconsent -DisplayName "Partner Center Web App" -TenantId tenant01.onmicrosoft.com .PARAMETER ConfigurePreconsent Flag indicating whether or not the Azure AD application should be configured for preconsent. .PARAMETER DisplayName Display name for the Azure AD application that will be created. .PARAMETER TenantId [OPTIONAL] The domain or tenant identifier for the Azure AD tenant that should be utilized to create the various resources. #> Param ( [Parameter(Mandatory = $false)] [switch]$ConfigurePreconsent, [Parameter(Mandatory = $true)] [string]$DisplayName, [Parameter(Mandatory = $false)] [string]$TenantId ) $ErrorActionPreference = "Stop" # Check if the Azure AD PowerShell module has already been loaded. if ( ! ( Get-Module AzureAD ) ) { # Check if the Azure AD PowerShell module is installed. if ( Get-Module -ListAvailable -Name AzureAD ) { # The Azure AD PowerShell module is not load and it is installed. This module # must be loaded for other operations performed by this script. Write-Host -ForegroundColor Green "Loading the Azure AD PowerShell module..." Import-Module AzureAD } else { Install-Module AzureAD } } try { Write-Host -ForegroundColor Green "When prompted please enter the appropriate credentials..." if([string]::IsNullOrEmpty($TenantId)) { Connect-AzureAD | Out-Null $TenantId = $(Get-AzureADTenantDetail).ObjectId } else { Connect-AzureAD -TenantId $TenantId | Out-Null } } catch [Microsoft.Azure.Common.Authentication.AadAuthenticationCanceledException] { # The authentication attempt was canceled by the end-user. Execution of the script should be halted. Write-Host -ForegroundColor Yellow "The authentication attempt was canceled. Execution of the script will be halted..." Exit } catch { # An unexpected error has occurred. The end-user should be notified so that the appropriate action can be taken. Write-Error "An unexpected error has occurred. Please review the following error message and try again." ` "$($Error[0].Exception)" } $adAppAccess = [Microsoft.Open.AzureAD.Model.RequiredResourceAccess]@{ ResourceAppId = "00000002-0000-0000-c000-000000000000"; ResourceAccess = [Microsoft.Open.AzureAD.Model.ResourceAccess]@{ Id = "5778995a-e1bf-45b8-affa-663a9f3f4d04"; Type = "Role"}, [Microsoft.Open.AzureAD.Model.ResourceAccess]@{ Id = "a42657d6-7f20-40e3-b6f0-cee03008a62a"; Type = "Scope"}, [Microsoft.Open.AzureAD.Model.ResourceAccess]@{ Id = "311a71cc-e848-46a1-bdf8-97ff7156d8e6"; Type = "Scope"} } $graphAppAccess = [Microsoft.Open.AzureAD.Model.RequiredResourceAccess]@{ ResourceAppId = "00000003-0000-0000-c000-000000000000"; ResourceAccess = [Microsoft.Open.AzureAD.Model.ResourceAccess]@{ Id = "bf394140-e372-4bf9-a898-299cfc7564e5"; Type = "Role"}, [Microsoft.Open.AzureAD.Model.ResourceAccess]@{ Id = "7ab1d382-f21e-4acd-a863-ba3e13f7da61"; Type = "Role"} } $partnerCenterAppAccess = [Microsoft.Open.AzureAD.Model.RequiredResourceAccess]@{ ResourceAppId = "fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd"; ResourceAccess = [Microsoft.Open.AzureAD.Model.ResourceAccess]@{ Id = "1cebfa2a-fb4d-419e-b5f9-839b4383e05a"; Type = "Scope"} } $SessionInfo = Get-AzureADCurrentSessionInfo Write-Host -ForegroundColor Green "Creating the Azure AD application and related resources..." $app = New-AzureADApplication -AvailableToOtherTenants $true -DisplayName $DisplayName -IdentifierUris "https://$($SessionInfo.TenantDomain)/$((New-Guid).ToString())" -RequiredResourceAccess $adAppAccess, $graphAppAccess, $partnerCenterAppAccess -ReplyUrls @("urn:ietf:wg:oauth:2.0:oob","https://localhost","http://localhost") $password = New-AzureADApplicationPasswordCredential -ObjectId $app.ObjectId $spn = New-AzureADServicePrincipal -AppId $app.AppId -DisplayName $DisplayName if($ConfigurePreconsent) { $adminAgentsGroup = Get-AzureADGroup -Filter "DisplayName eq 'AdminAgents'" Add-AzureADGroupMember -ObjectId $adminAgentsGroup.ObjectId -RefObjectId $spn.ObjectId } write-host "Installing PartnerCenter Module." -ForegroundColor Green install-module PartnerCenter -Force write-host "Sleeping for 30 seconds to allow app creation on O365" -foregroundcolor green start-sleep 30 write-host "Please approve consent form." -ForegroundColor Green $PasswordToSecureString = $password.value | ConvertTo-SecureString -asPlainText -Force $credential = New-Object System.Management.Automation.PSCredential($($app.AppId),$PasswordToSecureString) $token = New-PartnerAccessToken -ApplicationId "$($app.AppId)" -Scopes 'https://api.partnercenter.microsoft.com/user_impersonation' -ServicePrincipal -Credential $credential -Tenant $($spn.AppOwnerTenantID) -UseAuthorizationCode Write-Host "================ Secrets ================" Write-Host "ApplicationId = $($app.AppId)" Write-Host "ApplicationSecret = $($password.Value)" write-host "RefreshToken = $($token.refreshtoken)" Write-Host "================ Secrets ================" Write-Host " SAVE THESE IN A SECURE LOCATION "
This script should help you back on the Secure App Model Train. As always, Happy PowerShelling.
Kelvin Tegelaar
If you want to contact me directly you can find me on twitter here, or via email: Kelvin {at} limenetworks.nl
Latest posts by Kelvin Tegelaar (see all)
- Monitoring with PowerShell: Alerting on large Office 365 mailboxes - December 4, 2019
- Monitoring with PowerShell: Alerting on Shodan results - December 1, 2019
- Monitoring with PowerShell:Monitoring OneDrive status for current logged on user! - November 26, 2019
Pingback: Monitoring with PowerShell: Monitoring failed logins for Office365 - CyberDrain
I’m getting the following error after logging in through the browser using the authenticator app code.
Could I get some insight as to why this might be happening?
WARNING: Attempting to launch a browser for authorization code login.
WARNING: We have launched a browser for you to login. For the old experience with device code flow,
please run ‘New-PartnerAccessToken -UseDeviceAuthentication’.
New-PartnerAccessToken : AuthorizationCode can not be null or whitespace
Parameter name: AuthorizationCode
At line:117 char:10
+ $token = New-PartnerAccessToken -ApplicationId “$($app.AppId)” -Scope …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [New-PartnerAccessToken], ArgumentException
+ FullyQualifiedErrorId : System.ArgumentException,Microsoft.Store.PartnerCenter.PowerShell.Co
mmands.NewPartnerAccessToken