Merill Fernando Profile picture
Jan 31 20 tweets 10 min read
Do you work with Microsoft Graph, Graph Explorer and Graph PowerShell?

I shared some of my productivity tips at the last Microsoft Identity Platform Community Call. The recording is on YouTube.

Read on below for a quick summary 🧵👇🏾
Tip #1: Get your own free M365 tenant!
✅ Includes 25 E5 licenses
✅ Fully loaded sample data
✅ Tenant automatically renews every 90 days

These tenants never expire. My oldest tenant was created more than 5 years ago.

developer.microsoft.com/en-us/microsof… Screenshot of M365 Developer Program
Tip #2: Remember these shortcuts to quickly get to Graph Explorer

🚀 aka.ms/ge
🚀 ge.cmd.ms

PS: If you like shortcuts check out cmd.ms

Try the cmd.ms browser extension for auto-complete support. Screenshot of cmd.ms home page
Tip #3: Use the Samples tab in Graph Explorer to get started on some of the most used Graph API.

Remember you can use the POST and PATCH operations to make updates from right within Graph Explorer.
Tip #4: The History tab saves all API calls, request body + results from the last 30 days!

Use the search box to quickly find an API call that you made and re-run your queries.
Tip #5: The 'Modify permissions' tab shows the required permission scopes for every API call.

Type in your API to find out the required permissions. You can also consent/unconsent directly from here.

Bonus: Use the 'Consent to permissions' option under Profile for global search
Tip #6: Use the Graph Explorer's access token

This is great for troubleshooting permission issues with your own app. Simply copy the access token and re-use it in your code, PowerShell script etc.

Skip needing to perform MFA, device checks, etc for every run.
Tip #7: Use the 'Code snippets' tab to generate the C#, JavaScript, PowerShell versions of the API call

Super useful for POST and PATCH commands.

The PowerShell scripts include ConsistencyLevel and CountVariable params for advanced filter queries.
Tip #8: Get to the Graph API method's reference doc with a single click!

I stumbled across this one quite recently.

It's a delight to not have to waste time searching on Google to get to the right reference page. Screenshot showing how to link to open to the Graph API docs
Here is a demo of the quick link from API → Doc
Tip #9: Use the Graph X-Ray browser extension to convert your portal actions to PowerShell (C#/Javascript...)

Get it from graphxray.merill.net
Tip #10: Remember this shortcut to get to the Graph API Reference Docs

aka.ms/graphref Screenshot of Graph API reference page
Tip #11: The 'Properties' section in the docs is SUPER useful!

You need to scroll down a bit for this and it is worth it.

Every resource in Graph API docs has a Properties section. It's a must read when you need to create a new object, run filters, etc. Screenshot of reference docs in Properties with arrows showi
Tip #12: Graph Filter Doc 👉 aka.ms/graphfilter

We frequently need to query data through Graph and this shortcut will get you to handy the doc that lists all the supported operators with heaps of examples. Screenshot of the Graph Filter docs page
Tip #13: Filter Operators doc

This is a follow on tip from #12.

If you browse to aka.ms/graphfilter and select 'Advanced query capabilities' you get a neat page that summarises all the supported operators for common directory objects like Users, Devices, Applications, etc. Screenshot of Graph Filter doc with summary of supported ope
Tip #14: Graph Permission Explorer 👉 graphpermissions.merill.net

The Graph docs do an excellent job of listing the permissions required to call a given API.

Sometimes you need to find out all the APIs that can be used with a given permission. I built Permission Explorer for this. Screenshot of Graph Permission Explorer.
Tip #15: Convert Azure AD PowerShell commands to Graph PowerShell 👉 graphpowershell.merill.net

Azure AD PowerShell and MSOnline PowerShell are being deprecated in June 23. Use the Graph PowerShell Conversion Analyzer to help upgrade your scripts to use Graph PowerShell cmdlets. Screenshot of Graph PowerShell Conversion Analyzer
Tip #15: Graph PowerShell Cmdlet Permission

So, you know the cmdlet you need to run but can't figure out the Graph Permission scope to use with Connect-MgGraph.

Find-MgGraphCommand -Command to the rescue!

You can also use the -Uri parameter if you know the API but not the cmd. Screenshot of Find-MgGraphCommand showing permission scopes
Liked this thread?

