Entra ID Application setup for External Authentication using Powershell

Modified on Wed, 5 Feb at 11:51 AM

Summary

During the configuration of OfficePlace, we need to create an application registration in Entra ID to secure the login to OfficePlace and only allow single sign-on.

The sections below explains the process of setting up the app with Powershell, and it is important that the script snippets are used in the same powershell session to ensure that variables and variable values are carried over from one section to the next.

Note: Making use of this script requires prior knowledge about Powershell, and it is your responsibility to understand the script before using it. Add-On Products do not take any responsibility for the consequences of improper use.

Prepare powershell environment.

This guide explains the process of setting up the Entra ID application and associated RBAC in Exchange Online using Powershell, and hence it is important that certain modules are available on your machine.

In order to complete this task you will need the following components:

Powershell 7
ExchangeOnlineManagement module
Microsoft.graph module

Complete script is attached as zip.

Below scriptblock checks for installed modules and installs them if they are not present on your machine.

#Install required modules if missing
if(-not (Get-InstalledModule Microsoft.Graph.Authentication)){
  Install-Module Microsoft.Graph.Authentication -Scope CurrentUser -Force
  }

if(-not (Get-InstalledModule Microsoft.Graph.Applications)){
  Install-Module Microsoft.Graph.Applications -Scope CurrentUser -Force
  }

if(-not (Get-InstalledModule Microsoft.Graph.Identity.DirectoryManagement)){
  Install-Module Microsoft.Graph.Identity.DirectoryManagement -Scope CurrentUser -Force
  }

if(-not (Get-InstalledModule Microsoft.Graph.Identity.signins)){
    Install-Module Microsoft.Graph.Identity.signins -Scope CurrentUser -Force
    }

#Import Module
Import-Module Microsoft.Graph.Authentication
Import-Module Microsoft.Graph.Applications
Import-Module Microsoft.Graph.Identity.DirectoryManagement
Import-Module Microsoft.Graph.Identity.signins

Define script variables

Before creating the Entra ID app you must define a set of variables.

AppName - Define the name of the Entra ID app
ReplyUrl - This value can be found under your Organization in OfficePlace under the section Application. See below image.

$AppName =  "OfficePlace SSO"
$ReplyUrl = "https://login.officeplace.global/<GUID>/AccountTenant/ExternalLoginCallback"

Reply Url In OfficePlace

Create Entra ID application

Now it is time to create the Entra ID application according to the variables above.

The script below will create the application, but will exit in case an application with the same name already exists and leave it to you to manually delete that existing application or choose a different name for this new application.

The values of the application will be stored in a text file in Downloads folder and notepad will open presenting the values.

###############################################################################
#Connect to your tenant with Graph and required scopes
###############################################################################
Connect-MgGraph -Scopes "Application.Read.All","Application.ReadWrite.All","User.Read.All","Domain.Read.All"
Get-MgContext
Write-Host "Tenant Name: " (Get-MgDomain | Where-object {$_.IsInitial -eq $true}).id

###############################################################################
#Create AAD Application
###############################################################################
$ExistingApp = Get-MgApplication -Filter "startswith(displayName,'$AppName')"
If ($ExistingApp){
	Write-Warning -Message "Applicaiton already exist - Exiting script"
	Write-Warning -Message "Please delete application $($ExistingApp.AppId) before you proceed with this script"
    break
}Else{
	$App = New-MgApplication -DisplayName $AppName 
}
$APPObjectID = $App.Id

###############################################################################
#Add Current user as Owner
###############################################################################
$User = get-mguser -UserId (Get-MgContext).Account 
$ObjectId = $User.ID
$NewOwner = @{
	"@odata.id"= "https://graph.microsoft.com/v1.0/directoryObjects/{$ObjectId}"
	}
New-MgApplicationOwnerByRef -ApplicationId $APPObjectID -BodyParameter $NewOwner

###############################################################################
#Redirect URI
###############################################################################
#Redirect URI for singlepage
$RedirectURI = @()
$RedirectURI += $ReplyUrl
$params = @{
	RedirectUris = @($RedirectURI)
}

$Web = @{
    implicitGrantSettings = @{
        enableIdTokenIssuance = $true
        enableAccessTokenIssuance = $false
    }
}
Update-MgApplication -ApplicationId $APPObjectID -Spa $params -Web $Web

###############################################################################
#Add App Permissions
###############################################################################

#Add api Permissions
# User.Read				Delegated	e1fe6dd8-ba31-4d61-89e7-88639da4683d

$requiredGrants = New-Object -TypeName System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphRequiredResourceAccess]
$requiredResourceAccess = New-Object -TypeName Microsoft.Graph.PowerShell.Models.MicrosoftGraphRequiredResourceAccess
$requiredResourceAccess.ResourceAppId = "00000003-0000-0000-c000-000000000000"
$requiredResourceAccess.ResourceAccess+=@{ Id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"; Type = "Scope" }
$requiredGrants.Add($requiredResourceAccess)

Update-MgApplication -ApplicationId $APPObjectID -RequiredResourceAccess $requiredGrants

###############################################################################
#Create Service Principal if it does not exist.
###############################################################################

$Principal = Get-MgServicePrincipal -Filter "appId eq '$($App.appId)'"
if (-not $Principal) {
	Write-Host "Creating client app's service principal"
	$Principal = New-MgServicePrincipal -AppId $App.appId -Description $App.DisplayName
}
Write-Host "Client: '$($Principal.displayName)' (appId: $($Principal.appId))"

###############################################################################
#Grant Admin Consent 
###############################################################################
$Resource = Get-MgServicePrincipal -Filter "displayName eq 'Microsoft Graph'"

# Grant consent for delegated Graph permission User.Read
$params = @{

	"ClientId" = $Principal.Id
	"ConsentType" = "AllPrincipals"
	"ResourceId" = $Resource.id
	"Scope" = "User.Read"
	}

New-MgOauth2PermissionGrant -BodyParameter $params | Format-List Id, ClientId, ConsentType, ResourceId, Scope

###############################################################################
#App details to be used
###############################################################################

$ResultFile = "" + (New-Object -ComObject Shell.Application).Namespace('shell:Downloads').Self.Path + "\" + $AppName + ".txt"
$resultset=@"
Tenent ID: $((Get-MgOrganization).Id)
Tenant Name: $((Get-MgDomain | Where-object {$_.IsInitial -eq $true}).id)
Client ID: $($app.AppID)
"@

$resultset | out-file -FilePath $ResultFile 
Invoke-Item $ResultFile

Implement application settings in OfficePlace

Once the app described above has been created, you must collect this information for configuration in OfficePlace.

The powershell script above has created a text file in your download folder with the same name you gave the Entra ID application, and within you can find the details matching the configuration dialog in OfficePlace as seen in the screenshot below.

Properties

Applies to: OfficePlace
Knowledge base ID: 0338
Last updated: Jan 09 2025