cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Azure DevOps - Send an email to each Project Administrator with Account listed into using PowerShell

Fabrice Romelard
Steel Contributor

‎Mar 08 2021 06:51 AM - last edited on ‎Mar 05 2024 01:08 PM by

‎Mar 08 2021 06:51 AM - last edited on ‎Mar 05 2024 01:08 PM by

Azure DevOps - Send an email to each Project Administrator with Account listed into using PowerShell

We saw with a previous script how have a consolidated view of DevOps usage per organization:

That solution associated with Power Bi report is giving a good overall view of your IT delivery team and licenses.

But because the project management and user permission is under Project Manager umbrella, this new script is looking per organization and per project to send an email to Azure DevOps Project managers listing all accounts (with group, licenses, last connection, etc.) existing into their project.

 

Based on that script, you can better review permission and license management accorded with project owners, and match with real needs. This is also a security basic reviewing the external access (Partner, Suppliers, Customers, etc.).

 

 

Import-module AzureAD
connect-azureAD

#region  --  Customized Script Settings (need to be reviewed) ---
# ================== / Parameters to Adapt \ ================== 
[string]$GlobalPATForAllORganizations= "yyxxxxyyyyyxxxxxyyyy"
[string]$JSonFolderPath = "C:\DEVOPS_PROJECTS"
[string]$DomainNameEmail = "@yourdomain.com"

# -- Email configuration ----
[string]$DevOpsAdmins = "AdminEmail@yourdomain.com"
[string]$SMTPServer = "your.smtp.yourdomain.com"

[string]$EmailCoreTitle = "[[yourproject]] - Review Azure DevOps Accounts and licenses associated"

[string]$EmailPreCoreContent = "<DIV><P>Dear team,<BR><BR>
We are reviewing all Azure DevOps accounts associated with your project <B>[[yourproject]]</B>.<BR>
You can find an extract of all accounts listed for your project, and we need your control on each of those.<BR><BR>

Please to check each account and confirm if we have to:<BR>
<UL>
  <LI>Remove the account from your project</LI>
  <LI>Downgrade the license level, from Basic or Visual Studio (license paid) to Stakeholder (free of charge restricted to Work Items) - <a href='https://docs.microsoft.com/en-us/azure/devops/organizations/security/access-levels?view=azure-devops#supported-access-levels'>More details</a></LI>
</UL>
<BR>
Send that reviewed list to this email address '<B>$($DevOpsAdmins)</B>' and the change will be applied.<BR><BR>

---- ACCOUNT INTO YOUR DEVOPS PROJECT: [[yourproject]] ------</P></DIV>"

[string]$EmailPostCoreContent = "<DIV><P>-------------------------------------------------------------<BR><BR>

Thanks for your help.<BR>
Best Regards<BR><BR>

DevOps Administrator</P></DIV>"

# ================== \ Parameters to Adapt / ================== 
#endregion

#region --  Internal Script Settings  ---

$OrganizationList = @()
$ProjectAdministrators =  @()

[string]$PAT = ""
[string]$OrganizationName = ""
[string]$Organization = ""

[string]$SecurityGroupsJSonFilePath = ""
[string]$UserGroupJSonFilePath = ""
[string]$GroupsListJSonFilePath = ""
[string]$AccountValidInAzureAD = ""
$DataRefreshDate = Get-Date -Format "yyyy-MM-dd"
[int]$TotalProjectPerOrganization = 0
[int]$ProjectInProgress = 0

# -- Email configuration ----
[string]$TempEmailAddress = ""
[string]$ProjectOwnerEmailAddresses = ""
[string]$ListToPutInMail = ""
[string]$EmailCoreTitleToUse = ""
[string]$EmailPreCoreContentToUse = ""

[string]$HTMLHeader = @"
<style>
TABLE {border-width: 1px; border-style: solid; border-color: black; border-collapse: collapse;}
TH {border-width: 1px; padding: 3px; border-style: solid; border-color: black; background-color: #FF6600;}
TD {border-width: 1px; padding: 3px; border-style: solid; border-color: black;}
</style>
"@

#endregion

#region --  Each Az DevOps Organization  --

#YourOrganization1
$PAT = $GlobalPATForAllORganizations #https://dev.azure.com/YourOrganization1/_usersSettings/tokens
$OrganizationName = "YourOrganization1"
$OrganizationWithPAT = New-Object PSObject -property @{OrganizationName=$OrganizationName;OrganizationPAT=$PAT}
$OrganizationList += $OrganizationWithPAT

#YourOrganization2
$PAT = $GlobalPATForAllORganizations #https://dev.azure.com/YourOrganization2/_usersSettings/tokens
$OrganizationName = "YourOrganization2"
$OrganizationWithPAT = New-Object PSObject -property @{OrganizationName=$OrganizationName;OrganizationPAT=$PAT}
$OrganizationList += $OrganizationWithPAT

