Microsoft 365 Community Identity platform, 24 Jan 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Productivity Tips for working with Microsoft Graph and Microsoft Graph PowerShell – January 2023

Description

This month’s in-depth topic: Productivity Tips for working with Microsoft Graph and Graph PowerShell.

Reviewed current tools and documents for working efficiently with Microsoft Graph and Graph PowerShell. Microsoft 365 Dev Tenant, Graph Explorer, Graph API Reference Docs, Graph Filter (retrieves subset of a collection), Graph X-Ray (view Graph API and PowerShell log of actions), Graph Permissions Explorer (APIs and data objects), Graph PowerShell, Upgrading from Azure AD PowerShell to Graph PowerShell – using Graph cmdlets map, Graph PowerShell Conversion Analyzer and PowerShell Azure Migration Advisor. Microsoft Presenter: Merill Fernando.

This call was hosted by Nandeesh Swami (Microsoft), on January 19, 2023.

Agenda
00:00 – Intro - Nandeesh Swami (Microsoft) | @Nandeesh_Swami
01:50 – Demo with Q&A - Productivity Tips for working with Microsoft Graph and Graph PowerShell - Merill Fernando - Senior Program Manager (Microsoft) | @merill
1:09:34 – Closing

Stay connected
• Twitter https://twitter.com/microsoft365dev and @azuread
• LinkedIn Nandeesh Swami | https://www.linkedin.com/in/nandeesh-s-301a7514/
• Microsoft 365 Platform Community in YouTube - https://aka.ms/m365/videos
• Microsoft 365 Platform Community - http://aka.ms/m365/community
• YouTube https://aka.ms/M365DevYouTube (Developer channel)
• Blogs https://aka.ms/m365pnp/blog

👋 Join to our weekly Microsoft 365 & Power Platform Community calls to learn more. These are PUBLIC calls for you to get access on the latest details from Microsoft and to see awesome demos from community on these technologies - Download recurrent invites from https://aka.ms/community/calls

A

A

For joining, uh as promised, every month we come up with something exciting I think uh this session is really cool, because I've personally used a lot of uh scripts and script, generating tools that metal has written. uh It's really awesome, really handy is one of our program managers in our GTP team and he's very well known in the community I'm so glad to have you mirror and also he's joining us from Australia, which is really a odd time right now, it's four o'clock in the morning, so thanks a lot for joining Marilyn at this time,.

B

No Horizons I'm really happy to join the call, so it's the first time I'm joining the identity, Community College so really excited to be here.

A

Awesome so, as always, there are some ground rules that we wanted to set, let's be respectful. If you have any questions, please put them in the chat window. You can just mention at the name, nandish or Maryland. Put in your question we'll try to answer that in the chat, if not we'll, try to take it at the end of the call. I will be sharing a survey in the call when the call is going on. We would really love to get details of. How do you think we should do our next session?

A

What should we do, and how did this current call go and all those things? So we record these calls and we put it on our YouTube channel, which I've already shared in the chat window. You can just go to that channel and check out our videos that we have done before. You can follow me on LinkedIn to get updates about such calls. Events, programs similar to these uh kodal LinkedIn and follow me and nandi Swami. You can also follow us on Twitter at Microsoft, 365, Tab and Azure ID.

A

We're also will be sharing updates about our events. Programs as well as products like always we do this call every third Thursday of the month. The next one is coming up on February 16th.

B

Perfect so quick intro about myself, my name is Ben Fernando I'm, a senior product manager in the Azure active directory team. In my day, job I help some of our large Enterprise customers deploy Azure active directory and in my past life, I used to be a developer, so I try to combine all the dev stuff with identity and graph is one of my passion areas, Microsoft graph and graph Powershell. So I wanted to share some of these things with you.

B

Folks, I'm, not sure why, but my presentation seems to be running on its own, so we'll just get started on to the first tip itself. So not just let's go back to basics, so the first tip is the Microsoft 365 Dev tenant, um it's a free tenant and you get all of licenses and it looks like every time we share this new people find out about it. So this is sort of like the first tip at the moment. So let me show you what that is right. So that's not what's meant to happen Okay.

B

So right now there seems to be a bug with age where it's not allowing you to create a new tenant when you're on age, but Chrome Works for some reason. So if you search for M365 Dev, you will see the developer program page and you'll be able to click the join now button. Now you need to sign in with your any Microsoft account. Don't use your work account, but if you use your Microsoft account, you will be given the option to create a Dev sandbox.

B

There are other ways to get to the same page, but this is one of the like the hidden secrets that either you know it or you don't know it at all. So for those who don't know it at all, um I thought it'll be a good tip to share this one, and when you are working as part of large Dev team, it's like you can. Each person can have your own tenant. So it's always good to have your own tenant.

B

I have like about five different tenants um where I configure different things, they're, absolutely free, you get about 25 licenses and the best part. Is you get a tenant with about 16 users pre-created with all profiles and images and mail and chat channels created and so on? So it has like some good sample data packs included in that and if you keep using your tenant, like you know at least once once, a quarter it automatically gets extended.

B

So, for example, I have some tenants that I've had for, like maybe four or five years and they're still going so definitely. This is one of the um the best options for you to use, but you should make sure that you, don't really you know, have data that you will really want because it could get. You know cleared out from time to time. So it's it's meant to be sort of a developer tenant, but it's fully licensed. It has the E5 license.

B

So everything is activated all of the features and it gives you the best opportunity and the things that I'm doing going to be demoing like I, have my own tenant that I've created that's sending 365 Dev tenant, but I also have, for example, customized my own domain added that the DNS I have this mailbox with those users and I use it for all of all of my demos. So um that's uh right!

