Azure DevOps - How to collect all accounts from Organization using PowerShell

%3CLINGO-SUB%20id%3D%22lingo-sub-2121076%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20DevOps%20-%20How%20to%20collect%20all%20accounts%20from%20Organization%20using%20PowerShell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2121076%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F715928%22%20target%3D%22_blank%22%3E%40vinijmoura%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWelcome%2C%20it%20was%20really%20helpful%20to%20build%20that%20script%3C%2FP%3E%3CP%3EFab%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2120961%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20DevOps%20-%20How%20to%20collect%20all%20accounts%20from%20Organization%20using%20PowerShell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2120961%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F41125%22%20target%3D%22_blank%22%3E%40Fabrice%20Romelard%3C%2FA%3E%26nbsp%3Bthanks%20for%20mentioning%20my%20blog%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2120850%22%20slang%3D%22en-US%22%3EAzure%20DevOps%20-%20How%20to%20collect%20all%20accounts%20from%20Organization%20using%20PowerShell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2120850%22%20slang%3D%22en-US%22%3E%3CP%3EWhen%20you%20are%20managing%20an%20Azure%20DevOps%20instance%2C%20you%20can%20have%20one%20or%20many%20Organizations%20(depending%20of%20your%20isolation%20and%20distribution%20requirements).%3C%2FP%3E%3CP%3EEach%20organization%20will%20have%20a%20specific%20Account%20list%20(with%20license%20associated)%2C%20but%20there%20is%20no%20automatic%20cleanup%20to%20remove%20disable%20accounts%20or%20consolidate%20all%20account%20in%20one%20view%2C%20and%20the%20built-in%20CSV%20Export%20module%20is%20limited%20in%20usage.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20PowerShell%20Script%20will%20connect%20to%20all%20organization%20you%20specified%20in%20setting%20(using%20a%20dedicated%20Token%20you%20have%20to%20use%20or%20dedicated%20per%20Organization)%20to%20get%20all%20declared%20accounts%2C%20and%20loop%20for%20each%20account%20the%20Project%20part%20of.%20If%20No%20project%20assigned%2C%20you%20will%20have%20%22NO%20PROJECT%22%20as%20value.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-powershell%22%3E%3CCODE%3EImport-module%20AzureAD%0Aconnect-azureAD%0A%0A%23region%20%20--%20%20Customized%20Script%20Settings%20(need%20to%20be%20reviewed)%20---%0A%23%20%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%20%2F%20Parameters%20to%20Adapt%20%5C%20%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%20%0A%5Bstring%5D%24SharePointTeamSite%20%3D%20%22https%3A%2F%2Ftenant.sharepoint.com%2Fsites%2FYourCollection%2F%22%0A%5Bstring%5D%24DocumentLibrary%20%3D%20%22YourDocLib%22%0A%5Bstring%5D%24GlobalPATForAllORganizations%3D%20%22xxxyyyyxxxxxxyyyyy%22%20%23If%20you%20have%20a%20global%20PAT%0A%5Bstring%5D%24JSonFolderPath%20%3D%20%22C%3A%5CJSONDEVOPS%22%0A%5Bstring%5D%24DomainNameEmail%20%3D%20%22%40emaildomain.com%22%0A%0A%23%20%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%20%5C%20Parameters%20to%20Adapt%20%2F%20%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%20%0A%23endregion%0A%0A%23region%20--%20%20Internal%20Script%20Settings%20%20---%0A%0A%24OrganizationList%20%3D%20%40()%0A%5Bstring%5D%24PAT%20%3D%20%22%22%0A%5Bstring%5D%24OrganizationName%20%3D%20%22%22%0A%5Bstring%5D%24Organization%20%3D%20%22%22%0A%5Bstring%5D%24UserGroupJSonFilePath%20%3D%20%22%22%0A%5Bstring%5D%24UserListJSonFilePath%20%3D%20%22%22%0A%5Bstring%5D%24AccountValidInAzureAD%20%3D%20%22%22%0A%24