Microsoft 365 Community Community Demos, 22 Apr 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Running the CLI for Microsoft 365 in Azure Container Instances orchestrated by Logic Apps

Description

In this 14-minute Developer-focused demo, Albert-Jan Schot steps through running the CLI for Microsoft 365 in Azure Container Instances orchestrated by Logic Apps – or Flow in Power Automate. See how the Azure Container Instance is created with the specified managed identity. Docker enables bundling of a pre-configured version of CLI for Microsoft 365 together with all its required dependencies and also is used to orchestrate containers. One purpose for this configuration is to run scripts or reports against your tenant. This PnP Community demo is taken from the SharePoint Framework and JavaScript Special Interest Group (SIG) – Bi-weekly sync call recorded on April 22, 2021.

Demo Presenter: Albert-Jan Schot (Portiva) | @appieschot

Supporting materials:
• Article - Running the CLI for Microsoft 365 in an Azure Container Instance | https://www.cloudappie.nl/running-m365-cli-container-instances/
• Tool - CLI for Microsoft 365 | https://aka.ms/cli-m365
• Repo - CLI for Microsoft 365 | https://github.com/pnp/cli-microsoft365
• Docker - m365pnp/cli-microsoft365 | https://hub.docker.com/r/m365pnp/cli-microsoft365

Learn more:
• Learn more about the Microsoft 365 Patterns and Practices community at: http://aka.ms/m365pnp
• Visit the Microsoft 365 Patterns and Practices community YouTube channel: https://aka.ms/m365pnp-videos

A

I'm not going to do too many slides, just a quick introduction. What I'm going to show you is running the cli in azure container instances. So for those of you who don't know the cli, yet the cli is a cross-platform way of managing microsoft, 365 in a unified way from any platform or tool chain, and it will allow you to manage both your tenant as well as sharepoint framework projects. So we believe it's easy to use, uh definitely check out for yourself.

A

If you don't believe me, it works on any os, so, whether it's windows, mac os or linux, it works in any shell, powershell best commander or whatever shell of your liking, and there is one unified login. So you just log in once and from that point in time you can talk to all the services in microsoft, 365 that we provide commands for now.

A

We do have a fancy docker container running, that you can pull, so you can pull that either locally or, as I'm going to show you today, you can actually pull it into azure container instances and use things like managed identity to do long, running operations in the cloud against your tenant and use logic apps to orchestrate those those containers. Now, just some of the building blocks that I'm going to show you, we will use the cli docker container, so we're not going to introduce into details about that.

A

So we just assume that it's there believe me. It's there we're gonna use it. We gonna have a look at the logic, app that logic app is going to pull in something from a github repo. We're not gonna, go into too much detail on what's running in github, but we pull in a script and that script will actually run in the docker container.

A

In our azure container instances it will use a managed identity, making sure that we can authenticate against our tenants and that we can use that information to, for instance, get all site collections or get all site collections with a specific state. So that depends on the script that you want to run within the cli samples. We do have a bunch of sample scripts that you can use or reuse in this way, but basically these are the building blocks. So with that, let's have a look at an actual demo. Let's have a look at actual code.

A

Now. What you see here is you see a resource group within the resource group? I do have a managed identity, so I created a managed identity to make sure that I can do the things that I want to do. The advantage of having a managed identity is that I don't need to log in into my script. I can use this managed identity when running scripts, so the logic app will use this managed identity to attach it to the container that we'll be running so by doing so.

A

That container automatically uses that identity and can use that identity to get a bunch of scripts. Now there is one thing that you'll need to do. So what you see here is a new tab where I went to the enterprise applications and I looked up my my enterprise or I looked up my managed identity and what I need to make sure is that, depending on what I want to achieve with my script, I need to make sure that it has the appropriate permissions.

A

So in this case, what I wanted to do is I wanted to do some stuff with all side collections, so I made sure that both from the graph endpoint perspective, as well as the sharepoint or office 365 sharepoint online perspective, I do have the permissions with this managed identity to actually read and write items in all site collections. If I do not have this set of permissions, then I cannot run my script so these are. This is the bare minimum to authenticate against your tenant?

A

If you want to do different things, let's say you want to read and write all user profiles. You need that if you want to do things with yammer or if you want to do things with the power platform, you might require additional permissions and you need to make sure that you add them here. You need to make sure that they have the trend. Admin consent has been applied, but once you've done that, then your managed identity is ready. You can use that manage identity from there there's nothing else. I need to do now.

A

If I go back what I then have is, I have a logic app and the logic app is actually doing all the magic for me. So there's no other code involved and we're just going to walk you through. What's in the logic app, so the first step obviously is a trigger any logic. App or any flow would require a trigger. I did a http trigger, it can be any other trigger. You can run it on a timer, so you can run it every week or every day. That's not really the important part.

A

I also use two two variables not really important either, but because I'm using them multiple times, you'll need them in multiple steps. It's probably easy to create to create one. The real magic is actually happening in the action called, create or updated container group, and this is where the magic is happening. This is where we actually will create a azure container instance where everything will be run or everything is happening now. In order to do that, you'll need your subscription id. You need.

A

A resource group you'll need a resource group name which well, I would say, probably make some make some sense. That container group name is something that you will use later on. You'll need to set a location, doesn't really matter where you run it as long as it's near to wherever your microsoft 365 tenant is, then you will have the best performance, but it's not a requirement, then. As soon as you have that container group, you can specify the actual container name.

A

So this is what container will be started and you have to specify a container image and the advantage of using a container image is that it can actually look at the docker, the docker environment or the docker repository, and it can pull images from there. So by doing this, specifying the m365 pnp cli microsoft, 365 colon latest, you will get the latest. You can also do next, and then you get the beta container with the beta bits, but we're going to go with the latest, just uh official release that we have.

A

Then you have to specify for the container that you will start up how many cpu power, how many memory you will need, and that kind of depends on the size of the scripting that you try to execute. So in my case, I'm just going to pull in some sites, I'm not doing really resource intensive stuff. So this should be enough.

A

If you're running on a uh let's say large tenant with over a million site collections, then you'll probably need some more memory to just process them and work with them, but for demo purposes this is more than enough. Now then, there is a bunch of stuff that you don't need to specify you can you can play around with it if you want to, but there's not uh they're, not required, then the next step that you will need to specify is that you need to make sure that you actually can run a script.

A

So if you spin up a container, you can pass on command segments and the requirement of passing on command segments is that it can only be a single command, so you cannot chain commands. You can only execute one single command now, in my case, what I actually want to do is I want to do multiple steps into my script, so I want to log in I want to get all sites. I might want to get all owners for all sites, so I actually want to do more in order to do that.

A

What you need to do is you'll need to execute a best script or a powershell script for that matter, and you'll need to specify that actual script that needs to come in. So in this case, I'm going to say: okay, I'm going to ask you best. This is the script that I want to execute, and then I've got a bunch of other parameters that I can skip not really important, but that script actually needs to come in. I need to get that script. That script is not part of the container image.

A

So if you pull in the container image that script is not variant in order to get a script there, what you'll need to do is you'll need to make sure that you have a reference to that script and that you can say I'm gonna say the container volume I'm gonna mount a container volume. So by um specifying a repository, giving the name or specifying the name. I can then mount that container image and that container image is actually coming. If I scroll uh down a little bit more, it's actually coming from a git repo.

A

So what this does is this will pull in the git repo I'll specify the git repo name called git repo, and then what you can do is you can say, I'm gonna.

B

A

Git repo on this path, meaning that on this bed, all the scripts will reside that are coming from my git repo. Now this kit repo, I can open it, it's it's a public repo. So for production purposes, this is not a best practice. You'll probably want to use a private repository, because potentially someone can change that script would work the exact same way. The only thing that you then need to do is you need to authenticate your logic app or your azure subscription to be allowed to access your private repository.

A

In this case, I just put in a test script where, in that test script I do a login action and I'm going to list all site collections. Now, if you remember that login action that I just talked about the managed identity, I said there's no need for me to log in there's nothing.

A

I need to do there's only one step within the cli I'll need to say this is the id of the managed identity and, within that container, in image, I need to say use that id of the managed identity and if that id matches the managed identity of the container that got spun up, then everything word flawlessly. Then it can sign in and then it actually works. So that's the only requirement that, within the script, you'll need a reference to this managed identity or the managed identity that you want to use now going back.

A

Then the other thing that you'll need to do is you need to actually specify that the container group is using that managed identity and that's something that you do by setting the managed identity type I chose the user assigned. You can also use the system assigned, and then you can say this is the actual user that you want to use and what you'll see here is slightly confusing, because if you look at the docs it will give you a sample on how things should look. It's.

A

It might be small on your screen, but if you would zoom in you would see that it gives you a format on how things would look, but the actual stuff that you need to put in there is slightly different, so the docs lag a little bit behind on the actual content that you'll need to put in there. So what you see here is I need to specify okay, I'm using this subscription with this id I'm using this resource group and then I'm using this actual managed identity.

A

That's the only step that you actually need to spin up everything to get everything working now. If we go down a little bit more, then you can do it do until just pulling your your container pulling your image, seeing if it's finished, if it's done- and you have to do that a few times- usually it takes between 30 and 60 seconds to process everything.

A

And then you have an action called get locks from the container instance that allows you to get the actual content from the script that has been executed in your container instance and then I'm going to say, okay, I'm going to delete this this container group now I'm going to press run that's going to take around 60 seconds to process everything and because we are already running out of time, I'm gonna pick one up.

A

That's already succeeded just to walk you through, and you will see that all the actions are green and then, in this case that it took five iterations to check whether the container image was finished and if I go to then the get logs. What you see here is a bunch of json with all my site collections here you can see. I've got my site design.

A

I can see some details. The reason that I get json is because in the script I defined it to be output json and now I can either def or refine my script by filtering or doing additional steps, or I can say I want to have that logic. In my logic, app in place, so we see that this is something that we run at customers, where we can explain to cis admins, who might not have that much experience with either powershell or cli commands.

A

We can just set this up, put a script in place and explain if they want to do different things with the output, they can use the logic app to send it as an email or send it as an adaptive card to teams or do things what they whatever they want to do. With. With that, I saw a question about the slides. I think the slides will actually be shared if not reach out on twitter. I can definitely share them some important links in there.

A

If you want to read more on the cli, then there's the ak a dot. Ms link, if you want to see what's happening on the project, you can find everything in github. The docker image is on docker hub, and I did a write-up a walkthrough of all the steps that I took to get this to work. So if you want to uh well replay or actually get screenshots, how to do this definitely check out the uh d walkthrough and that's it for today.

B

Awesome stuff very, very cool capability there and showing off how to integrate all those different pieces so really exciting stuff. uh Thank you for sharing that with us.