B

So that's the the first uh tip on news on the Microsoft 365, developer, tenant, uh definitely use that and the sample data and it gets really useful.

B

The next one is on graph Explorer itself, like um I, feel like glass. There isn't really much focus on graph Explorer itself and on how to use graph Explorer, so I'm just going to go through and cover a few tips.

B

I'll walk, start walking you through those things: okay, so the first one, if you don't know the the shortest way to get to graph Explorer, is you go to AK dot, Ms, slash, GE and that's G for graph Explorer and you straight the way get into the graphics for a page, um or this is the one? That's my personal favorite, which is ge.cmd.ms, and you can quickly get into Graphics Builder from there.

B

For those who don't know this cmd.ms, which has lots of shortcuts to you, know every single portal and page in M365 and when Azure ID, so you don't need to uh click multiple times to get to where you want to go. You just remember the the URL and you can quickly get in there.

B

So this is a one of those other tools that I've created for the community um say, for example, if you want to get in tune uh portal, uh you just say in Dot, cmd.ms and you'll be logged in and taken straight into the InTune portal, similar with Azure ID as well. So that's the first tip for graph Explorer, just type g dot, cmd.ms and you're, taken straight into graph Explorer.

B

Now for those of you who haven't used, Graphics Pro I'm, pretty sure that that's going to be very slim, a minority of folks that I haven't used it I just walked through some of the basics and some of the things you might have missed, because graph Explorer has been there for a long time. You would have just been using uh maybe about half of the features that are that that exist here.

B

um So the first one is, of course you can type in any URL and you hit run query and it will execute the query and show you the response here. So you get that option to um run any graph API and you get the results here now. On the left hand side, you get lots of examples. So all you have to do is say. For example, say you want to get users you search for user. You get list of all the apis, that include user, and you can do things like get me.

B

Save my skills or you know, count the number of users in your tenant. You say you add that in and you run the query and you can get the result set now. The samples are really good because they do things like I'll cover this later in another tip as well. But if you use some of the special queries like dollar count or filter, you need to add some special headers and this these samples add the header for you. So it's a really easy way for you know uh getting this in.

B

If not, you need to manually come in and type these parameters that say, consistency, level and eventual, and things like that. So uh some of these Advanced graph API queries need those headers in place and these samples add them in. So it's a quick and easy way of adding those in by just going there from the the samples.

B

Now, if you didn't know you could you can also do edits from graph Explorer itself, so you can call get which I guess is what a lot of people use, but you can do also do things like post patch and even delete so say, for example, I want to make some change to my some of my profile. Details. I can just come in here copy paste that, because it's a patch, you only need to put in the things that you do want to change, so I'll, just um clear out everything else that I don't need.

B

So let me just you know, do a typo and do a change here. So you change that to a patch and you do a run query.

B

um You just see I just added the letter S at the end, you can see in the previous one I don't have so I run this and the patch went through a head. It's a 204 that was successful. uh Now if we do a get- and you run the query, you will see that it has updated right.

B

So, if I head on over to the portal and search for my name- and this is another tip, if you weren't aware this search bar on the Azure portal searches across everything, so it will even find users for you um and say, for example, this I click here and I straight away, get into my user profile. So you come in here and you go into properties. You should see that my name has changed on the portal as well right.

B

So this is a really cool way. To remember that you can do patching as well from the the graph Explorer right, so um I a lot of people. Don't really realize that you know you can do all these pack chain updates from here. Another neat tip is to know that you do have something called the history right.

B

So I've seen people you know copy and paste the same thing over and over again when they don't realize that there's a full-blown history here for 30 days, so you can go back to any sort of query that you had previously um so I click this one. It shows the API that I ran and the results that came through I can run them again. So you don't need to copy paste things again.

B

So if I want to get back to that edit, that I just did before I just click that- and you can see that uh it brings up including the stuff that I put in here right. So it's a really powerful feature there to have the history, and you can sort of run this from here. You can also download this into like a har file and you can open it up on Fiddler I. Believe even Postman loves opening these things up. So it gives you a quick way to like move the move.

B

Like you know this whole set of things, uh the queries that you ran into Postman or into one of your other favorite tools right. So that's another easy tip there.

B

Okay, so moving on into some more tips about the graph. Explorer is the share button, so you are working with the team and you created you've crafted like a complex URL in the history. Now this one is a simple one, but if I do things like, uh maybe you know getting a secure score and added some parameters, and so on.

B

You have the share button and you can copy that and share with one of your your teammates and they just get to the same page where you're, on with the query typed in as well right, so um very easy way to get someone onto that same context, um say you're doing screen share and you want to hand over to them. This is an easy way to move that across right, so very powerful there.

B

Next we get into this tab called the modify permissions tab now. This is where it's sort of very dynamic in this blade here. So, as you type in your query, you'll see this. If I come in here and I go to say, I want to make a call in admin, slash, say: Service Announcement, you can see the this page refreshes and it gets you the list of graph permissions for that particular API. Now, sometimes it I don't know if it's my network, but maybe I'll try a simpler one. So, let's say beta slash users.

B

It's like just a while to load. So if I uh go into one of the apis that I need, you can see it dynamically refreshes, based on what I want to pull across right. So Theta, slash.

B

uh There's sometimes these apis take a little while to load up, but what happens is it shows you, the permissions um for that particular component or the API that you're calling that maybe I'll just try a refresh of this page yeah? So for me, you can see that it, for the me API is showing what are the graph permission Scopes that are needed, so it's very context sensitive. It's one, easy way if you were trying to call into a new API and you're figuring like what what permissions do I need.

