Mar 18 2017
05:59 PM
- last edited on
Jul 24 2020
02:48 AM
by
TechCommunityAP
Mar 18 2017
05:59 PM
- last edited on
Jul 24 2020
02:48 AM
by
TechCommunityAP
Hi,
There's been a lot of changes with Azure AD B2B and I wanted to see if anyone had already implemented a method to let internal users invite external accounts themselves?
There's both PowerShell and API methods here: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-b2b-api but they're the more of a framework.
There's some code samples here on triggering the invite too https://docs.microsoft.com/en-us/azure/active-directory/active-directory-b2b-code-samples
Has anyone implemented an end user system to let staff do the invites themselves, and give approprtiate permissions?
Also, is there a nice way to clean up externally invited accounts that haven't been used for a certain period?
Finally, is there any security risk in having an external user invited, but with no extra settings configured?
Thanks
Adam
Mar 19 2017 08:45 PM
I've been testing some of this in PowerShell using the Azure AD Preview module.
Inviting a user is easy enough:
New-AzureADMSInvitation -InvitedUserEmailAddress someexternaluser@externaldomain.com -SendInvitationMessage $True -InviteRedirectUrl "http://myapps.microsoft.com"
But adding that user to a group for them to access something I'm finding much tricker to automate.
First you'd have to find the group and then get the Object ID. But you also need to Object ID of the user you just invited.
Getting the Object ID of the user is tricky because the invite itself generates an ID in the ID field, but that's not the Object ID. That's hidden in the InvitedUser field, which contains other data too.
Getting the user via email address doesn't work, so this was the quickest way I could work it out:
$group = get-azureadgroup -SearchString "Sharepoint Online Testsite" | where {$_.dirsyncenabled -eq $null}
$newuser = New-AzureADMSInvitation -InvitedUserEmailAddress testy@contoso.com -InvitedUserDisplayName "Full Name" -sendinvitationmessage $true -InviteRedirectUrl "http://myapps.microsoft.com"
$newuser2 = get-azureaduser -SearchString $newuser.InvitedUserEmailAddress
Add-AzureADGroupMember -objectid $group.objectid -RefObjectId $newuser2.objectid
Mar 22 2017 10:31 PM
I've now found out that script won't work for inviting people who are using a public email account such as gmail or hotmail, as it parses the email address differently.
Thankfully I can cut out a step and just use an object from inside an object inside an object 🙂
$group = get-azureadgroup -SearchString "Sharepoint Online Testsite" | where {$_.dirsyncenabled -eq $null}
$newuser = New-AzureADMSInvitation -InvitedUserEmailAddress testy@contoso.com -InvitedUserDisplayName "Full Name" -sendinvitationmessage $true -InviteRedirectUrl "http://myapps.microsoft.com"
Add-AzureADGroupMember -objectid $group.objectid -RefObjectId $newuser.InvitedUser.Id
Jun 05 2020 12:03 PM