Introducing the Entra Helpdesk Portal: A Zero-Trust, Dockerized ITSM Interface for Tier 1 Support
Hello everyone, If you manage identity in Microsoft Entra ID at an enterprise scale, you know the struggle: delegating day-to-day operational tasks (like password resets, session revocations, and MFA management) to Tier 1 and Tier 2 support staff is inherently risky. The native Azure/Entra portal is incredibly powerful, but it’s complex and lacks mandatory ITSM enforcement. Giving a helpdesk technician the "Helpdesk Administrator" role grants them access to a portal where a single misclick can cause a major headache. To solve this, I’ve developed the Entra Helpdesk Portal (Community Edition)—an open-source, containerized application designed to act as an isolated "airlock" between your support team and your Entra ID tenant. Why This Adds Value to Your Tenant Instead of having technicians log into the Azure portal, they log into this clean, Material Design web interface. It leverages a backend Service Principal (using MSAL and the Graph API) to execute commands on their behalf. Strict Zero Trust: Logging in via Microsoft SSO isn’t enough. The app intercepts the token and checks the user’s UPN against a hardcoded ALLOWED_ADMINS whitelist in your Docker environment file. Mandatory ITSM Ticketing: You cannot enforce ticketing in the native Azure Portal. In this app, every write action prompts a modal requiring a valid ticket number (e.g., INC-123456). Local Audit Logging: All actions, along with the actor, timestamp, and ticket number, are written to an immutable local SQLite database (audit.db) inside the container volume. Performance: Heavy Graph API reads are cached in-memory with a Time-To-Live (TTL) and smart invalidation. Searching for users or loading Enterprise Apps takes milliseconds. What Can It Do? Identity Lifecycle: Create users, auto-generate secure 16-character passwords, revoke sign-in sessions, reset passwords, and delete specific MFA methods to force re-registration. Diagnostics: View a user's last 5 sign-in logs, translating Microsoft error codes into plain English. Group Management: Add/remove members to Security and M365 groups. App/SPN Management: Lazy-load raw requiredResourceAccess Graph API payloads to audit app permissions, and instantly rotate client secrets. Universal Restore: Paste the Object ID of any soft-deleted item into the Recycle Bin tab to instantly resurrect it. How Easy Is It to Setup? I wanted this to be universally deployable, so I compiled it as a multi-architecture Docker image (linux/amd64 and linux/arm64). It will run on a massive Windows Server or a simple Raspberry Pi. Setup takes less than 5 minutes: Create an App Registration in Entra ID and grant it the necessary Graph API Application Permissions (e.g., User.ReadWrite.All, AuditLog.Read.All). Create a docker-compose.yml file. Define your feature toggles. You can literally turn off features (like User Deletion) by setting an environment variable to false. version: '3.8' services: helpdesk-portal: image: jahmed22/entra-helpdesk:latest container_name: entra_helpdesk restart: unless-stopped ports: - "8000:8000" environment: # CORE IDENTITY - TENANT_ID=your_tenant_id_here - CLIENT_ID=your_client_id_here - CLIENT_SECRET=your_client_secret_here - BASE_URL=https://entradesk.jahmed.cloud - ALLOWED_ADMINS=email address removed for privacy reasons # CUSTOMIZATION & FEATURE FLAGS - APP_NAME=Entra Help Desk - ENABLE_PASSWORD_RESET=true - ENABLE_MFA_MANAGEMENT=true - ENABLE_USER_DELETION=false - ENABLE_GROUP_MANAGEMENT=true - ENABLE_APP_MANAGEMENT=true volumes: - entra_helpdesk_data:/app/static/uploads - entra_helpdesk_db:/app volumes: entra_helpdesk_data: entra_helpdesk_db: 4.Run docker compose up -d and you are done! I built this to give back to the community and help secure our Tier 1 operations. If you are interested in testing it out in your dev tenants or want to see the full architecture breakdown, you can read the complete documentation on my website here I’d love to hear your thoughts, feedback, or any feature requests you might have!windwosBright Mode Software Properties Interface Font is Completely White
After enabling the light mode on the system, all fonts in the property dialog boxes/settings interfaces of all software are displayed in white (the light background makes it difficult to read the text), which severely affects normal use. I need a fix or a temporary workaround. Thank you for your response.
Windows Hardware Errors
Hello, This is my third attempt at posting. The prior two times, my post has vanished with no emails or notifications of any kind, just gone. Hope someone besides a bot will read this. I have been getting several 'windows hardware errors' showing up in the 'reliability history' tool on Windows 11. I'd post the information about them, but maybe that is why my post is being removed? Is there someone willing to help troubleshoot? Thanks
How to resolve automatic repair loop on windows 11?
My windows 11 pc is running into a frustrating issue after installing a feature update. It suddenly got stuck in an automatic repair loop. It boots up, shows Preparing automatic repair, then goes to the blue screen saying "Automatic Repair couldn’t repair your PC," with options restart and advanced options. If I click Restart, it just loops back to the same screen. If I go into Advanced options, I’ve tried a few things already, but nothing has worked so far. How to resolve Windows 11 automatic repair loop? Has anyone successfully exit this automatic repair loop on windows 11? Any specific command prompt tricks, registry edits, or other less-known fixes I could try?
Feature Request: Allow Custom User Profile Folder Name during Microsoft Account OOBE Setup
Currently, when setting up Windows 11 using a mandatory Microsoft Account (MSA), the operating system automatically generates a truncated 5-character folder name in "C:\Users" based on the first five letters of the user's email address. For professionals using high-end workstations, this behaviour is problematic for several reasons: Professionalism: Truncated names like "siddh" instead of "Siddharth Shankar" look unprofessional in file paths and environment variables. Scripting and Development: Many automated scripts and terminal-based workflows rely on consistent, predictable naming conventions that align with the user's actual identity. Accessibility: Users should have agency over their local directory structure without needing to resort to OOBE\BYPASSNRO hacks or post-install Registry edits, which can be risky and time-consuming. Request: Please provide an "Advanced" or "Edit" option during the "Who is going to use this PC?" screen that allows users to manually define their local folder name while still signing in with their Microsoft Account. This change would align Windows 11 with modern UX standards of personalization and user control.Why lunar client won't uninstall on my windows 11 pc?
Running into a weird situation here. I tried removing Lunar Client from my Windows 11 PC like any normal app, but the lunar client won't uninstall. The uninstall option either does nothing or fails partway, and the app still shows up afterward. Feels like something is blocking the removal. Maybe background services or leftover files but not sure where to even start checking. Don’t want to mess around too much and break something else. Has anyone dealt with this before? What's the best way to completely uninstall lunar client on windows 11?