B

You can go to the the docs, but this gives you a really quick view of what permissions are needed and the neatest thing here is: you can do a consent right from within the screen, so you can click consent and if it's your Dev tenant, you are the global admin you can just you know, Grant yourself, this permission.

B

um You can also remove a specific consent. If you want, you know retry or replay the practicing, this you can just say unconsent to the permission and it will remove that function right. So sometimes you get this propagation delay thing. So if it's a Dev tenant, you want to reset it back to how things were you. You will be able to consent and unconsent this way. If you want to clear all of the content, so this is another tip that people sometimes might not be aware.

B

If you want to remove all the permissions, you would just want to reset it to how it was. When you first created your tenant, then you will go into the igid portal.

B

um You go into the Enterprise applications plate and you can search for graph Explorer and you can actually delete that you can delete the entire app and you don't need to worry. You can delete the entire app you go back into the graph Explorer you'll be able to reconsent to these permissions right. So that's a neat way to uh sort of, especially the dev tenant. You want to reset things back to how they were quick and easy way to get Graphics product back to how it was right.

B

So that's with, with the consent permission now, for example, you might not know the API, but you know uh the the permission you want to Grant uh there's a hidden place here. You might not have seen or known about this um you hit on your profile. Then you click on consent to permissions. It opens a full-blown view of all of the permissions right so from here you can just type in say, directory dot, tree dot all and you can just type in the permission and you can consent to it.

B

So if you ever need to give graph Explorer a permission like that, you can just come in and you can see which permissions are needed.

B

So that's a neat tip, so these are all like power, user tips about graph explorer that might be all coming out new to you another one that I really like is if you go into a sort of a new API and you're, not sure what the API does or how it works. You click through on the more info and you can say, learn more it'll. Take you straight into the graph API for that particular uh the reference docs.

B

For that API right, so you don't need to go to Google, Search or Bing and then search for the API and then come and find it it's just one click of it. So you you pick on any API that you want you come here and you click learn more you're just taken immediately into the reference doc. So that's a really powerful way of getting into the docs without spending time searching you know and then trying to figure out. How do you get to that API, because these things are not always really easy to search?

B

Normally, you can, you know, give the URL and search, but uh with some of the more complex ones, um especially where you have lists of parameters in it's. uh It's a bit more harder. So remember these, these all, because they're all hidden away, most people don't find them out right and we don't really spend time learning graph Explorer, um so I thought it would be really good to cover some of these.

B

Our user tips- and another thing you might not have realized, is when you do this. Let me say: groups right, so I'll just go and go to groups right um and I run the query. You get this responses here at the bottom now again, these hiding in in the other tab. So you might not really have come across this, but you can do these sort of code Snippets right and you can see the code snippet straight here in your favorite language, whether it's C, sharp or JavaScript.

B

You get the code samples here and remember those examples we did before so I'll go into history and say where I did that patch of my command. So let me bring that up is the one that did the I think that has gone past in the history but say if I come here and do a patch.

B

So we'll do this as a patch and I'll make some changes. Maybe I'll set my name back to what it was.

B

Perfect so I do this patch and it does the update. But if you go into the code Snippets, you will see you will get the API for doing that change right. So you you can just copy and paste this and it has the the exact content you provided or you want to get the Powershell version of what you just did. This is a neat way. You, you already have the code. You just copy that over and you have a full-blown um useful capability there right. So these languages are expanding.

B

You, you even get go and like even C sharp code, so you don't need to like there's a lot. You can do just from graph Explorer itself to get these things. If you are a toolkit user, you can also use uh like the the graph toolkit controls uh which can show you. You know how that graph toolkit will show up and render so another powerful thing which shows you like the JavaScript and CSS. You can make changes here and see how it works out, so very powerful.

B

They are, and there is also adaptive card for the apis. I haven't really said that I've played much with it, but it just shows you right. These are things that we see every day, but we don't really go and dig into it. um But there's a lot of powerful stuff have been happening here right. So one more thing: is this access token? So this is really really helpful. uh The access token for this graph session- and it includes all of the permission scope. So if you click here you can copy the token.

B

But if you click on this option here you can see uh this is the job token for the graph Explorer app and you can see all of the Scopes and the permissions that have been granted to it. So sometimes you know you are blocked from doing things with Powershell and other things in orgs and so on, but maybe graph Explorer is allowed.

B

Sometimes Graphics Pro is blocked as well, but you do get this quick token and if you you can use it in a lot of apis and commands where it might not be a parent right. So you can do something like you can go even to connect mg craft. uh You can pass in the access token, so I just copied that access token I paste that in and now I'm connected right. So if you see get energy context now, it's thinking I'm using graph Explorer and all those permission Scopes that were given I I.

B

Have it now so I don't need to you know, remember a username password do all of the MFA and things your in graph Explorer. You just want to quickly run the same thing you can in Powershell. You can just quickly copy the access Tok. The only thing is, the access token is valid one now.

B

So, if you're running trying to run some long running script, that might not work if it's going over that Panna period, but this is very helpful if you want to quickly use it in maybe in your c-sharp code or whatever you are, writing you know in a Dev context, it's using this. So it's a good way to troubleshoot the difference between.

B

Well, if you think something is working graph, Explorer, not in your other uh app that maybe you registered, you can just use this to try things out because token is they have all of the apis should work uh just to make sure that it's nothing to do with your code, and then you can uh I sort of use it to isolate where the issues the identity protection it. uh If it's coming from the same machine it should might not trigger, but yeah. That's a good call up it.

