59 lines
2.3 KiB
PowerShell
59 lines
2.3 KiB
PowerShell
# Script to add multiple users to multiple AzureAD roles
|
|
|
|
<#
|
|
You can find a list of available roles in the following Microsoft article
|
|
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-assign-admin-roles-azure-portal
|
|
Double check using Get-AzureADDirectoryRole as they don't always have the same name in PowerShell as the GUI
|
|
|
|
Built from the code example on the following Mircosoft page
|
|
https://docs.microsoft.com/en-us/powershell/module/azuread/add-azureaddirectoryrolemember?view=azureadps-2.0
|
|
#>
|
|
|
|
|
|
# User UPNs to assign roles to
|
|
$roleUsers = @('')
|
|
|
|
# Role Names to Assign
|
|
$roleNames = @('')
|
|
|
|
|
|
# Import AzureAD module and Connect
|
|
Import-Module AzureAD
|
|
Connect-AzureAD
|
|
|
|
# Run through the list of users
|
|
foreach ($roleUser in $roleUsers) {
|
|
# Fetch user to assign to role
|
|
$roleMember = Get-AzureADUser -ObjectId $roleUser
|
|
|
|
# Run through the list of roles
|
|
foreach ($roleName in $roleNames) {
|
|
# Fetch User Account Administrator role instance
|
|
$role = Get-AzureADDirectoryRole | Where-Object { $_.displayName -eq $roleName }
|
|
|
|
# If role instance does not exist, instantiate it based on the role template
|
|
if (!($role)) {
|
|
# Instantiate an instance of the role template
|
|
$roleTemplate = Get-AzureADDirectoryRoleTemplate | Where-Object { $_.displayName -eq $roleName }
|
|
Enable-AzureADDirectoryRole -RoleTemplateId $roleTemplate.ObjectId
|
|
|
|
# Fetch User Account Administrator role instance again
|
|
$role = Get-AzureADDirectoryRole | Where-Object { $_.displayName -eq $roleName }
|
|
}
|
|
|
|
# Get existing users with the role assigned
|
|
$existingRoleUsers = (Get-AzureADDirectoryRoleMember -ObjectId $role.ObjectId).UserPrincipalName
|
|
|
|
# Assign role to new user if not already in the list
|
|
if ($roleMember.UserPrincipalName -notin $existingRoleUsers) {
|
|
Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId $roleMember.ObjectId -ErrorAction Stop
|
|
}
|
|
}
|
|
}
|
|
|
|
# Uncomment to fetch role membership for each role to confirm
|
|
#foreach ($roleName in $roleNames) {
|
|
# Write-Output -InputObject ('Members for role: ' + $roleName)
|
|
# Get-AzureADDirectoryRoleMember -ObjectId $role.ObjectId | Get-AzureADUser | Where-Object {$_.UserPrincipalName -in $roleUsers} | Format-List -Property DisplayName,UserPrincipalName
|
|
#}
|