{"id":38992,"date":"2020-04-27T06:00:07","date_gmt":"2020-04-27T13:00:07","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/premier-developer\/?p=38992"},"modified":"2020-04-04T11:19:44","modified_gmt":"2020-04-04T18:19:44","slug":"azure-active-directory-automating-guest-user-management","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/premier-developer\/azure-active-directory-automating-guest-user-management\/","title":{"rendered":"Azure Active Directory: Automating Guest User Management"},"content":{"rendered":"

Application Development Manager Francis Lacroix<\/strong> discusses how to use Azure Automation and Microsoft Graph to determine which users are inviting guests into Azure Active Directory, audit guest logins, and disable unused guest identities.<\/p>\n

\n

While Azure AD offers many functions and features for managing Guest Users and their permissions, there are still some business specific processes that may not be supported. Though the use of Azure Automation and Microsoft Graph, it is possible to augment the built-in features to achieve business goals.<\/p>\n

In this blog post, we will focus on two goals:<\/p>\n

    \n
  1. Track and maintain the inviter for guests<\/strong>. We will be using the Manager field on the Azure AD Guest User to track the inviter. This will allow us to track and audit who has invited each guest user, and integrate this information into other processes.<\/li>\n
  2. Audit Guest logins and disable unused guest users<\/strong>. We will be tracking logins for guest users, and if there are no logins in the past week, the guest user account will be disabled and and email sent to the inviter.<\/li>\n<\/ol>\n

    Assumptions<\/h2>\n

    As with many custom solutions, there are multiple ways of approaching it. As this work is based on a Proof of Concept for a Premier Developer customer, the solution presented in this blog post is built around certain assumptions:<\/p>\n

      \n
    1. Using an Automation Account<\/strong>. There are different means of building automated processes in Azure. Azure Automation was selected since it uses PowerShell, which is the primary audience at the customer. Azure Functions could have also been used.<\/li>\n
    2. Using PowerShell Runbooks<\/strong>. Since the target audience was already comfortable with PowerShell, this was selected as the Runbook type.<\/li>\n
    3. Using Azure AD PowerShell Module<\/strong>. Targeting the Microsoft Graph API directly would have worked also, but since this solution is built around PowerShell, we have opted to use the AzureAD PowerShell module.<\/li>\n<\/ol>\n

      The Scripts<\/h2>\n

      For those simply interested in the scripts, they can be found here:<\/p>\n