Merill Fernando Profile picture
Jan 31, 2023 20 tweets 10 min read Read on X
Do you work with Microsoft Graph, Graph Explorer and Graph PowerShell?

I shared some of my productivity tips at the last Microsoft Identity Platform Community Call. The recording is on YouTube.

Read on below for a quick summary 🧵👇🏾
Tip #1: Get your own free M365 tenant!
✅ Includes 25 E5 licenses
✅ Fully loaded sample data
✅ Tenant automatically renews every 90 days

These tenants never expire. My oldest tenant was created more than 5 years ago.

developer.microsoft.com/en-us/microsof… Screenshot of M365 Developer Program
Tip #2: Remember these shortcuts to quickly get to Graph Explorer

🚀 aka.ms/ge
🚀 ge.cmd.ms

PS: If you like shortcuts check out cmd.ms

Try the cmd.ms browser extension for auto-complete support. Screenshot of cmd.ms home page
Tip #3: Use the Samples tab in Graph Explorer to get started on some of the most used Graph API.

Remember you can use the POST and PATCH operations to make updates from right within Graph Explorer.
Tip #4: The History tab saves all API calls, request body + results from the last 30 days!

Use the search box to quickly find an API call that you made and re-run your queries.
Tip #5: The 'Modify permissions' tab shows the required permission scopes for every API call.

Type in your API to find out the required permissions. You can also consent/unconsent directly from here.

Bonus: Use the 'Consent to permissions' option under Profile for global search
Tip #6: Use the Graph Explorer's access token

This is great for troubleshooting permission issues with your own app. Simply copy the access token and re-use it in your code, PowerShell script etc.

Skip needing to perform MFA, device checks, etc for every run.
Tip #7: Use the 'Code snippets' tab to generate the C#, JavaScript, PowerShell versions of the API call

Super useful for POST and PATCH commands.

The PowerShell scripts include ConsistencyLevel and CountVariable params for advanced filter queries.
Tip #8: Get to the Graph API method's reference doc with a single click!

I stumbled across this one quite recently.

It's a delight to not have to waste time searching on Google to get to the right reference page. Screenshot showing how to link to open to the Graph API docs
Here is a demo of the quick link from API → Doc
Tip #9: Use the Graph X-Ray browser extension to convert your portal actions to PowerShell (C#/Javascript...)

Get it from graphxray.merill.net
Tip #10: Remember this shortcut to get to the Graph API Reference Docs

aka.ms/graphref Screenshot of Graph API reference page
Tip #11: The 'Properties' section in the docs is SUPER useful!

You need to scroll down a bit for this and it is worth it.

Every resource in Graph API docs has a Properties section. It's a must read when you need to create a new object, run filters, etc. Screenshot of reference docs in Properties with arrows showi
Tip #12: Graph Filter Doc 👉 aka.ms/graphfilter

We frequently need to query data through Graph and this shortcut will get you to handy the doc that lists all the supported operators with heaps of examples. Screenshot of the Graph Filter docs page
Tip #13: Filter Operators doc

This is a follow on tip from #12.

If you browse to aka.ms/graphfilter and select 'Advanced query capabilities' you get a neat page that summarises all the supported operators for common directory objects like Users, Devices, Applications, etc. Screenshot of Graph Filter doc with summary of supported ope
Tip #14: Graph Permission Explorer 👉 graphpermissions.merill.net

The Graph docs do an excellent job of listing the permissions required to call a given API.

Sometimes you need to find out all the APIs that can be used with a given permission. I built Permission Explorer for this. Screenshot of Graph Permission Explorer.
Tip #15: Convert Azure AD PowerShell commands to Graph PowerShell 👉 graphpowershell.merill.net

Azure AD PowerShell and MSOnline PowerShell are being deprecated in June 23. Use the Graph PowerShell Conversion Analyzer to help upgrade your scripts to use Graph PowerShell cmdlets. Screenshot of Graph PowerShell Conversion Analyzer
Tip #15: Graph PowerShell Cmdlet Permission

So, you know the cmdlet you need to run but can't figure out the Graph Permission scope to use with Connect-MgGraph.

Find-MgGraphCommand -Command to the rescue!

You can also use the -Uri parameter if you know the API but not the cmd. Screenshot of Find-MgGraphCommand showing permission scopes
Liked this thread?

Please re-tweet to share with folks you know + feel free to follow. I try to share at least one tip a week on topics related to Graph, Graph PowerShell, Azure AD and Entra.

I have heaps in my backlog since I was away in December and just getting started!
Thanks @Nandeesh_Swami for having me on the Identity Community Call!

Check out the past videos that deep dive into Microsoft Identity dev topics like MSAL, AAD Extensions, Permissions, etcc.

youtube.com/playlist?list=… Screenshot of Identity platform community calls.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Merill Fernando

Merill Fernando Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @merill

Mar 4
This doesn't happen everyday folks!!