#YourOrganization3
$PAT = $GlobalPATForAllORganizations #https://dev.azure.com/YourOrganization3/_usersSettings/tokens
$OrganizationName = "YourOrganization3"
$OrganizationWithPAT = New-Object PSObject -property @{OrganizationName=$OrganizationName;OrganizationPAT=$PAT}
$OrganizationList += $OrganizationWithPAT

#endregion

foreach($MyOrganization in $OrganizationList)
{
    write-host " --------------------------------------------------------------------" -ForegroundColor White -BackgroundColor DarkYellow
    write-host " -----      Organization :", $MyOrganization.OrganizationName ,"              ------" -ForegroundColor White -BackgroundColor DarkYellow
    write-host " --------------------------------------------------------------------" -ForegroundColor White -BackgroundColor DarkYellow
    $TotalProjectPerOrganization = 0
    $ProjectInProgress = 0
	$Organization = "https://dev.azure.com/$($MyOrganization.OrganizationName)/" 
	$UserGroupJSonFilePath = "$JSonFolderPath\$($MyOrganization.OrganizationName)-UserGroups.json"
	$GroupsListJSonFilePath = "$JSonFolderPath\$($MyOrganization.OrganizationName)-AllProjects-List.json"
	$SecurityGroupsJSonFilePath = "$JSonFolderPath\$($MyOrganization.OrganizationName)-SecurityGroups-List.json"
	echo $($MyOrganization.OrganizationPAT) | az devops login --org $Organization
	az devops configure --defaults organization=$Organization
	#$allProjects = az devops project list --org $Organization --top 1 | ConvertFrom-Json | Select-Object -ExpandProperty value | Sort-Object name #Select 1st project to validate script
	#$allProjects = az devops project list --org $Organization --top 10000 | ConvertFrom-Json | Select-Object -ExpandProperty value | Where-Object name -eq "YourProjectname" | Sort-Object name #Select filtered project
	$allProjects = az devops project list --org $Organization --top 10000 | ConvertFrom-Json | Select-Object -ExpandProperty value | Sort-Object name  #Select all projects
    #$allProjects
	#$allProjects | ConvertTo-Json | Out-File -FilePath $GroupsListJSonFilePath -Encoding UTF8 #If you want to save a copy
    $TotalProjectPerOrganization = $allProjects.Count

    foreach($myProject in $allProjects)
    {
        $ProjectInProgress += 1
        $ProjectAdministrators =  @()
        $EmailPreCoreContentToUse = ""
        $EmailCoreTitleToUse = ""
        $ProjectOwnerEmailAddresses = ""
        $ListToPutInMail = ""
        $UserGroupsPerOrganizationAndProject = @()
        write-host " ---------------------------------------------------------------------------------------------------- " -ForegroundColor Yellow
        write-host " -- Project Name:", $myProject.Name, "[", $ProjectInProgress, " of ", $TotalProjectPerOrganization, "] --" -ForegroundColor Yellow
        #write-host "     > Project Description:", $myProject.Description -ForegroundColor DarkYellow
        write-host " ---------------------------------------------------------------------------------------------------- " -ForegroundColor Yellow
        $ProjectSecurityGroups = az devops security group list --org $Organization --project $myProject.Name  | ConvertFrom-Json
	    #$ProjectSecurityGroups | Out-File -FilePath $SecurityGroupsJSonFilePath #-Encoding UTF8 #If you want to save a copy
        foreach($mySecurityGroup in $ProjectSecurityGroups.graphGroups)
        {
            write-host "     - Security Group Name:", $mySecurityGroup.displayName, "- Descriptor:", $mySecurityGroup.descriptor -ForegroundColor Magenta
            #write-host "       > Security Group Description:", $mySecurityGroup.Description  -ForegroundColor DarkMagenta
            $AllGroupMembers = az devops security group membership list --id $mySecurityGroup.descriptor --org $Organization --relationship members | ConvertFrom-Json
            #write-host " JSON:", $AllGroupMembers
        	#$AllGroupMembers | ConvertTo-Json | Out-File -FilePath $UserGroupJSonFilePath -Encoding UTF8 #If you want to save a copy
       		[array]$groupMembers = ($AllGroupMembers | Get-Member -MemberType NoteProperty).Name

            foreach($MyUserInGroup in $groupMembers)
            {
                if($AllGroupMembers.$MyUserInGroup.mailAddress -ne $null)
                {
                    $AccountValidInAzureAD = ""
                    write-host "          ==> User Name:", $AllGroupMembers.$MyUserInGroup.displayName, "- Email:", $AllGroupMembers.$MyUserInGroup.mailAddress -ForegroundColor Green
		            if($AllGroupMembers.$MyUserInGroup.mailAddress.endswith($DomainNameEmail))
		            {
			            $TempEmailAddress = $AllGroupMembers.$MyUserInGroup.mailAddress -replace "'", "''"
			            $MyAzureADUser = Get-AzureADUser -Filter "userPrincipalName eq '$($TempEmailAddress)'"
			            if($MyAzureADUser)
			            {
				            if($MyAzureADUser.AccountEnabled)
				            {
					            $AccountValidInAzureAD = "ACCOUNT VALID IN AZURE ACTIVE DIRECTORY"
				            }
				            else
				            {
					            $AccountValidInAzureAD = "ACCOUNT DISABLE IN AZURE ACTIVE DIRECTORY"
				            }
			            }
			            else
			            {
				            $AccountValidInAzureAD = "ACCOUNT NOT EXIST IN AZURE ACTIVE DIRECTORY"
			            }
		            }
		            else
		            {
			            $AccountValidInAzureAD = "ACCOUNT NOT INTERNAL EMAIL ADDRESS"
		            }
                    $MyUserDetails = az devops user show --user $AllGroupMembers.$MyUserInGroup.mailAddress --org $Organization | ConvertFrom-Json
                    #write-host " JSON:", $MyUserDetails

