How to configure Azure AD Custom Tenant Configuration Scripts

How to configure Azure AD Custom Tenant Configuration Scripts

Overview

As part of the Atria Azure AD Service Sync Policies, you can assign custom configuration scripts that will be run each time the service is provisioned.  This is useful to ensure your customer's tenants are always configured with your preferred best practice settings.  The key benefit is that Atria will connect up with the right security context for your customer tenants leveraging the Secure Application Model. 

This guide will be updated as we create new script examples.  If there are examples you need assistance with please contact us at support@automate101.com 

Note: If you want to apply scripts as part of the user provisioning process or need to pass in other variables to your scripts see the following article here: https://support.automate101.com/portal/en/kb/articles/how-to-extend-automation-of-microsoft-online-services

Applying a script to a Sync Policy

To apply a custom script to a Sync Policy:
  1. Navigate to Services > Microsoft Online > Sync Policies
  2. Edit or create a new Sync Policy
  3. When editing a Sync Policy there is a section called Tenant Configuration Script as shown below
  4. Specify a custom script to be run i.e. C:\msol\customscript.ps1 (Note: script path should be a local path in the provisioning server or a UNC path accessible in intranet)
  5. Save your Policy - the script will be run every time the Azure AD service is provisioned or reprovisioned to a customer.


Example Scripts

Enforce MFA with security defaults – or enable/disable security defaults

Required application permissions
For this script, you will need to edit the Atria Partner Center App Registration located in Azure AD of your Partner Center account.  This is the App Registration you created during the setup of Microsoft Online: https://support.automate101.com/portal/en/kb/articles/connecting-atria-to-microsoft-partnercenter

The following additional permissions are required.


Validation
  1. Tenant level (https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Properties)

 Script Example
  1. $GraphUri    = "https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy"
  2. $ContentType = "application/json"
  3. $Headers     = @{ 
  4.     Authorization = "Bearer $GraphToken"
  5. }

  7. # Get security defaults status
  8. $SecurityDefaults = Invoke-RestMethod -Headers $Headers -Uri $GraphUri -Method GET -ContentType $ContentType

  10. If($SecurityDefaults.isEnabled -eq $False) {
  11.     $Body = '{ "isEnabled": true }'

  13.     # Enable security defaults
  14.     $Response = Invoke-RestMethod -Headers $Headers -Uri $GraphUri -Method Patch -Body $Body -ContentType $ContentType
  15. }

Enable audit logging

Validation
  1. Tenant level (https://compliance.microsoft.com/auditlogsearch?viewid=Test%20Tab)

 

Script Example
  1. # Get the current Unified Audit Log status
  2. $AdminAuditLogConfig = Invoke-Command -Session $Session -ScriptBlock {
  3.     return Get-AdminAuditLogConfig
  4. }

  6. $UnifiedAuditLogIngestionEnabled = $AdminAuditLogConfig.UnifiedAuditLogIngestionEnabled

  8. If(!$UnifiedAuditLogIngestionEnabled) {
  9.     # Prerequisite
  10.     Invoke-Command -Session $Session -ScriptBlock {
  11.         Enable-OrganizationCustomization -Confirm:$false -ErrorAction SilentlyContinue
  12.     }

  14.     # Enable Unified Audit Log
  15.     Invoke-Command -Session $Session -ScriptBlock {
  16.         Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true | Out-Null
  17.     }
  18. }