B

I I identity protection could find it and it could trigger it right. So um that's uh something to remember so if it's your Dev tenant, you can definitely do it your own tenant right, so it wouldn't affect uh what anyone's doing um the next one I all this was my first tip, but this is a quicker way or as well. If you click this option, you will be taken to the dev program, URL from where you can join, so you can either Google M365 Dev and get to the same page.

B

But if you don't remember that you can click here in the tenant settings and get click on that option. To take you straight into that page, okay, cool.

B

Right I think I covered all of the tips that I had on graph Explorer yeah. All of that stuff cool, so I think that uh hopefully was useful. uh Next is the graph API reference docs. Now these are some tips about using the API reference docs, because I I know people get sort of thrown out with all of these different things right. So the first one is I always have my um I'm sort of like a command line.

B

Guy and I want to get to where I want to go without having to click multiple times or do searches. So you'll always see me using an AK dot, Ms or some sort of shortcut. So graph ref will get you to the graph reference, so you just type AKA dot, Ms, slash graph, ref you'll be taken to the API for Microsoft graph right. So you are quickly into the API. You can drill through the user list, and you know you just get in there. You don't need to search, or you know, bookmark these.

B

You can also switch between V1 and beta quite easily, um and that's like one you when you're writing code. You want to get to something you can do this now, I already shared the tip where you can go straight from graph Explorer to the particular API from here, but sometimes you don't even know the API. You might end up.

B

You might have to come here to search and get to that right now, one like a really important tip that I use here, which people get lost uh around with the API is the API always has this top level um with almost all of them. On the left hand, side you get this, the main object type listed and it lists all the methods. Most people skip this page.

B

They think okay, that's just random stuff there and you go into the API that you're actually working with, which is like you know, get a list of users or you know, update users. You get this list, but this is actually very useful, so I'll use group as an example where I'll pick that group example in other places. So when you do groups- and you say- okay, you want to create a group.

B

Now you come here and you you look at examples, and it says okay, so you can pass this in uh into the group as parameters. Now you might think. Okay is that all I can pass into the group and you're like like that. Doesn't look like what you should be able to do more with the group right. So the tip here is you there's always lots of Link here to the actual reference object right.

B

So if you click on group on that link or It's, usually the top level thing it takes you to that summary page, which shows you all the methods. Now this is good, but what I'm always really interested in is properties. Now this is sort of the hidden secret.

B

When you come to the properties page, you will see every single property that you can pass when you create a group, for example, right and even better, is these these options, so all of the parameters that you can pass in uh for any of these, you get that full list of what what you can pass in when you create a group right. So all these details are included um and let me see right so I'll give you an example of what I mean so say, for example, resource Behavior options.

B

Now what do you pass and it's a string collection? What are the values that you can pass in here and if you see over here, you will actually get to see a list of all of the actual types they're, usually like magic strings, because this rest API right, um you get to see all the options that are included and you can pass them over there right. So this is very useful uh page that not a lot of people are aware of right and the other most important one.

B

Usually you need to query these objects when you're writing graph, API to filter and so on. You get this definitive list of um what filters that particular field supports, so you don't need to blindly try different things, because not all of them support all of the queries. So if you say I want to get a list of all the groups where the preferred language is equal to English you'll by coming here, you'll be able to quickly know.

B

Does it even support the equal operator right, because various operators are not supported, depending on the lots of things going on behind the scene, and some things are supported some art right? You can also see you know this. One supports count not equal to zero, so you can do things like get list of all the users who don't have a proxy or who who have a proxy address. So you can run queries like slash count. Dull account equals zero, not equal to zero foreign.

B

And these apis are really powerful. It gives you all of the information that you need and it's sort of hidden away behind the scenes and uh I I need to usually guide when I'm working with teams I need to guide them to how they can get to this page. These pages, so remember with all of these, you need to remember to get to the resource object like, and sometimes some apis uh call out the object.

B

So you can see the return type or the object type that you need to pass in for these things, so you can click through on those. Sometimes you need to click through a few different times to get to the the actual object and what you can pass in right. So uh this is sort of like an app role assignment you click through here and then you get to see. Okay, what are the IDS for example? What can you pass in right?

B

So it gives you um much more information and you can then work out your examples from there right so make sure you remember how to do that with the uh with the graph API docs, another tip with the graph API dock. If you haven't seen it or maybe you've seen it but you've never used it is. There is sort of like a mini graph Explorer built into the docs, so you can use, try it Now. It only works with uh sort of the sample data.

B

That's included not with your own data, so you might not get results all of the time, but it just gives you a quick overview of that API and you know how it works. So if you want you can, then click on you know go to the full experience that will take you into graph Explorer with the full-blown one, and it includes the API that you are using. So this is something you might have seen but never tried. You can just come straight into into here and try that out from there right.

B

So you click here you get taken out, but that's a really powerful way to get uh to the documentation as well. So my main tip for the graph API is is just that. Okay, the other main uh tip, is um at the bottom of every page. So if you come across any issue with an API, you try, it didn't work or it's not. You know working the way you expected or you wanted to do something different or maybe you know you want to contribute you. You have look at these examples.

B

You got something working which is slightly more complex. You want to add another example to contribute. You can say, submit and view feedback for this page, so you can click that uh you'll need to sign in I'll. Just uh do this in my other profile.

B

B

So you can say, submit feedback for this page and you will be straighten straight into the graph API for the in the docs page, and you can come in and see um how you can make that change. uh Sorry, you can request things right, so you can say, there's a bug you found and you can contribute to this. These are always monitored and reached by the docs team for those pages. So it's a really good way to give back to the community.

B

um If you found an issue that you know you would like to get fixed and so on, and so that's um how you can do back and help out as well.

