• State Not Answered
  • Replies 3 replies
  • Subscribers 66 subscribers
  • Views 170 views
  • Users 0 members are here
Options
Related

Configure TAP workflow

jraines

We would like to empower certain members of our Service Desk to issue TAP (Temporary Access Passwords) via Active Roles instead of granting Azure PIM roles.   I can find the powershell scripts that will do it, but they require MS Graph credentials.   Is there a way to do this in Active Roles to leverage the Graph credentials that AR already possesses without embedding them in plain text in the script? 

  • 0

    Yes. I have done everything you asked for using Active Roles and PowerShell scripting designed in way that does not store any sensitive information in the scripts. My solution can work through automated workflows during provisioning as well as interactively in the web portal as part of a manually initiated support function. It can set, examine, display and clear tap codes.

  • 0 in reply to Robert Sandri

    Awesome :-)  Can you share how to set it up?

  • 0

    The credentials part can be dealt with by:

    1) Setting up a Service Principal in your tenant that has the appropriate Graph rights assigned to allow the actions you need.

    2) Associating a certificate with that Service Principal and installing that cert on your Active Roles Admin service host.

    3) Then, at the top of your script, you would have a command line like this:

    Connect-MgGraph -ErrorAction Stop -ClientID <the GUID of the service principal> -TenantId <your tenant GUID> -CertificateThumbprint <the thumbprint of the cert you registered on the Service Principal and installed on your AR host>