• State Not Answered
  • Replies 3 replies
  • Subscribers 66 subscribers
  • Views 169 views
  • Users 0 members are here
Options
Related

Configure TAP workflow

jraines

We would like to empower certain members of our Service Desk to issue TAP (Temporary Access Passwords) via Active Roles instead of granting Azure PIM roles.   I can find the powershell scripts that will do it, but they require MS Graph credentials.   Is there a way to do this in Active Roles to leverage the Graph credentials that AR already possesses without embedding them in plain text in the script? 

Parents
  • 0

    The credentials part can be dealt with by:

    1) Setting up a Service Principal in your tenant that has the appropriate Graph rights assigned to allow the actions you need.

    2) Associating a certificate with that Service Principal and installing that cert on your Active Roles Admin service host.

    3) Then, at the top of your script, you would have a command line like this:

    Connect-MgGraph -ErrorAction Stop -ClientID <the GUID of the service principal> -TenantId <your tenant GUID> -CertificateThumbprint <the thumbprint of the cert you registered on the Service Principal and installed on your AR host>

Reply
  • 0

    The credentials part can be dealt with by:

    1) Setting up a Service Principal in your tenant that has the appropriate Graph rights assigned to allow the actions you need.

    2) Associating a certificate with that Service Principal and installing that cert on your Active Roles Admin service host.

    3) Then, at the top of your script, you would have a command line like this:

    Connect-MgGraph -ErrorAction Stop -ClientID <the GUID of the service principal> -TenantId <your tenant GUID> -CertificateThumbprint <the thumbprint of the cert you registered on the Service Principal and installed on your AR host>

Children
No Data