B

Okay, so that's graph ref remembered ak.mslash graph, ref, okay, graph filter. Now. This is something that, if you're, if you're a Dev you'll, be using quite a lot and if even if you're, an ID Pro, this is something you need all the time right. You have these objects and you need to query and get results. How do you uh ak.ms .m?

B

How do you know what is supported? What's not supported, you try to run some command in graph API um and it's not working. It says this is not supported. You you're just getting some random errors thrown at you. So that's where the use the wrong shortly.

B

Aka.Mslash graph filter.

B

So graph filter takes you straight to the graph API page that shares the filter. Now you can also go to graph ref and scroll down and find the right page, but graph ref will take you here.

B

uh The neat thing is: it gives you all of the different parameters and options that you can use when you're making a graph API call, and there are loads and loads of examples here right. So this is to anything you want to do a get and run queries on any of the graph objects, whether it's users groups devices, whether it's in SharePoint themes, um almost exactly sort of the identical set of apis. The only thing is because of how all of our different products are built, the filters and what they support can be different right.

B

So that's why these docs are important, because they let you see what's possible and what's not uh what I really like is this link here? If you you go down, you'll be taken to this filter page, but if you come to the advanced capabilities, um you I don't know if you might have seen this before, but you had this neat table. That shows you for some of the key Azure active directory objects. What filters, what what operators are supported right.

B

So you can see some of these don't support the equal to null or equal count, equals zero or some where you can see this right. So this gives you a really neat to you. You don't need to do any guessing anymore. uh You can see if a particular object supports something that you're trying to do, whether it's even in the list. So it's a quick way to scan everything like you can go and look in the API docs itself, which gives you the that information, but this gives it in a neat nice summary as well.

B

Are there any open questions on this.

A

There's one from Harry which says how about adding the code snippet to the preview experience directly for easier example, access I think that's more of a comment right: okay,.

B

Yeah I think those startup suggestions. We can always take back to our teams- absolutely absolutely yeah cool yeah, so this filter is very powerful. You can do this and some of these are new. So if you tried some things with graph, maybe a year or two ago- and they didn't work- doesn't mean that it still doesn't work anymore because we keep changing and we keep adding these things. So um the one thing with graph is you can't assume anything?

B

So if you, if it didn't work before you, try the try doing the same thing always come back and check, because maybe it's possible enough right. So there are always improvements being made, and these are not things that are sort of advertised and you'll need to find them out on your own. Now, one really important thing with all of these Advanced. These are called Advanced capabilities. Is you need to pass param some parameters in which I showed in graph Explorer?

B

You need to add this header called eventual, and you need to send that in now you might say: okay, how do I do this in Powershell? It's confusing! uh You know. How do you pass this header and and so on? So what you can do is go always go back to graph, Explorer and say, for example, this earlier example thing that I showed you run this.

B

It gives you just a number which is the count, and if you go into your code snippers, you can see how they always head at the header for those things right, so that makes it really easy to know how that works. So some, obviously the generation engine doesn't work too well, so it makes it harder but say, for example, let's do I think groups might be simpler.

B

Yes, I think that doesn't, but with the graph Explorer with Powershell as well, you will need to add the header to do that, and sometimes you need to do the count right. So that's a dollar count variable, maybe I'm not sure why it's not working but definitely worked when I tried yesterday.

B

Yeah, um so with graph API, you can add the same headers by using that right. So you have the consistency level and the count is another parameter that you need to sometimes use right. So you can see how this works. So, if I do this, try it option. That might be the faster way.

B

Okay and I'll also go into The Full Experience, so we can see that.

B

This works, this work right so um but yeah I think this. This is sort of see this is uh Auto generated, so this actually will fail if you run it in Powershell, uh because yeah in partial, you need to have spaces instead of the plus sign, so you might sometimes need to tweak the Powershell examples that you get, but these are things we report back to the team that writes these engines and they fix them as we call them out right. So um the advanced filter is one where I spend a lot of time.

B

Trying to do things and it's it supports all data. So it's very complex and things that you can do there. There are lots of capabilities there. uh The other tip is there is a training module which is really good. So if you haven't done it and you work with graph quite a lot, this training module will take you through lots of things. You know, you'll become an advanced graph API, especially with all data.

B

You'll learn quite a lot of ways how you can work with all the different entities and search and how you can perform these various searches. So graph is like the glue that holds everything together in M365 and if you are n365 Dev, definitely an area where you it's always good, to learn and how you work with these things.

B

Okay, so jumping on to some of the tools that I've created um the first one is graph x-ray. This is a browse extension that I've built. So if you go to um idk.ms, slash, Graphics tray or graph x-ray, Dot mineral.net or if you just go to metal.net I, have like all of my apps LinkedIn from there you'll be able to get to your extension. So there is an edge, a Google Chrome add-on as well, um and you can install the extension now once you install it.

B

uh What it does is any any portal or any experience in Azad, that's calling. So what happens? Is these portals are also now nowadays being built using Microsoft graph, so the same graph API that you use is what our first party Microsoft developers as well use to build all these different portals.

B

Right now we are modernizing all of our portals. So not everything uses graph API, but some of the big ones that were pre-written are users and groups and, like you know, some of the more common ones. So once you install graph x-ray, you get this extension. You need to open your Dev tools, so you will either press F12 or command alt I on a Mac, and you can get to the graphics right now.

B

This is where there's something in Chrome, where it doesn't show up all the time and I need to struggle getting that in okay, it's turned on off again, so let me go to ad.

B

Maybe I'll try on a different instance.

B

B

They should have funded users. Give me a second, let's see if at least some yeah it works on this okay, okay, so once you um install the extension, if you come into devtools you'll see this graph x-ray being listed. Sometimes it takes a while to load with the Chrome. Has Chrome and Edge. Has this weird thing with Dev extensions? They are blocking something, so it sometimes take a few more Refreshers okay. So if I go to the user's plate right, uh you can see here.

B

What happens is every time uh the whatever the browser page you're looking at when it calls graph API graph x-ray will start showing you like a stack trace of what's Happening behind the scenes on that page right. So this is a an extension like we built for an hackathon that we worked on last year and the neat thing this again with this is you can pick your language. So if it's JavaScript and you like, for example, I'll search for my name.

B

Right so I pick say my object and you can see the the apis that are running on behind the scene. They all show up right, so I can go click edit um and you can see it shows up with all of the changes and you you can even do your own updates and hit save um and you'll see the code generated for that right. So, if you want to see the version be generated as Powershell, you can do that or you can do this with JavaScript as well right.

B

So it's a really neat easy way to uh like what we did with Graphics program. But on this side you get to see this with um we're just using.

B

Right, so what are the usual demo that I like to show is using groups? So if you go into groups um and you sort of try to create a new group right, uh there are so many different parameters that you can pass into a group right. So you can say yes, I want it to be role. Assignable uh or you can say, I want it to be a dynamic user group and you can create your own Dynamic query here right. So, let's see account enabled equals.

B

True right, so you type that in and you add the expression, okay, so go back into.

B

So I'd save that right, so I'll say test group right um and I, even maybe assign an owner which is I'll, give a Dell.

B

So once I clear this um I clear this and I hit create you can see it shows the exact like you know all the parameters that I passed in um it will show what I pass them in right so and if you're doing it in Powershell. Sometimes these are really you know complex to understand how to craft them. You get a really quick way to see how that was crafted, and you can then just copy and paste that and use that in your graph Powershell right. So um that's very useful.

B

I saw someone like InTune portal is heavily built using graph API. So almost all the blades work. The thing with this is not all of initiated, not all blades use graph Explorer. So if you go into some of the things like app I think Enterprise apps now do. But uh if you click through into one of these, you might not see much happening right so but yeah it looks like apps uh had been they've started, doing a rewrite, so graph x-ray is very useful tool to have in your toolkit.

B

The next one is graph permissions Explorer. The graph permissions Explorer is actually useful for security folks. So this is where the reason I built that uh someone asked okay when I create Grant directory.read.all, uh what permissions am I, giving someone right so um I, unfortunately, works better with Google, so on a Google search if I search for say directory.readride.all um when you search on that. Usually this comes up as a second search hit.

B

If someone says, if your security team asked like what are the things can I, can someone do with those permissions I created this page, which gives you this view of all of the apis? That someone can call by permission now our normal Docs gives it the other way around. So it'll give you saying um you know for this API. This is all you get at the moment.

B

So it's sort of not very easy to understand what this you know where the security someone is reviewing it and they want to make sure you get only the least privilege uh what you can do with that. So this page really helps so that's the graph function Explorer. You can search and come through Google, which is how a lot of people come to these different pages or you can even search from here right.

B

So you can see user.read that all some API you can get to that particular page and you can see you know all of the different apis that can be called and you can then click through through the actual API from there onwards. Now uh the this that page is written by scraping the docs. So it's not 100 accurate, but our internal teams are working on having this built into our uh into graph API. So hopefully we'll get a better list from here now you can get to some of this from cloud permissions Explorer.

B

But this view of all of the permissions is sort of only available with in this blade in this sort of new portal. At the moment,.

B

To uh graph partial, so graph Powershell, uh this was supposed to be half graph official, but I spent a lot of time on all the others, but I think it was useful anyway, because uh graph Powershell also relies on all of this right. So you need to know how to move around in the graph API for you to be able to use graph Powershell, so AK dot, Ms, slash graph. Powershell uh is sort of like a link tree that I've created to give you all of the main things about craft powershelling sort of one page.

B

So just remember that in here.mslash graph Powershell um what happened with Azure ID Powershell and the other powershells before it is, we had a team that was manually building all of the commandlets, but as people know from history, new apis will turn up, but the Powershell will not appear for a long time. Sometimes it took a year sometimes longer um before the Powershell commandlets were all available right, so it was very difficult with some of those things.

B

So what we done now is uh the graph Powershell and a lot of other libraries like uh the go Library. Even the newer python. One Etc they all get auto-generated now uh based on just the API specs, so there's a graph API, so we don't have people hand crafting and writing these, so you can quickly get through to the craft Powershell.

B

uh There are some other links that to remember as well, apart from the link tree so which this is what I frequently use, which is AK dot, MS, slash mgps, which is Microsoft draft Powershell, which gets you to the quick page about graph Powershell how to install it. All of the commands that you can do and the key is this reference, so you get to all of the the reference commands.

B

So if you want to get say like get mg user and so on, uh you can quickly look those up from here and get to the page that you need to now some of the important things room base. If you know your way around graph API, it's fairly easy now to work out how you can do the uh the Powershell version of that right. So there's always a get get post put patch, so they have corresponding verbs in partial.

B

So you can easily remember how what it is that you need to call by just going through that right and then how the API maps to the commandlet name is also really simple. So if you were to look at this right and if someone asks you what's the graph Powershell version of this- it's usually get mg and then user and message. So if you see here, that's what it maps to I'll make this bigger right, so I get mg user messages and it it comes into that right.

B

So that's how you can sort of translate a graph API call into Powershell. Now, of course, you can always use that snipper feature now, which is really handy to get to the Powershell version. um But if you, if you know the API, you can easily do call this from here. Another trip that a lot of folks don't know or might not realize is okay. You know you have the API, but what permission scope? Do you need right? So you can use um Powershell itself to sort of figure some of these things out right.