DataRefreshDate%20%3D%20Get-Date%20-Format%20%22yyyy-MM-dd%22%0A%5Bstring%5D%24TempEmailAddress%20%3D%20%22%22%0A%24UserGroupsOveralOrganization%20%3D%20%40()%0A%24UserGroupOveralOragnizationJSonFilePath%20%3D%20%22%24JSonFolderPath%5CDevOps-UserGroups.json%22%0A%0A%23endregion%0A%0A%23region%20--%20%20Each%20Az%20DevOps%20Organization%20%20--%0A%0A%23YourOrganization1%0A%24PAT%20%3D%20%24GlobalPATForAllORganizations%20%23If%20specific%20https%3A%2F%2Fdev.azure.com%2FYourOrganization1%2F_usersSettings%2Ftokens%0A%24OrganizationName%20%3D%20%22YourOrganization1%22%0A%24OrganizationWithPAT%20%3D%20New-Object%20PSObject%20-property%20%40%7BOrganizationName%3D%24OrganizationName%3BOrganizationPAT%3D%24PAT%7D%0A%24OrganizationList%20%2B%3D%20%24OrganizationWithPAT%0A%0A%23YourOrganization2%0A%24PAT%20%3D%20%24GlobalPATForAllORganizations%20%23If%20specific%20https%3A%2F%2Fdev.azure.com%2FYourOrganization2%2F_usersSettings%2Ftokens%0A%24OrganizationName%20%3D%20%22YourOrganization2%22%0A%24OrganizationWithPAT%20%3D%20New-Object%20PSObject%20-property%20%40%7BOrganizationName%3D%24OrganizationName%3BOrganizationPAT%3D%24PAT%7D%0A%24OrganizationList%20%2B%3D%20%24OrganizationWithPAT%0A%0A%23YourOrganization3%0A%24PAT%20%3D%20%24GlobalPATForAllORganizations%20%23If%20specific%20https%3A%2F%2Fdev.azure.com%2FYourOrganization3%2F_usersSettings%2Ftokens%0A%24OrganizationName%20%3D%20%22YourOrganization3%22%0A%24OrganizationWithPAT%20%3D%20New-Object%20PSObject%20-property%20%40%7BOrganizationName%3D%24OrganizationName%3BOrganizationPAT%3D%24PAT%7D%0A%24OrganizationList%20%2B%3D%20%24OrganizationWithPAT%0A%0A%23endregion%0A%0Aforeach(%24MyOrganization%20in%20%24OrganizationList)%0A%7B%0A%20%24Organization%20%3D%20%22https%3A%2F%2Fdev.azure.com%2F%24(%24MyOrganization.OrganizationName)%2F%22%20%0A%20%24UserGroupsPerOrganization%20%3D%20%40()%0A%20%24UserGroupJSonFilePath%20%3D%20%22%24JSonFolderPath%5C%24(%24MyOrganization.OrganizationName)-UserGroups.json%22%0A%20%24UserListJSonFilePath%20%3D%20%22%24JSonFolderPath%5C%24(%24MyOrganization.OrganizationName)-UsersList.json%22%0A%20echo%20%24(%24MyOrganization.OrganizationPAT)%20%7C%20az%20devops%20login%20--org%20%24Organization%0A%20az%20devops%20configure%20--defaults%20organization%3D%24Organization%0A%20%24allUsers%20%3D%20az%20devops%20user%20list%20--org%20%24Organization%20--top%2010000%20%7C%20ConvertFrom-Json%0A%20%23write-host%20%22All%20Users%3A%22%2C%20%24allUsers%0A%20%24allUsers%20%7C%20ConvertTo-Json%20%7C%20Out-File%20-FilePath%20%24UserListJSonFilePath%0A%20foreach(%24au%20in%20%24allUsers.members)%0A%20%7B%0A%20%20if(%24au.user.mailAddress.endswith(%24DomainNameEmail))%0A%20%20%7B%0A%20%20%20%24TempEmailAddress%20%3D%20%24au.user.mailAddress%20-replace%20%22'%22%2C%20%22''%22%0A%20%20%20%0A%20%20%20%24MyAzureADUser%20%3D%20Get-AzureADUser%20-Filter%20%22userPrincipalName%20eq%20'%24(%24TempEmailAddress)'%22%0A%20%20%20if(%24MyAzureADUser)%0A%20%20%20%7B%0A%20%20%20%20if(%24MyAzureADUser.AccountEnabled)%0A%20%20%20%20%7B%0A%20%20%20%20%20%24AccountValidInAzureAD%20%3D%20%22ACCOUNT%20VALID%20IN%20AZURE%20AD%22%0A%20%20%20%20%7D%0A%20%20%20%20else%0A%20%20%20%20%7B%0A%20%20%20%20%20%24AccountValidInAzureAD%20%3D%20%22ACCOUNT%20DISABLE%20IN%20AZURE%20AD%22%0A%20%20%20%20%7D%0A%20%20%20%7D%0A%20%20%20else%0A%20%20%20%7B%0A%20%20%20%20%24AccountValidInAzureAD%20%3D%20%22ACCOUNT%20NOT%20EXIST%20IN%20AZURE%20AD%22%0A%20%20%20%7D%0A%20%20%20%0A%20%20%7D%0A%20%20else%0A%20%20%7B%0A%20%20%20%24AccountValidInAzureAD%20%3D%20%22ACCOUNT%20NOT%20INTERNAL%20EMAIL%22%0A%20%20%7D%0A%0A%20%20%24activeUserGroups%20%3D%20az%20devops%20security%20group%20membership%20list%20--id%20%24au.user.principalName%20--org%20%24Organization%20--relationship%20memberof%20%7C%20ConvertFrom-Json%0A%20%20%5Barray%5D%24groups%20%3D%20(%24activeUserGroups%20%7C%20Get-Member%20-MemberType%20NoteProperty).Name%0A%20%20if%20(%24groups.count%20-gt%200)%0A%20%20%7B%0A%20%20%20foreach%20(%24aug%20in%20%24groups)%0A%20%20%20%7B%0A%20%20%20%20%24UserGroupsPerOrganization%20%2B%3D%20New-Object%20-TypeName%20PSObject%20-Property%20%40%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20DevOpsOrganizationName%3D%24MyOrganization.OrganizationName%0A%20%20%20%20%20%20%20%20%20%20%20%20%20principalName%3D%24au.user.principalName%0A%20%20%20%20%20%20%20%20%20%20%20%20%20displayName%3D%24au.user.displayName%0A%20%20%20%20%20%20%20%20%20%20%20%20%20mailAddress%3D%24au.user.mailAddress%0A%20%20%20%20%20%20%20%20%20%20%20%20%20UserID%3D%24au.id%0A%20%20%20%20%20%20%20%20%20%20%20%20%20AccountValidInAzureAD%20%3D%20%24AccountValidInAzureAD%0A%20%20%20%20%20%20%20%20%20%20%20%20%20LicenseType%3D%24au.accessLevel.licenseDisplayName%0A%20%20%20%20%20%20%20%20%20%20%20%20%20dateCreated%3D%24au.dateCreated%0A%20%20%20%20%20%20%20%20%20%20%20%20%20lastAccessedDate%3D%24au.lastAccessedDate%0A%20%20%20%20%20%20%20%20%20%20%20%20%20ProjectName%3D%20%24(%24activeUserGroups.%24aug.principalName.Split(%22%5C%5C%22))%5B0%5D%0A%20%20%20%20%20%20%20%20%20%20%20%20%20GroupName%3D%24activeUserGroups.%24aug.principalName%0A%20%20%20%20%20%20%20%20%20%20%20%20%20DataRefreshDate%20%3D%20%24DataRefreshDate%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%7D%0A%20%20%7D%0A%20%20else%0A%20%20%7B%0A%20%20%20%20%24UserGroupsPerOrganization%20%2B%3D%20New-Object%20-TypeName%20PSObject%20-Property%20%40%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20DevOpsOrganizationName%3D%24MyOrganization.OrganizationName%0A%20%20%20%20%20%20%20%20%20%20%20%20%20principalName%3D%24au.user.principalName%0A%20%20%20%20%20%20%20%20%20%20%20%20%20displayName%3D%24au.user.displayName%0A%20%20%20%20%20%20%20%20%20%20%20%20%20mailAddress%3D%24au.user.mailAddress%0A%20%20%20%20%20%20%20%20%20%20%20%20%20UserID%3D%24au.id%0A%20%20%20%20%20%20%20%20%20%20%20%20%20AccountValidInAzureAD%20%3D%20%24AccountValidInAzureAD%0A%20%20%20%20%20%20%20%20%20%20%20%20%20LicenseType%3D%24au.accessLevel.licenseDisplayName%0A%20%20%20%20%20%20%20%20%20%20%20%20%20dateCreated%3D%24au.dateCreated%0A%20%20%20%20%20%20%20%20%20%20%20%20%20lastAccessedDate%3D%24au.lastAccessedDate%0A%20%20%20%20%20%20%20%20%20%20%20%20%20ProjectName%3D%20%22%5BNO%20PROJECT%5D%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20GroupName%3D%22%5BNO%20PROJECT%20GROUP%5D%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20DataRefreshDate%20%3D%20%24DataRefreshDate%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%7D%0A%20%7D%0A%0A%20%24UserGroupsPerOrganization%20%7C%20ConvertTo-Json%20%7C%20Out-File%20-FilePath%20%24UserGroupJSonFilePath%0A%0A%20%24UserGroupsOveralOrganization%20%2B%3D%20%24UserGroupsPerOrganization%20%0A%7D%0A%0A%24UserGroupsOveralOrganization%20%7C%20ConvertTo-Json%20%7C%20Out-File%20-FilePath%20%24UserGroupOveralOragnizationJSonFilePath%0A%0AImport-Module%20PnP.PowerShell%20-DisableNameChecking%0AConnect-PnPOnline%20-Url%20%24SharePointTeamSite%20-UseWebLogin%0A%0A%24Files%20%3D%20Get-ChildItem%20-Path%20%24JSonFolderPath%20-Force%20-Recurse%0A%23Upload%20All%20files%20from%20the%20directory%0AForEach%20(%24File%20in%20%24Files)%0A%7B%0A%20%20%20%20Write-host%20%22Uploading%20%24(%24File.Directory)%5C%24(%24File.Name)%22%0A%20%20%20%20%23upload%20a%20file%20to%20sharepoint%20online%20using%20powershell%20-%20Upload%20File%20and%20Set%20Metadata%0A%20%20%20%20Add-PnPFile%20-Path%20%22%24(%24File.Directory)%5C%24(%24File.Name)%22%20-Folder%20%24DocumentLibrary%20-Values%20%40%7B%22Title%22%20%3D%20%24(%24File.Name)%7D%0A%7D%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20result%20will%20be%20a%20JSON%20file%20(saved%20in%20SharePoint)%2C%20you%20can%20easily%20load%20in%20Power%20Bi%20to%20build%20your%20dedicated%20Report%20helping%20you%20to%20adapt%20Develop%20license%20with%20real%20usage%20like%3A%3C%2FP%3E%3CUL%3E%3CLI%3ERemove%20all%20accounts%20Disable%20in%20Azure%20AD%3C%2FLI%3E%3CLI%3EDowngrade%20all%20account%20license%20from%20Basic%2B%20to%20Stakeholder%20if%20no%20connection%20since%20more%20than%201%20year%3C%2FLI%3E%3CLI%3ERemove%20all%20accounts%20without%20any%20project%3C%2FLI%3E%3CLI%3EAny%20other%20rules%20part%20of%20your%20Governance%20model%3C%2FLI%3E%3C%2FUL%3E%3CP%3EThat%20could%20also%20be%20adapted%20to%20use%20an%20Azure%20Engine%20to%20cleanup%20automatically%20your%20Organization.%3C%2FP%3E%3CP%3EIn%20any%20case%2C%20that%20part%20need%20to%20be%20integrated%20into%20your%20FinOps%20process%20to%20optimize%20your%20license%20costs%20as%20you%20really%20need%20and%20use.%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EFabrice%20Romelard%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3E%3CEM%3EReferences%20used%20to%20build%20that%20script%3A%3C%2FEM%3E%3C%2FSTRONG%3E%3C%2FP%3E%3CUL%3E%3CLI%3E%3CEM%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcli%2Fazure%2Finstall-azure-cli-windows%3Fview%3Dazure-cli-latest%26amp%3Btabs%3Dazure-powershell%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcli%2Fazure%2Finstall-azure-cli-windows%3Fview%3Dazure-cli-latest%26amp%3Btabs%3Dazure-powershell%3C%2FA%3E%3C%2FEM%3E%3C%2FLI%3E%3CLI%3E%3CEM%3E%3CA%20href%3D%22https%3A%2F%2Fvinijmoura.medium.com%2Fhow-to-list-all-users-and-group-permissions-on-azure-devops-using-azure-devops-cli-54f73a20a4c7%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3Ehttps%3A%2F%2Fvinijmoura.medium.com%2Fhow-to-list-all-users-and-group-permissions-on-azure-devops-using-azure-devops-cli-54f73a20a4c7%3C%2FA%3E%3C%2FEM%3E%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3E%3CEM%3EUpdate%3A%3C%2FEM%3E%3C%2FSTRONG%3E%3C%2FP%3E%3CUL%3E%3CLI%3E%3CEM%3EScript%20cleaned%20to%20be%20easily%20modified%20and%20used%3C%2FEM%3E%3C%2FLI%3E%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2120850%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EDevOps%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EFinOps%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ELicense%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Epowershell%20script%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EUser%20Management%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2193434%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20DevOps%20-%20How%20to%20collect%20all%20accounts%20from%20Organization%20using%20PowerShell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2193434%22%20slang%3D%22en-US%22%3ENew%20script%20associated%20with%20this%20one%20to%20perform%20Account%20review%20in%20DevOps%20organization%3A%3CBR%20%2F%3E-%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-devops%2Fazure-devops-send-an-email-to-each-project-administrator-with%2Fm-p%2F2193427%23M14%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-devops%2Fazure-devops-send-an-email-to-each-project-administrator-with%2Fm-p%2F2193427%23M14%3C%2FA%3E%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E
Regular Contributor