Please re-tweet to share with folks you know + feel free to follow. I try to share at least one tip a week on topics related to Graph, Graph PowerShell, Azure AD and Entra.

I have heaps in my backlog since I was away in December and just getting started!
Thanks @Nandeesh_Swami for having me on the Identity Community Call!

Check out the past videos that deep dive into Microsoft Identity dev topics like MSAL, AAD Extensions, Permissions, etcc.

youtube.com/playlist?list=… Screenshot of Identity platform community calls.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Merill Fernando

Merill Fernando Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @merill

Nov 14, 2022
Why is everyone so excited about the new #azuread Authentication Strength feature in Conditional Access that was announced at Ignite last month?

Here's are short thread about the feature.

PS. There is a bonus if you read all the way to the end 😉👇 Screenshot from the Authent...
This illustration from @Yubico shows that not all MFA is of equal strength when protecting your users. Some like Phone number and email are very weak compared to others.

I shared more about this in a previous thread Illustration showing the ri...
Moving away from Voice and SMS is in fact called out by NIST who classify PSTN based auth like SMS and Voice as RESTRICTED.

They explain in more detail in this FAQ.
pages.nist.gov/800-63-FAQ/#q-… 5.1.3.3 Authentication usin...
Read 10 tweets
Oct 31, 2022
Why is MFA over SMS/Voice not considered safe vs other MFA methods like TOTP & Authenticator apps?

I'll break down a blog post by Microsoft's VP of Identity Security @Alex_T_Weinert on why he considers SMS to be the least secure of MFA methods.

👇
Not all MFA authentication methods are equal. Some are stronger than others.

SMS and voice based MFA mechanisms are based on publicly switched telephone networks (PSTN).

💡Before we begin a quick reminder that any MFA is better than no MFA.
#1 Every mechanism to exploit a credential can be used on SMS/Voice!

🎣 Phish? ✅️
💬 Social? ✅️
👤 Account takeover? ✅️
🤳 Device theft? ✅️

SMS/Voice has all the vulnerabilities of every other authenticator and a host of other issues specific to SMS/Voice.
Read 14 tweets
Oct 26, 2022
Are you tired of clicking around in Microsoft portals to get to a blade?

Introducing cmd.ms your Microsoft cloud command line for the browser!

Use the power of your keyboard and your memory to get to your favourite Microsoft portal or blade in seconds. Screenshot of cmd.ms
Try it out. Open a new tab and type {command}.cmd.ms using any of the available commands (see the full list at cmd.ms)

For those who like autocomplete from the address bar you can get the browser extensions from cmd.ms/docs/tips
The best part is that you can contribute your own commands to this open-source project by simply adding a line at github.com/merill/cmd/blo…
Read 6 tweets
Oct 26, 2022
Public Preview: Conditional Access filters for apps ift.tt/Hk3WQaY
This is an exciting feature! You no longer need to keep updating your CA policy to add new apps.

Instead you can tag each app. e.g.

Sensitivity = Business Critical / Medium / Low

Then create a CA policy for each sensitivity level (eg. Business Critical = Require security key)
Have questions about the new CA filter for apps feature and want to learn more?

Click Set Reminder below and join us live with @Caleb_B in a couple of hours as we dig deeper into this.

@markmorow @BaileyBercik @JefTek
Read 5 tweets
Oct 25, 2022
Advanced Microsoft Authenticator security features are now generally available! techcommunity.microsoft.com/t5/microsoft-e…
If your org was prevented from enabling public preview features, that goes away today.

Number matching is GA today! Number matching
Go to Authentication Methods, select Authenticator app and turn on 'Number Matching' today!!

Protect your users from MFA fatigue. Number matching config
Read 6 tweets
Oct 24, 2022
Did you know that CA policies now provide granular control over the types of external users you want to apply the policy to?

External users are categorized based on how they authenticate (internally or externally) and their relationship to your org (guest or member). CA policy blade with new se...
The 'B2B direct connect' checkbox now let's you target Teams Connect shared channel users even though these users don't exist in your tenant.

To learn more about what each checkbox means see learn.microsoft.com/en-us/azure/ac…
You can now also target specific orgs without having to resort to hacky solutions like creating dynamic groups based on the domain of the user's UPN

A word of warning, keep in mind that you can only create 195 policies in a tenant so don't go crazy with a policy for each org 🙂 CA blade with ability to se...Image
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(