B

So if you want to call get mg user, but uh it maybe it might throw an error saying you don't have the permission to call that. So we have this find mg command where you can say, okay for this command.

B

um Let me say this one get mg secure score right. It gives you a list of what are the apis that are available. Now you need to use this format list option to give you a breakdown. So when you do format list it gives you a clear view to say for this Powershell command. These are the permissions that you need to use and it goes from lease privilege to the high privilege. So you can then say: okay, right, that's the permission. I need!

B

So now you can say, connect mg graph and you can say Scopes and you can use that scope pass that in right. So that gives you a really quick way to get into uh the graph API commandlet and it's a few sort of tips on how to navigate between the different things in graph API right.

B

um Sometimes the docs fall behind just the other day, I found out in the docs. The Powershell the API was there, but the Powershell commandlet was not being generated, so you we had this other uh API called, find graph command and you can give just the URL uh say: maybe this one and it gives you the the exact commandlet that you would call for that right. So this is a really useful thing and this is only exposed through Powershell.

B

So this is where you know the URL, but the docs also don't show what the partial command is. You can use this to get to the right, um API right so find mg graph. It supports y card as well. So this one is a an important tip use the dot star, so you can do a wild card search right. So that's a very neat and Powerful way to find the right command pool so um yeah so graph and the last one is sometimes the command lets uh might not give what you need.

B

Do you know the handcrafted commandlets? You can always do invoke graph requests. So if you got it working in graph Explorer and you know the URL, so you can do things like info craft request and you can run this uh once run some query. So I'm is calling something maybe.

B

I'll just do a simple one, which is invercraft request and.

B

Let me say: let's get me graph, microsoft.com slash, V 1.0, slash users right, so you can do that to now. That's the difference. When you call the invoke command, where you can, you know call the raw graph API it'll, give you like a different object that you need to then pass through to get it doesn't give the rich object that you get with the commandlet, but sometimes this is the only way to do, especially if you want to do your own paging of the results.

B

You know you want to have a long partial script that runs might take hours to run and you want to page through each result set and do things. uh Then this is useful here.

B

Right um yep, so that's what we can do with Bluff Powershell, okay, so the last tip we are deprecating Azure, ID Powershell and we are recommending you more to graph Powershell, so both Microsoft online and Powershell now I know we are not 100 there with all of the commandlets, um but we are working. We are almost at 83 now and we hope to close uh that entire Gap.

B

So if you are someone who has been working with Azure ID Powershell for a long time- and you have lots of scripts written, you want to upgrade- you go to the same page that I had before and I call this craft PS map to get there. But you can also go uh from the other page so and let's go to AK dot Ms slash graph, PS map.

B

uh We provide this page where we map all of the IGA partial commands to the graph. Now you can see, we do have gaps, but we have been closing this down so right now. This is sort of like a full list. It includes all of the Azad Powershell and even the MS online commandlets.

B

We give you the graph version of these, so this is continuously being improved and we're asking that you move to this uh to switch over now, it's a little hard to rewrite all your scripts, so which is where graph polish. Why I built graph Powershell uh like a conversion analyzer?

B

So if you have some script right say something like this, where you were calling, you know, get Azure user and you know doing various things. um If you wanted to write the Powershell version of this, let me zoom out you click. You write you, you just copy paste your script in and you hit analyze. We this generates and spits out a whole list of the partial commands that you would use now, uh and you know it will.

B

Take your old code say something like this and trans translate that to the graph version of the API right and what I especially like, is you know, being able to click through to all of the different links from here, uh because when you're here there isn't an easy way to find out what is the AP graph API, because the docks in Powershell are improving, but they are not.

B

There yet, especially when it comes to all the different you know, Advanced parameters, so there's a quick link to get to you know the actual API for that commandlet and then figure out. You know, okay for use object. What are the different parameters that I need to pass in? You can find them from here. So this is our way to sort of help.

B

You move and migrate your script over awesome thanks for the call out 10d yeah, so this is sort of like in when I, when I used to be a Dev from you know, a VB Dev and we were moving from BB to C sharp.

B

There used to be all these nice converters that let you copy paste the code and get the c-sharp version of the code, um and that was my inspiration for building this now one of my good friends Frederick built um PS migration advisor because you can do this, for you know single scripts, but if you have a whole repository of lots of PS1 files, doing that's a lot harder. So you can use this partial commandlet that he built um where it can give you like spit it out.

B

It can scan an entire folder of Powershell scripts and give you the same recommendations uh but straight from partial right. So if you were doing like a bulk migration, that's a really easy way to work across cool awesome, so that about winds down. Everything. I have um feel free to follow me on LinkedIn, on Twitter, at Merrill um and on Master Don as well. uh Merrill at infosec data exchange um and yeah I sort of tried to post some new tips and tricks uh on on Twitter as well too.

B

So it'll be a good way to keep on top of things.

A

Absolutely I would definitely encourage you. Folks, like follow. Marin I learn a lot. It has helped me in my project, so please do a follow.

C

A

And you know what he's going to be a regular guest in this call. I will ensure to book his calendar going forward because I'm pretty sure he's going to generate a lot of new tips and tricks by six months or three months or whatever.

A

So uh there are a lot of questions uh in the chat. We've I've tried to do justice, but then, uh if there are questions that are still not answered, folks, please feel free to come off here and ask a question uh would be happy to take it off.

