Skip to content

Instantly share code, notes, and snippets.

@svarukala
Last active September 25, 2024 00:37
Show Gist options
  • Select an option

  • Save svarukala/f23e6ee03e7516b1520469e9730a4515 to your computer and use it in GitHub Desktop.

Select an option

Save svarukala/f23e6ee03e7516b1520469e9730a4515 to your computer and use it in GitHub Desktop.
This script uses Microsoft Graph PowerShell SDK. It is helpful to identify and inventorize all the Azure AD Applications registered in your tenant. The script enumerates the KeyCredentials (Certificates) and PasswordCredentials (Client Secret) keys, expiration dates, owner and other useful information.
Connect-MgGraph -Scopes "User.Read.All","Group.ReadWrite.All","Application.Read.All", "Application.ReadWrite.All", "Directory.Read.All", "Directory.ReadWrite.All", "Directory.AccessAsUser.All"
$Apps = Get-MgApplication -All
$today = Get-Date
$credentials = @()
$Apps | %{
$aadAppObjId = $_.Id
$app = Get-MgApplication -ApplicationId $aadAppObjId
$owner = Get-MgApplicationOwner -ApplicationId $aadAppObjId
$app.KeyCredentials | %{
#write-host $_.KeyId $_.DisplayName
$credentials += [PSCustomObject] @{
CredentialType = "KeyCredentials";
DisplayName = $app.DisplayName;
AppId = $app.AppId;
ExpiryDate = $_.EndDateTime;
StartDate = $_.StartDateTime;
#KeyID = $_.KeyId;
Type = $_.Type;
Usage = $_.Usage;
Owners = $owner.AdditionalProperties.userPrincipalName;
Expired = if(([DateTime]$_.EndDateTime) -lt $today) {"yes"} else{ "No"};
}
}
$app.PasswordCredentials | %{
#write-host $_.KeyId $_.DisplayName
$credentials += [PSCustomObject] @{
CredentialType = "PasswordCredentials";
DisplayName = $app.DisplayName;
AppId = $app.AppId;
ExpiryDate = $_.EndDateTime;
StartDate = $_.StartDateTime;
#KeyID = $_.KeyId;
Type = 'NA';
Usage = 'NA';
Owners = $owner.AdditionalProperties.userPrincipalName;
Expired = if(([DateTime]$_.EndDateTime) -lt $today) {"yes"} else{ "No"};
}
}
}
$credentials | FT -AutoSize
# Optionally export to a CSV file
#$credentials | Export-Csv -Path "AppsInventory.csv" -NoTypeInformation
@Jakke2440

Copy link
Copy Markdown

I have changed that line to :

Expired = if(([DateTime]$_.EndDateTime) -lt $today) {"yes"} else{ "No"};

works as a charm now for me in PS 5.1

@ashmsport

Copy link
Copy Markdown

Is there a way to do this for Enterprise Applications?

@amlijupnandanan

Copy link
Copy Markdown

Is it possible to do this with C# or python.. like need to implement this in web application level

@svarukala

Copy link
Copy Markdown
Author

@ashmsport yes, see this: https://dev.to/svarukala/manage-azure-ad-enterprise-applications-permissions-using-microsoft-graph-powershell-222m

@amlijupnandanan yes, you must use MS Graph rest endpoint. The above script essentially doing the same except it's using PS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment