Category: PowerShell

Azure Active Directory – How to give a Registered Application an AD Directory Administrative Role

By default a ‘Registered Application’ account is not a member of any Directory Roles and/or group memberships and there is no easy way to make these changes using the portal. You may have an API or back-end application that will be required to perform actions on your AD that requires elevated permissions (e.g. Reset passwords or delete accounts etc..)

Normally for advanced configuration, you will need to start editing the manifest file. Luckily this has been made easy using the Portal. You can now edit the file directly, or download, make changes and then upload.

However, to make a ‘Registered Application’ a member of a ‘Directory Administrative Role’ you need to use PowerShell to add the role member to the ‘Service Principal’ (as I couldn’t find a way to do this in the manifest!).

Continue reading “Azure Active Directory – How to give a Registered Application an AD Directory Administrative Role”

How to delete an Azure Active Directory (ADD) Tenant

You may have discovered that deleting an Azure Active Directory is a particularly frustrating experience that ultimately ends in failure. The new portal have improved things a bit, by running through a series of check before the delete button is enabled.

You may need to go back to the Classic portal (https://manage.windowsazure.com) to see some of the objects/resources to delete.

However, although this will help you remove ‘most’ of what you need to, unfortunately NOT all!

In this case I got a “Unable to delete directory

Continue reading “How to delete an Azure Active Directory (ADD) Tenant”

Creating an Azure Virtual Network with VPN Gateway entirely with PowerShell not possible!

As I found the documentation for this somewhat lacking (especially for New-AzureRmVirtualNetworkGateway and New-AzureRmVirtualNetworkGatewayIpConfig), I thought I would try and see if it was possible to create and fully configure a Virtual Network and Gateway using PowerShell. I have posted my PowerShell script examples and efforst here.

NOTE: Several of these command return  a warning (shown below) which means things will be changing soon…again 😉 …and other just exception, so although you can setup a Virtual Network you can not create the Gateway!

2017-01-05_15-39-25

I am using version 3.3.0 of the Azure cmdlets.

# Get Azure cmdlets version
Get-Module -ListAvailable -Name Azure -Refresh

Steps

  1. Setup variables, login and set current context
    # Setup Variables
    $location = "North Europe"
    $rgName = "MyResourceGroup"
    $strgAccount = "MyStorageAccount"
    $vnetName = "vnet-1"
    $gatewayPIPName = "gateway-2-pip"
    $clientAddressPool = "192.168.0.0/16"
    $gatewayName = "mygateway1"
    
    # Setup PowerShell Environment
    Add-AzureRmAccount
    Select-AzureRmSubscription -SubscriptionName "MySubscription"
    Set-AzureRmCurrentStorageAccount -ResourceGroupName $rgName -Name $strgAccount
    # get and check current context (ARM)
    Get-AzureRmContext
  2. Create the Virtual Network (include a subnet called ‘GatewaySubnet‘ specifically for the VPN Gateway. It appears this is required even if using the Portal to add a Gateway to a Virtual Network.)
    # Create the Virtual Network with 3 subnets)
    # Setup Subnets
    $gatewaySubnet = New-AzureRmVirtualNetworkSubnetConfig `
        -Name GatewaySubnet -AddressPrefix "10.1.0.0/24"
    $frontendSubnet = New-AzureRmVirtualNetworkSubnetConfig `
        -Name frontendSubnet -AddressPrefix "10.1.1.0/24"
    $backendSubnet = New-AzureRmVirtualNetworkSubnetConfig `
        -Name backendSubnet -AddressPrefix "10.1.2.0/24"
    # Create VNet
    $vnet = New-AzureRmVirtualNetwork -Name $vnetName `
        -ResourceGroupName $rgName -Location $location `
        -AddressPrefix "10.1.0.0/16" `
        -Subnet $gatewaySubnet,$frontendSubnet,$backendSubnet
  3. Create a Public IP Address (PIP) to be used by the Gateway
    # Create a PIP
    $pip = New-AzureRmPublicIpAddress -AllocationMethod Dynamic `
        -ResourceGroupName $rgName -Location $location `
        -Name $gatewayPIPName
  4. Create the VNet Gateway (Attempt 1Although I can’t see any issues in the script below, unfortunately this is returning a 500 Internal Server Error. I have tried a number of variations!!)
    # Gateway config
    $vnetGatewayIPConf = New-AzureRmVirtualNetworkGatewayIpConfig -Name default `
        -PublicIpAddress $pip -Subnet $gatewaySubnet
    # Create VNet Gateway
    $vnetGateway = New-AzureRmVirtualNetworkGateway -Name "hmstraingateway1" 
        -ResourceGroupName $rgName `
        -Location $location `
        -IpConfigurations $vnetGatewayIPConf `
        -GatewayType Vpn `
        -VpnType RouteBased `
        -GatewaySku Basic `
        -VpnClientAddressPool $clientAddressPool

     

Attempt 2: I then thought I would see if it would be possible to complete the process using ARM Templates. When attempting to get an ARM Template for an existing Virtual Network Gateway we get the following errors.

Error details - Microsoft Azure 
  • The schema of resource type 'Microsoft.Network/virtualNetworkGateways' is 
    not available. Resources of this type will not be exported to the template. 
    (Code: ResourceTypeSchemaNotFound)
  • The schema of resource type 'Microsoft.Web/connections' is not available. 
    Resources of this type will not be exported to the template. 
    (Code: ResourceTypeSchemaNotFound)

This effectively indicates that the ARM capability of this type of resource is not yet all there in Azure. I seem to come across issue like this quite a lot.

Also with the ARM Virtual Network you can’t use the Get-AzureVNetConfig to download the configuration files either.

So in conclusion the only way to currently create a Gateway and complete the process, is to use the Azure Portal. Please comment below if you know of another way or have spotted an issue.

Links

New-AzureRmVirtualNetworkGatewayIpConfig (https://docs.microsoft.com/en-us/powershell/resourcemanager/azurerm.network/v2.1.0/new-azurermvirtualnetworkgatewayipconfig)

New-AzureRmVirtualNetworkGateway (https://docs.microsoft.com/en-us/powershell/resourcemanager/AzureRM.Network/v1.0.13/New-AzureRmVirtualNetworkGateway?redirectedfrom=msdn)

Save

“Resource group not found” when using PowerShell with Azure (especially DSC)

I have been banging my head against a wall wondering why my Azure PowerShell DSC commands like

Publish-AzureRmVMDscConfiguration  ".\MyDSCConfig.ps1" 
            -ResourceGroupName "VM-Training" -StorageAccountName "hmsvmtraindsc"

was failing with a “Resource Group not found“, even though other commands worked with that Resource Group and my current context.

The answer is do NOT use the x64 build of PowerShell or the “Windows PowerShell ISE”!

Use the x86 versions for now!

I found this advice at the bottom of this page https://azure.microsoft.com/en-us/blog/turn-on-windows-feature-using-dsc-cli/, and switching to the x86 ISE worked for me!

However, when I tried to reproduce the issue on the x64 ISE, the command worked fine??? However, by that time the Blob container had been created by the x86 version, so who know?

If I get time I will try to reproduce the error, otherwise please post a comment if the same thing happened to you.

 

Finding Azure VM Images using PowerShell

I have been trying to write a PowerShell command that would help me find the right Azure VM Image to use when creating a new Virtual Machine.

In the Portal UI you get something not very useful like the following when search for a VM Image. No unique identifying information to locate the image from script.

2016-12-09_09-55-17

However, when using such a simple search in PowerShell, you get a lot more data returned and working out which one you want is a bit of a pain.

After a few iterations I thought I would share it and save others the time.

The first thing is how to filter the huge list to just the images that contain what I am after, whether that’s a service or OS. It turns out that there is not much consistency to help here, but two fields stand out for searching.

  • Label – The publicly visible name of the image
  • ImageFamily – A sometimes useful category that can be used to filter, but depend on the type of image. Often this value is either the same as the Label or some cryptic value.

Once filtered, there seemed to be a number of additional fields that may vary and influence your decision as to which VM Image you want when creating a new VM.

  • OS – This is usually repeated in the Label so have left this off the listing.
  • PublisherName – Was hoping this may match the Portal listing, but no!
  • PublishedDate – The date the image was published. I have use this to sort the list, showing the latest first.
  • Category – I was also hoping this would match the Portal listing, but no! This seems to only indicate if the image is public or …something else! I am only interested in Public ones.
  • IsPremium – This indicates if the image includes any licensing. If false, it’s more than likely a ‘Bring You Own License’ (BYOL)
  • ShowInGui – I assume when this is ‘true’ then the image is available in the portal. Again I think unless you have a very specific image in mind, this should also be ‘true’.
  • RecommnededVMSize – sows the recommended VM size to use

I was looking for a simple “Windows Server 2016 Datacenter”. Ideally the recommended or default. For this case it was possible to filter by the ImageFamily. However I noticed this was not going to be so easy for other things such as ‘SQL Server’ images as some ImageFamily were return with text like ‘Windows SQL14-PCU-MAIN-12.0.5000.0-SQLENTCORE.ENU.Nov-WS2012R2-127gb.09.27.16.01.042’ , so opted for filter on the Label instead.

$searchTerm = "*Windows Server 2016*"
Get-AzureVMImage | Where-Object {$_.Label -like $searchTerm -and $_.Category -eq "Public" -and $_.ShowInGui -ne $false} | Sort-Object PublishedDate -Descending | Select-Object Label,PublisherName, PublishedDate,IsPremium,RecommendedVMSize,ImageName | Format-Table

The line above will produce a table output as shown below, but the ImageName, which is probably what you are after, may well be truncated.

2016-12-09_12-02-07
$searchTerm=”*SQL Server 2014*”

 

2016-12-09_12-05-55
$searchTerm=”*Windows Server 2016 Datacenter*”

So, once you have honed your search term down, then run this smaller table version.

Get-AzureVMImage | Where-Object {$_.Label -like $searchTerm -and $_.Category -eq "Public" -and $_.ShowInGui -ne $false} | Sort-Object PublishedDate -Descending | Select-Object Label,ImageName | Format-Table

which produces something like the listing below, from where you can copy the full ImageName.

2016-12-09_12-12-58