Thursday, July 11, 2019

Script to retrieve all the Office365 (Azure) Tenants an account is associated with

The Azure AD business-to-business (B2B) platform is the underlying tech that drives both guest access in Microsoft Teams,Office365 Groups and also other Azure resources. If your someone who collaborates across a number of different organization or potentially different Community or even school or university groups you might find your MSA or Office365 account starts to accumulate Guest access to different tenants. Depending on what type of access your accruing eg If it just Microsoft Teams access you will see your guest tenancies when logging on to Teams, another way is if you logon to the Azure Portal and hit switch directory you will get a list of Azure Directories your account has an association with. 

However and easier way of doing this is using PowerShell along with the ADAL, Azure Resource Management and Graph API's. I put together the following script that uses first the Azure Resource Management API to make a request that gets all the Tenants associated with your account (same as what you would see if you hit switch directory).


$UserResult = (Invoke-RestMethod -Headers $Header 
  -Uri ("https://management.azure.com/tenants?api-version=2019-03-01&`
  $includeAllTenantCategories=true") -Method Get -ContentType "Application/json").value

This returns all the Tenants associated with your user and a lot of information about the domains for the tenants your guesting into eg



The domains information was a little interesting especially seeing all the other domains people had associated in their tenants where I was a Guest. While domains aren't private information finding the bulk of domains a particular organization is associated with isn't that easy (from an outside perspective). For the rest of the script I added some code that would authenticate as a Guest into any tenants my account was associated with and then using the Graph API try to query any Teams or Office365 groups this account is associated with and then try to query for the last 2 conversation items in those Groups/Teams. The script adds information about the Groups to the Tenant object returned for each Tenant the account is associated with and then the conversations to each of the Groups in the object returned. eg so i can do something like this


I've put the script up on GitHub at https://github.com/gscales/Powershell-Scripts/blob/master/Get-TenantsForUser.ps1 this script requires the ADAL dll's for the authentication and it should be located in the same directory as the script is being run from.


2 comments:

Unknown said...

Awesome work as always! Is there a way to see if a username/email is also associated with a personal account as well? My company is running into an issue where a good majority of our user base has used their company email to register a personal Microsoft account. As we are migrating these users to O365 we are running into various client activation issues until they disassociated their personal account with their company email address.
In using 'http://office.com/signin' with an address in this situation we are presented with a “Is this a work or personal account” screen. So I traced the form\redirects and have been trying to script out this process via PowerShell but I can’t seem to get the various form submittals correct despite trapping (what I think) is the proper apiCanary, FlowTokens, etc.

kavita sharma said...

Thanks for the nice information. For best deals and genuine products visit our official site. And get Unbelievable Discount on Microsoft, Windows, Antivirus products
. Get quick email delivery and 24/7 support.