When you are managing an Azure DevOps instance, you can have one or many Organizations (depending of your isolation and distribution requirements).

Each organization will have a specific Account list (with license associated), but there is no automatic cleanup to remove disable accounts or consolidate all account in one view, and the built-in CSV Export module is limited in usage.

 

This PowerShell Script will connect to all organization you specified in setting (using a dedicated Token you have to use or dedicated per Organization) to get all declared accounts, and loop for each account the Project part of. If No project assigned, you will have "NO PROJECT" as value.

 

 

 

Import-module AzureAD
connect-azureAD

#region  --  Customized Script Settings (need to be reviewed) ---
# ================== / Parameters to Adapt \ ================== 
[string]$SharePointTeamSite = "https://tenant.sharepoint.com/sites/YourCollection/"
[string]$DocumentLibrary = "YourDocLib"
[string]$GlobalPATForAllORganizations= "xxxyyyyxxxxxxyyyyy" #If you have a global PAT
[string]$JSonFolderPath = "C:\JSONDEVOPS"
[string]$DomainNameEmail = "@emaildomain.com"

# ================== \ Parameters to Adapt / ================== 
#endregion

#region --  Internal Script Settings  ---

$OrganizationList = @()
[string]$PAT = ""
[string]$OrganizationName = ""
[string]$Organization = ""
[string]$UserGroupJSonFilePath = ""
[string]$UserListJSonFilePath = ""
[string]$AccountValidInAzureAD = ""
$DataRefreshDate = Get-Date -Format "yyyy-MM-dd"
[string]$TempEmailAddress = ""
$UserGroupsOveralOrganization = @()
$UserGroupOveralOragnizationJSonFilePath = "$JSonFolderPath\DevOps-UserGroups.json"

#endregion

#region --  Each Az DevOps Organization  --

#YourOrganization1
$PAT = $GlobalPATForAllORganizations #If specific https://dev.azure.com/YourOrganization1/_usersSettings/tokens
$OrganizationName = "YourOrganization1"
$OrganizationWithPAT = New-Object PSObject -property @{OrganizationName=$OrganizationName;OrganizationPAT=$PAT}
$OrganizationList += $OrganizationWithPAT

#YourOrganization2
$PAT = $GlobalPATForAllORganizations #If specific https://dev.azure.com/YourOrganization2/_usersSettings/tokens
$OrganizationName = "YourOrganization2"
$OrganizationWithPAT = New-Object PSObject -property @{OrganizationName=$OrganizationName;OrganizationPAT=$PAT}
$OrganizationList += $OrganizationWithPAT

#YourOrganization3
$PAT = $GlobalPATForAllORganizations #If specific https://dev.azure.com/YourOrganization3/_usersSettings/tokens
$OrganizationName = "YourOrganization3"
$OrganizationWithPAT = New-Object PSObject -property @{OrganizationName=$OrganizationName;OrganizationPAT=$PAT}
$OrganizationList += $OrganizationWithPAT

#endregion

foreach($MyOrganization in $OrganizationList)
{
	$Organization = "https://dev.azure.com/$($MyOrganization.OrganizationName)/" 
	$UserGroupsPerOrganization = @()
	$UserGroupJSonFilePath = "$JSonFolderPath\$($MyOrganization.OrganizationName)-UserGroups.json"
	$UserListJSonFilePath = "$JSonFolderPath\$($MyOrganization.OrganizationName)-UsersList.json"
	echo $($MyOrganization.OrganizationPAT) | az devops login --org $Organization
	az devops configure --defaults organization=$Organization
	$allUsers = az devops user list --org $Organization --top 10000 | ConvertFrom-Json
	#write-host "All Users:", $allUsers
	$allUsers | ConvertTo-Json | Out-File -FilePath $UserListJSonFilePath
	foreach($au in $allUsers.members)
	{
		if($au.user.mailAddress.endswith($DomainNameEmail))
		{
			$TempEmailAddress = $au.user.mailAddress -replace "'", "''"
			
