Scripters guide to using Guest Access in Office365 to automate things

Guest access is one of the ways in Office365 of collaborating between different organizations which allows you to give certain people who are outside of your company access to a limited subset of the resources you have in the Cloud. This can be an Office365 unified Group or Microsoft Team but also other workloads like SharePoint and OneDrive can utilize this.

When it comes to scripting there are a number of value add things you can do to automate tasks for different people who have guest accounts in another tenant. The first step to automating with Guest Access is to Authenticate and generate an access token in the Guest tenant.

Getting the Guest Tenants Authorization Endpoint

Before you can authenticate you need to first obtain the Guest tenants Authorization endpoint for the tenant where the Guest Account exists in. To do this you can make a simple Get Request like the following

Invoke-WebRequest -uri ("[https://login.windows.net/{0}/.well-known/openid-configuration" -f "guestdomain.com")

this will return a JSON result that contains the Authorization endpoint for the guest tenant along with other information useful when authenticating.

While Invoke Web Request will do the job fine if you ever what to execute something like this from an Azure Run-book it better to use the httpclient object instead. Here is a simple function to get the Authorization endpoint

function Get-TenantId {
param( 
    [Parameter(Position = 1, Mandatory = $false)]
    [String]$DomainName
   
)  
Begin {
    $RequestURL = "https://login.windows.net/{0}/.well-known/openid-configuration" -f $DomainName
    Add-Type -AssemblyName System.Net.Http
    $handler = New-Object  System.Net.Http.HttpClientHandler
    $handler.CookieContainer = New-Object System.Net.CookieContainer
    $handler.AllowAutoRedirect = $true;
    $HttpClient = New-Object System.Net.Http.HttpClient($handler);
    $Header = New-Object System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/json")
    $HttpClient.DefaultRequestHeaders.Accept.Add($Header);
    $HttpClient.Timeout = New-Object System.TimeSpan(0, 0, 90);
    $HttpClient.DefaultRequestHeaders.TransferEncodingChunked = $false
    $Header = New-Object System.Net.Http.Headers.ProductInfoHeaderValue("Get-TenantId", "1.1")
    $HttpClient.DefaultRequestHeaders.UserAgent.Add($Header);
    $ClientResult = $HttpClient.GetAsync([Uri]$RequestURL)
    $JsonResponse = ConvertFrom-Json  $ClientResult.Result.Content.ReadAsStringAsync().Result
    return $JsonResponse.authorization_endpoint
}}

Using the ADAL
Once you have the authorization endpoint your ready to Authenticate, using the ADAL library which is a popular method you would use something like the following (where I’m using the above function to get the endpoint in @line3

Import-Module .\Microsoft.IdentityModel.Clients.ActiveDirectory.dll -Force
$PromptBehavior  =  New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList Auto
$EndpointUri  =  Get-Tenantid -DomainName domain.com
$Context  =  New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext($EndpointUri)
$token  = ($Context.AcquireTokenAsync("https://graph.microsoft.com","d3590ed6-52b3-4102-aeff-aad2292ab01c","urn:ietf:wg:oauth:2.0:oob",$PromptBehavior)).Result

In the above example I’ve used the preapproved Office appId otherwise if you where to use your own AppId that would need to be authorized in the Guest tenant (which is a always a degree of difficulty when dealing with another companie's IT departments).

Once you have the Token you can then make a Request to the ./me endpoint to find a bit more about your account in the guest tenant eg

$Header = @{
        'Content-Type'  = 'application\json'
        'Authorization' = $token.CreateAuthorizationHeader()
        }
Invoke-RestMethod -Headers $Header -Uri "https://graph.microsoft.com/v1.0/me" -Method Get -ContentType "application/json" 

Or to get the Groups or Teams your a member of you can use

Invoke-RestMethod -Headers $Header -Uri "https://graph.microsoft.com/v1.0/me/memberOf" -Method Get -ContentType "application/json" 

And to get the Members or a particular Team or Group

Invoke-RestMethod -Headers $Header -Uri "https://graph.microsoft.com/v1.0/groups/938383f7-3060-4604-b3a5-cbdb0a5fc90f/members" -Method Get -ContentType "application/json"

Where the Guid (938383f7-3060-4604-b3a5-cbdb0a5fc90f in this instance) is the id you retrieved when you used me/memberOf

This gives you access to all the raw data about each of the members of a Group you might be interacting with. For some real life uses of this take a look at the module section below

Other things you can do with this which I’ll go through below are

• Export the Group members from  a Guest Teams/Group to CSV
• Download or Upload Files to shared Team/Group drive
• Export the Groups Calendar to a CSV file

Using a Module

If your looking for an easier way of using Guest Access check out my Exch-Rest Module on the PowerShell Gallery https://www.powershellgallery.com/packages/Exch-Rest/3.22.0 and gitHub https://github.com/gscales/Exch-Rest . The following are samples for this module

To connect to a tenant as a Guest use

 Connect-EXRMailbox -GuestDomain guestdomain.com -MailboxName gscales@datarumble.com

You can then execute the Me and MemberOf requests using

Get-EXRMe

Get-EXRMemberOf

Export the members of a Group or Team your a member of as a Guest to CSV

The following can be used to Export the members of a Team or Unified Group in a Guest tenant to a CSV file. The Inputs you need a the SMTP address of the Group which you can get from running Get-EXRMemberOf in the Guest Tenant

$Group = Get-EXRUnifedGroups -mail guest@guestdomain.org
$GroupMembers = Get-EXRGroupMembers -GroupId $Group.id -ContactPropsOnly
$GroupMembers |  Export-Csv -path c:\temp\groupexport.csv -noTypeInformation

If you wish to include the user photo in the export you can use (although the AppId you use to connect must have access to the userphoto)

$Group = Get-EXRUnifedGroups -mail guest@guestdomain.org
$GroupMembers = Get-EXRGroupMembers -GroupId $Group.id -ContactPropsOnly
$GroupMembers |  Export-Csv -path c:\temp\groupexport.csv -noTypeInformation

Downloading a File from Group/Teams Shared Drive (Files) as a Guest

$Group = Get-EXRUnifedGroups -mail guest@guestdomain.org
$FileName = "thenameofthedoc.docs"
$File = Get-EXRGroupFiles -GroupId $Group.id -FileName $FileName
Invoke-WebRequest -Uri $File.'@microsoft.graph.downloadUrl' -OutFile ("C:\downloaddirectory\$FileName)

Export a Groups Calendar to CSV as a Guest

$Group = Get-EXRUnifedGroups -mail guest@guestdomain.org
Get-EXRGroupCalendar -GroupId $Group.id -Export | export-csv -NoTypeInformation -Path c:\temp\calendarexport.csv

By default the next 7 days is exported by the time windows can be tweaked using -starttime and -sndtime parameter in the Get-EXRGroupCalendar cmdlet

Hire me - If you would like to do something similar to this or anything else you see on my blog I'm currently available to help with any Office365,Microsoft Teams, Exchange or Active Directory related development work or scripting, please contact me at gscales@msgdevelop.com (nothing too big or small).