Entra ID application management policies no longer require a Workload ID Premium license! 👏🎁🍾🥳🎊

This change happened back in October last year and I somehow missed it.

Here's a complete walkthrough 🧵👇

✳️ Bookmark this. App Management Policies are now in the  Entra ID FREE Tier!!  So what are app management policies?  How can they be used to secure your tenant?
Threat actors love apps.

They can find long lived app secrets in text files on servers, code repos and even email archives. Why do we need app management policies?  Unlike user passwords, apps can have more than one credential Even worse → Devs (and threat actors) can set very long expiry dates
You might fall into a false sense of security, since the admin portal only allows a max 2 year expiry for secret.

Devs (like me) are lazy and we use the API to create long lived secrets to make life easier for us 😎 🤯 While Entra ID prevents setting long lived expiry in the admin portal  You can use APIs to create credentials with long expiry
Read 14 tweets
Sep 24, 2024
Microsoft just published their SFI progress report. Here's the TLDR; version.

There is a lot that CISOs, M365/Entra admins and cybersecurity teams can learn from what Microsoft is doing and apply to their own organizations.

🧵👇 Image
How far along is your org in this journey? Image
Managing the number of tenants (including dev tenants) and securing ALL of them is becoming important Image
Read 6 tweets
Feb 28, 2024
The ability to block Device Code Flow just became available in Microsoft Entra ID Conditional Access.

Here's a quick walkthrough of how attackers use device code flow to get access to your tenant and what you can do to protect yourself. Attn M365 admins & security teams Create this CA policy NOW and  protect your users from Device Code Flow  phishing & social engineering attacks!
❇️ Why does device code flow exist?

Device code flow is required when signing into devices that might lack local input for eg meeting room devices or scenarios like shared devices.

Unfortunately, attackers frequently use this mechanism to target your users. The new Conditional Access feature Authentication Flows, lets you target Device Code Flow +  Authentication Transfer and  BLOCK them from your tenant
🪟 Microsoft's recommendation

Microsoft's recommendation is to block device code flow wherever possible and only allow device code flow where necessary.

Learn more




→ How-to article: learn.microsoft.com/entra/identity…
learn.microsoft.com/entra/identity…
learn.microsoft.com/entra/identity…
Here’s how the new CA policy works to block Device Code Flow and protect your users!  Illustration showing how the block access policy will prevent user from signing in
Read 5 tweets
Feb 8, 2024
So your Microsoft 365 tenant has been compromised by a malicious app!

Here's a step by step guide to block access to the app and remove it from your tenant -Bkmk this!

1️⃣ Go to Microsoft Entra → Enterprise Apps
2️⃣ Select the compromised app
3️⃣ Permissions → Review Permissions Image
Select 'This app is malicious and I'm compromised' Image
Follow the recommendations to
✅ Disable the app

Then run the PowerShell scripts that is generated to
✅ Require user assignment
✅ Revoke all permissions
✅ Invalidate refresh tokens of users with access to the app Image
Read 4 tweets
Oct 24, 2023
Windows LAPS just went GA today!

Here's a refresher and quick walkthrough on what it is and how you can start using it.

🧵⬇️ What is  Windows LAPS with Microsoft Entra ID  and why is everyone  so excited  about today's  GA announcement?
2/8  Local Administrator Password Solution   Every Windows device comes with a built-in local administrator account that you must secure and protect to mitigate any Pass-the-Hash (PtH) and lateral traversal attacks.   LAPS is a Windows feature that automatically manages and backs up the password of the  local admin account.
3/8 Windows LAPS is available for both Entra joined and  hybrid Entra joined devices!  Windows LAPS is now built-in into Windows!    🎯 Windows 10 20H2 and later  🎯 Windows 11 21H2 and later  🎯 Windows Server 2019 and later
Read 9 tweets
Oct 23, 2023
What are HAR files?
A HAR file is a recording of your current session & includes all web traffic including secrets & tokens.

Admins usually share these files with customer support when troubleshooting issues.

Here's a thread on how you can handle .har files safely.

🧵⬇️
Exporting HAR files
There are a few ways to record your session to create HAR files. You might need to use different tools depending on what you are recording.

→ Browser
Every modern browser lets you export an HAR file of the current tab's session from the Network tab. Export HAR file from browser session
→ Desktop
Sometimes you might need to troubleshoot a non-browser-based app, for example a desktop app like Outlook or a CLI or PowerShell script.

Your admins are usually asked to use an app like Fiddler that adds a system proxy to capture all the web traffic on the desktop. Screenshot of exporting HAR using Fiddler for desktop apps
Read 18 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(