B

A

I would say Meryl. This is by far uh you know. I've, like I, think I needed an army to manage the comments and all the you know uh it's by far a very popular topics, no two thoughts, I would I would be not not be surprised if we get a lot of views on our YouTube video as well. Yeah.

B

I I was surprised. These tips are not. You know, we have it in the docs, but I didn't find many clips, and you know athletes presentations that colored all this because graph Explorer, no one is like going to learn all the tips and tricks there right. Absolutely so much in there.

A

um Yeah, okay, uh folks, if you have no questions, I mean uh uh be, you know uh we would be probably done for the call, but then, if there are any questions, I would give you one more chance to uh come off, mute or even put it in the chat I. Would we would be happy to take it up.

C

I have the one in the chat about the permissions for Microsoft graph and Microsoft graph Powershell applications. If you have user consent, turned off in your in your tenant. How in the world, do you let people you can only admin consent for these things? How do you get around that for just these two applications, because of I mean you didn't need this with with Azure ID or Ms online Power Gel yeah. So how do you I mean you know and and worse off?

C

Is it the only way they can consent for these application administrator doesn't even allow it. You have to be I, believe a permissions permit or a privileged role, administrator or Global admin to permissions. We don't want to give to people. How do you get around it? Yes, yes, big problem.

B

Yeah, so why we moved away from pre-consenting is basically like with the Azure the Powershell. It actually follows a not a it's, not really good practice of pre-consenting all permissions to uh Azure ID Powershell, for example. Right, and we know that you know the folks who write you know the bad folks. They use that same Azure, the app to do things in tenants and that's how someone can just run a script and it can do things that are harmful for the tenant.

B

So we tilted more towards the security side on the newer graph partial, where nothing. No permission is pre-consented and your tenant admin has to pre-consent, so they can grant consent. What they can do is they can go to graph Explorer and limit who the users are. So that's one way we recommend.

B

So they can say you know every anyone who's a Dev in the tenant to do that or the best thing I tell is use your own Dev tenant. And then you can do everything in there and you don't need that. But um but you might a tip for your admins if you are an admin, and you want to allow just uh some of the folks to be able to do this, what you can do is uh in the app Enterprise apps you can limit.

B

You can limit it to just the users uh that need that act. So if you go to Enterprise apps you search for graph, Powershell or graph Explorer, uh so you get both here right. So this is graph Powershell and then you have Graphics product. They can say this particular app needs a user assignment required. They can say yes.

C

I understand about assigning users to the application, but that doesn't allow them to add me: consent for the permission, there's still a problem. They can never. They can never add the permission to the to the thing. Somebody who is a rope permit, Global adminer has to add. So if you do connect graph, how do you get past that little permission problem.

B

Yes yeah, so that's there is a shortcut which we, our team, doesn't really come. Try to recommend too much, which is there is a permission called directory.accessor asuser.org right. So that permission, if you give it sort of consents to almost all of the delegate permissions instead of one by one, but we normally try to recommend not using that.

B

um So it's this is one exemption where so, then you don't need to give you know at a per you. You know the delegate permission you don't need to Grant each one uh that one sort of gives access to almost all of the delegate apis. So that's a shortcut. It's not an official recommendation.

B

uh You won't see us writing it anywhere and saying to do that, but um the the other ways for the global admin to sort of going and uh consent to the different permissions that the person needs so that that's the the drawback with tilting a little bit more towards the security side um and usually what we recommend is all devs to have their own Dev tenant where they can. You know Grant all of this, and it takes away that um requirement.

C

A

Awesome all right, uh we have gone off time, but then a class check. If so, you have any questions for us. Okay, I see a question. What's the approach we should take to find graph, API endpoint for any use case other than docs, for example, update M365 group properties.

A

uh This is a question Merrell. uh The question is: what's yeah from.

B

Other than docs, um so we obviously will always recommend the docs, because that's where we put in a lot of effort and it's where the dev teams, you know the PMS who build the features they go in and you know put in all the content there. So we try to make that the source of Truth and if you see any gaps in those or mistakes, please use that uh Link at the bottom, where it says report and issue and submit if something is not clear.

B

Just give your feedback, because our content, writers and those teams are always looking to improve this, and we want that to be the One-Stop place that everyone gets so right. We don't want to have lots of different destinations.

B

um So there's a lot of effort been put in there with actual content, writers and the PM teams and others involved there if something works in graphics problem, but you get an error when running the command. What might this should be so Rob? That's a good question and I. Don't know if you missed that tip. So one way to sort of work around that is in graph Explorer. You have the access token, so I recommend that copying that access token, using that in in Powershell uh and then running it. So then you can work out.

B

You can sort of try to isolate. Is it an issue with permission? So is it an issue with Powershell because sometimes crafting it in graph in Powershell those Json and things they're a bit tricky? You know converting a Json call into Powershell, um so you can use the access token to remove all of the headaches about permissions and just uh clear out your partial script. Once you get that working, then you can sort of troubleshoot what the app permission is.

B

So the tip there for you is on how to sort of navigate and work through that.

A

Okay, I guess: if there are any follow-up questions, I would appreciate if you could email us, because I think we have shot 15 minutes of the time and I'm sure the questions will continue. So you guys uh know us we are on LinkedIn. You have our email IDs. If not I'm gonna put my email, ID shoot out your questions. I would be happy to take it.

A

Dr, Merrell and uh I'll get it answered, but thanks a lot Meryl for joining at this our time and such a popular topic- and you did a great job, not just with your tools, even the session. uh Thanks a lot guys, you need to fill in the feedback. For us, uh this was a great session. I am gonna, also feel the feedback. So uh please take some time and fill in the feedback for us thanks a lot everyone for joining the call. Thank you.

B