Section 5: Configure the PowerShell PnP App

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
########################################## Required Modules ##########################################
#Install-Module Microsoft.Graph.Applications

########################################## Connect to Graph ##########################################

# Connect to MgGraph
Import-Module Microsoft.Graph.Applications

# Commercia/GCC
#Connect-MgGraph -Scopes "Application.ReadWrite.All"

# GCC High
#Connect-MgGraph -Environment UsGov -Scopes "Application.ReadWrite.All"

# DoD
#Connect-MgGraph -Environment UsGovDoD -Scopes "Application.ReadWrite.All"

########################################## Security Groups ##########################################

# The application registrations
$appRegistrations = @(
    @{
        name = "pnp-powershell"
        permissions = @(
            # Microsoft Graph
            @{
                ResourceAppId = "00000003-0000-0000-c000-000000000000"
                ResourceAccess = @(
                    # Application.Read.All
                    @{
                        Id = "9a5d68dd-52b0-4cc2-bd40-abcf44ac3a30"
                        Type = "Role"
                    },
                    # AppRoleAssignment.ReadWrite.All
                    @{
                        Id = "06b708a9-e830-4db3-a914-8e69da51d44f"
                        Type = "Role"
                    },
                    # Sites.FullControl.All
                    @{
                        Id = "a82116e5-55eb-4c41-a434-62fe8a61c773"
                        Type = "Role"
                    }
                )
            },
            # Office 365 SharePoint Online
            @{
                ResourceAppId = "00000003-0000-0ff1-ce00-000000000000"
                ResourceAccess = @(
                    # Sites.FullControl.All
                    @{
                        Id = "678536fe-1083-478a-9c59-b99265e6b0d3"
                        Type = "Role"
                    }
                )
            }
        )
    }
)

########################################## Create Application Registrations ##########################################
# Parse the application registrations to create
$appRegistrations | ForEach-Object {
    $appReg = Get-MgApplication -Filter "DisplayName eq '$($_.name)'"
    if($appReg -eq $null) {
        # Create the group
        $appReg = New-MgApplication -DisplayName $_.name

        # Log
        Write-Host "Application Registration created: $($_.name)"
    } else {
        # Log
        Write-Host "Application Registration already exists: $($_.name)"
    }

    # Add the api permission
    Update-MgApplication -ApplicationId $appReg.Id -RequiredResourceAccess $_.permissions

    # Log
    Write-Host "Permission added to the application registration"

    # Log
    Write-Host "Admin consent is required"
}

########################################## Disconnect ##########################################
Disconnect-MgGraph

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
# Certificate Information
$certname = "CN=SPARKAutomationPnP"
$certPath = "Cert:\CurrentUser\My"
$pfxOutputPath = "C:\certs\SPARKAutomation_PnP.pfx"

# Password for the certificate
$pfxPassword = ConvertTo-SecureString -String "Sp@rkAutom8tion" -Force -AsPlainText

# Create the certificate and add it to the user's store
$cert = New-SelfSignedCertificate `
    -Subject $certname `
    -CertStoreLocation $certPath `
    -KeyExportPolicy Exportable `
    -KeySpec Signature `
    -KeyLength 2048 `
    -HashAlgorithm SHA256 `
    -NotAfter (Get-Date).AddYears(2)

# Export the certificate to a file
Export-PfxCertificate `
    -Cert $cert `
    -FilePath $pfxOutputPath `
    -Password $pfxPassword