			    	$UserGroupsPerOrganizationAndProject += New-Object -TypeName PSObject -Property @{
													UserName=$AllGroupMembers.$MyUserInGroup.displayName
													mailAddress=$AllGroupMembers.$MyUserInGroup.mailAddress
													AccountStatusInAzureAD = $AccountValidInAzureAD
													LicenseType=$MyUserDetails.accessLevel.licenseDisplayName
													dateCreated=$($MyUserDetails.dateCreated).Substring(0, 10)
													lastAccessedDate=$($MyUserDetails.lastAccessedDate).Substring(0, 10)
													ProjectName= $myProject.Name
													GroupName=$mySecurityGroup.displayName
													DataRefreshDate = $DataRefreshDate
													}
                }
            }
        }
        $EmailCoreTitleToUse = $EmailCoreTitle.replace("[[yourproject]]", $myProject.Name)
        $ProjectAdministrators = $UserGroupsPerOrganizationAndProject | where { $_.GroupName -eq "Project Administrators" } | Select mailAddress
        if($ProjectAdministrators.count -gt 0)
        {
            foreach ($myProjectAdminEMail in $ProjectAdministrators)
            {
                if ($myProjectAdminEMail.mailAddress.endswith($DomainNameEmail))
                {
                    $ProjectOwnerEmailAddresses += $myProjectAdminEMail.MailAddress 
                    $ProjectOwnerEmailAddresses += ";"
                }
            }
            if($ProjectOwnerEmailAddresses -eq "")
            {
                $ProjectOwnerEmailAddresses = $DevOpsAdmins
                $EmailCoreTitleToUse = "NO INTERNAL PROJECT ADMIN - " + $EmailCoreTitleToUse
            }
        }
        else
        {
            $ProjectOwnerEmailAddresses = $DevOpsAdmins
            $EmailCoreTitleToUse = "NO PROJECT ADMIN - " + $EmailCoreTitleToUse
        }
        $UserGroupsPerOrganizationAndProject | ConvertTo-Json
        #write-host " JSON:", $UserGroupsPerOrganizationAndProject
        $EmailPreCoreContentToUse = $EmailPreCoreContent.replace("[[yourproject]]", $myProject.Name)
        #$ListToPutInMail = $UserGroupsPerOrganizationAndProject | Format-Table UserName, mailAddress, AccountStatusInAzureAD, LicenseType, GroupName, dateCreated, lastAccessedDate | Out-String
        $ListToPutInMail = $UserGroupsPerOrganizationAndProject | ConvertTo-Html -Property UserName, mailAddress, AccountStatusInAzureAD, LicenseType, GroupName, dateCreated, lastAccessedDate -PreContent $EmailPreCoreContentToUse -PostContent $EmailPostCoreContent -Head $HTMLHeader | Out-String
        #write-host " HTML Table:", $ListToPutInMail

        #write-host " Project Admins:", $ProjectAdministrators
        $ProjectOwnerEmailAddresses = $ProjectOwnerEmailAddresses.Trim()
        if($ProjectOwnerEmailAddresses.EndsWith(";"))
        {
            write-host "    Remove last char from:", $ProjectOwnerEmailAddresses
            $ProjectOwnerEmailAddresses = $ProjectOwnerEmailAddresses.Substring(0, $ProjectOwnerEmailAddresses.Length-1)
            write-host "    Last char removed from:", $ProjectOwnerEmailAddresses
        }
        write-host " Project Admin Emails:", $ProjectOwnerEmailAddresses
        write-host "    *> Email Title:", $EmailCoreTitleToUse
        Send-MailMessage -To $ProjectOwnerEmailAddresses.split(';') -From $DevOpsAdmins -Cc $DevOpsAdmins -Subject $EmailCoreTitleToUse -Body $ListToPutInMail -BodyAsHtml -SmtpServer $SMTPServer
        write-host " ---------------------------------------------------------------------------------------------------- " -ForegroundColor Yellow
    }
    write-host " --------------------------------------------------------------------" -ForegroundColor White -BackgroundColor DarkYellow
}

 

 

You have a restricted list of settings to adapt and run the script.

 

In any case, that part need to be integrated into your FinOps process to optimize your license costs as you really need and use. 

 

Fabrice Romelard

References used to build that script:

3,321 Views
0 Likes
0 Replies
Reply
0 Replies