Source

https://cyporgau.sharepoint.com/sites/ICT_Documents/Shared%20Documents/11.%20Projects/AD%20and%20Azure%20Accounts%20-%2045%20day%20login%20expired


Setup

Select a server in the local domain.


  1. Create new destination folder such as 'C:\DATA\PowershellScripts\AD and Azure Accounts - 45 day login expired'
  2. Ensure to delete the inherited permissions from the C:\DATA folder. 
  3. Copy the '45 Day deactivation.ps1' file from source to destination folder. Add suffix to the name eg " - BAMA".
  4. Open powershell (as admin) and CD to the new destination folder in step 1. 
  5. If module isn't installed
    > Install-Module microsoft.graph
> Get-WindowsFeature -Name RSAT-AD-PowerShell | Install-WindowsFeature
  6. Create self signed certificate on server 
    > $certName = "GraphAutomationCert-BAMA"
> $cert = New-SelfSignedCertificate -Subject "CN=$certName" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256
> $cert.thumbprint
  7. Export the certificate (without private key) to a file. 
    > $cert | export-certificate -Type CERT -FilePath "$certName.cer"
  8. Log into Entra for the appropriate tenant.
  9. App registrations > All applications.  Check for app called 'GraphAutomationCertificateAuth'. If exists figure out what's using this app and if you can reuse, otherwise create new but you'll need to change the name of the new app to something else. 
  10. New registration
  11. Name: GraphAutomationCertificateAuth
    Select: Accounts in this organizational directory only
    Click Register
  12. API permissions > Add a permission > Microsoft Graph > Application permissions
    AuditLog.Read.All
    Directory.Read.All
    User.ReadWrite.All
  13. Delete User.Read permissions. 
  14. Grant admin consent for Bama Services > Yes
  15. Certificates & secrets > Certificates > Upload certificate
    Description: Automation on [insert SERVERNAME]
  16. Overview. This will display the application and tenant IDs
  17. Update the script parameters :
    $TenantId = "enter the tenant id shown in step 16"
    $ClientId = "enter the client id shown in step 16"
    $CertificateThumbprint = "enter thumbprint as shown in step 6"
  18. Test script using whatifmode param:
    > & '.\45 Day deactivation.ps1' -WhatIfMode
  19. Update the IgnoreList.csv file. Put on-prem SAM accounts in the first column; Put 365 UPNs into second column.
    Column row needs to be:
    OnPremSamAccountName,CloudUPN
    eg 
    OnPremSamAccountName,CloudUPN
testaccount
,testupn@bama.net.au

  20. Always test changes using -whatifmode
  21. Use Task Scheduler to schedule the script to run daily.
    If the TS folder doesn't exist create "Powershell Tasks" folder.
    Start a Program: %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe
    Arguments: -NoLogo -ExecutionPolicy Bypass -file "C:\DATA\PowershellScripts\AD and Azure Accounts - 45 day login expired\45 Day deactivation - CYP.ps1"
    Start in: C:\DATA\PowershellScripts\AD and Azure Accounts - 45 day login expired

Currently configured on:


SVRBAMA09 - BAMA Domain

SVRCYH02 - CYH/Ngak Min Domain 

SVRCYP09 - CYP Domain