			$MyAzureADUser = Get-AzureADUser -Filter "userPrincipalName eq '$($TempEmailAddress)'"
			if($MyAzureADUser)
			{
				if($MyAzureADUser.AccountEnabled)
				{
					$AccountValidInAzureAD = "ACCOUNT VALID IN AZURE AD"
				}
				else
				{
					$AccountValidInAzureAD = "ACCOUNT DISABLE IN AZURE AD"
				}
			}
			else
			{
				$AccountValidInAzureAD = "ACCOUNT NOT EXIST IN AZURE AD"
			}
			
		}
		else
		{
			$AccountValidInAzureAD = "ACCOUNT NOT INTERNAL EMAIL"
		}

		$activeUserGroups = az devops security group membership list --id $au.user.principalName --org $Organization --relationship memberof | ConvertFrom-Json
		[array]$groups = ($activeUserGroups | Get-Member -MemberType NoteProperty).Name
		if ($groups.count -gt 0)
		{
			foreach ($aug in $groups)
			{
				$UserGroupsPerOrganization += New-Object -TypeName PSObject -Property @{
													DevOpsOrganizationName=$MyOrganization.OrganizationName
													principalName=$au.user.principalName
													displayName=$au.user.displayName
													mailAddress=$au.user.mailAddress
													UserID=$au.id
													AccountValidInAzureAD = $AccountValidInAzureAD
													LicenseType=$au.accessLevel.licenseDisplayName
													dateCreated=$au.dateCreated
													lastAccessedDate=$au.lastAccessedDate
													ProjectName= $($activeUserGroups.$aug.principalName.Split("\\"))[0]
													GroupName=$activeUserGroups.$aug.principalName
													DataRefreshDate = $DataRefreshDate
													}
			}
		}
		else
		{
				$UserGroupsPerOrganization += New-Object -TypeName PSObject -Property @{
													DevOpsOrganizationName=$MyOrganization.OrganizationName
													principalName=$au.user.principalName
													displayName=$au.user.displayName
													mailAddress=$au.user.mailAddress
													UserID=$au.id
													AccountValidInAzureAD = $AccountValidInAzureAD
													LicenseType=$au.accessLevel.licenseDisplayName
													dateCreated=$au.dateCreated
													lastAccessedDate=$au.lastAccessedDate
													ProjectName= "[NO PROJECT]"
													GroupName="[NO PROJECT GROUP]"
													DataRefreshDate = $DataRefreshDate
													}
		}
	}

	$UserGroupsPerOrganization | ConvertTo-Json | Out-File -FilePath $UserGroupJSonFilePath

	$UserGroupsOveralOrganization += $UserGroupsPerOrganization 
}

$UserGroupsOveralOrganization | ConvertTo-Json | Out-File -FilePath $UserGroupOveralOragnizationJSonFilePath

Import-Module PnP.PowerShell -DisableNameChecking
Connect-PnPOnline -Url $SharePointTeamSite -UseWebLogin

$Files = Get-ChildItem -Path $JSonFolderPath -Force -Recurse
#Upload All files from the directory
ForEach ($File in $Files)
{
    Write-host "Uploading $($File.Directory)\$($File.Name)"
    #upload a file to sharepoint online using powershell - Upload File and Set Metadata
    Add-PnPFile -Path "$($File.Directory)\$($File.Name)" -Folder $DocumentLibrary -Values @{"Title" = $($File.Name)}
}

 

 

 

The result will be a JSON file (saved in SharePoint), you can easily load in Power Bi to build your dedicated Report helping you to adapt Develop license with real usage like:

  • Remove all accounts Disable in Azure AD
  • Downgrade all account license from Basic+ to Stakeholder if no connection since more than 1 year
  • Remove all accounts without any project
  • Any other rules part of your Governance model

That could also be adapted to use an Azure Engine to cleanup automatically your Organization.

In any case, that part need to be integrated into your FinOps process to optimize your license costs as you really need and use. 

Fabrice Romelard

References used to build that script:

 

Update:

  • Script cleaned to be easily modified and used
3 Replies

@vinijmoura 

Welcome, it was really helpful to build that script

Fab