Finding setup date of Azure Active Directory - azure-active-directory

Someone asked me: Should we not celebrate 10year anniversary for our AzureAD. Do you know the exact date?
Me: No problem, I'll find out. Give me a minute with powershell...
Two days later I am still trying to figure it out.
I have the creation date for our oldest account as a pretty decent answer, but the actual oldest account could be deleted. So, I would like to have the exact date/time for the AAD Instantiation. I guess its an "OCD thing".
Summarize:
Do anyone know how to find the "whenCreated" for an Azure AD instance?
Anyone?

Use Microsoft Graph Get organization.
GET https://graph.microsoft.com/v1.0/organization
There is a property named createdDateTime which is what you want.
Have a quick test in Microsoft Graph Explorer.
Sign in with your admin account and query the organization:

Related

Quick Search do not retrieve "can not find" recently added records

I am working on CRM dynamics 2015, recently we became unable to find contacts that are created recently on CRM via "Quick Search", but we manage to find them with "Advanced search".
in the other hand the contacts that existed already existed are still searchable via Quick Find view
The Quick Search view is well configured.
What may be the problem?
Thank you in advance.
This issue is likely a metadata problem with the underlying tables/fields which store the name of the record. A workflow variant of this issue is described by the following article:
http://teameasi.com/blog/crm-quick-search-not-returning-records-that-exist
I have experienced this issue (specifically on the workflow table) and the fix suggested by the author if this article (renaming the workflow) does work for me. I have also experienced similar issues in the past with contact records modified directly via SQL where the fullname field was not set correctly to reflect the underlying name fields.
Obviously this renaming approach is not particularly friendly for fixing a large number of records, I have some ideas for how to fix records in bulk which I will need to prove out.
Can you provide the following feedback:
- Try re-naming one of the affected contacts to see if this approach also works for the contact case?
- What version of CRM are you on, is it on-premise or online?
- Please test out whether you receive different results within the advanced find if you search based on the fullname field vs the firstname and lastname fields

How to query users from on-prem only using Microsoft Cloud

I'm using Microsoft Graph to query users for my application. I noticed many guest users showing up in the results. These users are not in our on-prem AD that is synced.
I've tried the various OnPremisesXXX properties, but it doesn't look like they support being filtered on (via the $filter query).
Any help would be appreciated.
I've figured it out. I thought I had tried to filter on OnPremisesSyncEnabled, but maybe I did something wrong the first attempt. My filter statement looks like this:
onPremisesSyncEnabled eq true
As I learned, not all properties are usable for the filter command. I used this documentation to help find the answer. Note: I actually ended up on the group.md page which mentioned that the property supports $filter, but the actual user.md page doesn't mention it, so this document may not be 100% up-to-date, but it did ultimately help me find my answer.

Microsoft Graph AppRoleAssignments via AD Group

I have multiple Managed Service Identities (MSIs) that need the same set of permissions to use Microsoft Graph. I've given permissions to one of the MSIs directly and I got the expected result (after waiting for permissions to propagate).
To make life easier, I decided to create a security group, give that group the needed permissions, then assign the various MSIs to that security group. I've verified that the AppRoleAssignments are correct for the security group, but the group members do not seem to inherit the access as expected (even after waiting to ensure permissions have had time to propagate).
Does anyone know if this scenario is supported?
I posted the same question in GitHub and I got my answer there. The net out is that this scenario is not currently supported, however, it may be a supported scenario in the future.
https://github.com/microsoftgraph/microsoft-graph-docs/issues/2797

users and expiration date

I have a question that I hope someone can help me with, I would like to be able to search for how many paying members my website has at a specific date.
They belong to their own role "members" and there is an expiration date for each member. If they do not have an expiration date, they should also be listed.
Should I be able to use 2sxc module for this and would anyone tell me how to do?
You would need to have an intermediate understanding of SQL and the tables/fields related to the results you are trying to achieve. Though it is possible to get done in 2sxc, I would recommend starting the effort the DNN Reports module. That should let you focus on getting the results you need in the SQL Query first (since the display part is auto/default. Then, once you have the right query, you could move it over to 2sxc (or any module that allows data to be queried and returned as a result (set)) and do something more useful.

Generalise LDAP query for groups

I use the following query to find the groups each user is a member of:
(&(objectClass=group)(|(member=cn=UID,OU=ServiceAccounts,OU=MC,DC=ads,DC=myCompany,DC=com,DC=au)(member=cn=UID,OU=BTLY,OU=Sites,OU=MC,DC=ads,DC=myCompany,DC=com,DC=au)))
This query works and runs using the following Base DN:
OU=MC,DC=ads,DC=myCompany,DC=com,DC=au
I have few problems with the query:
I don't like having to use the OR operator to find Service Account users and BTLY users.
I don't want to hard-code the BTLY site, there are others, too.
Ideally, I'd just like to have the query as:
(&(objectClass=group)(|(member=cn=UID,OU=MC,DC=ads,DC=myCompany,DC=com,DC=au))
This way, I don't care whether the user account is a service account nor which site the account belongs to. Unfortunately, that query doesn't work.
Can someone please help me generalise the LDAP query? I'm a bit of a newbie, so I'm most likely missing something completely obvious!
Thanks!
Thanks for the reply. What you've said makes sense, but it doesn't help me, unfortunately. We're using GlassFish (a Java app server), and have configured it to point to the local AD server. Normally, a person can tell GlassFish how to retrieve users, eg
(&(objectCategory=user)(CN=UID))
and GlassFish will pick up all the groups (perhaps by using the memberOf attribute).
This time round we're using a different AD server which hosts a different directory of users. GlassFish isn't able to retrieve the groups by itself. So, there is a field where we can give GlassFish a custom query to find groups. In this field, I've put the query I've posted which works, but is ugly and verbose.
What I'd love to be able to do is:
(&(objectClass=group)(member=cn=UID))
but this doesn't work.
Is there anyway to do this?
Thanks,
Muel.
My guess is that using this technique is not possible. You would need to use wildcard here:
(&(objectCategory=group)(member=CN=UID,*))
and this is not acceptable for DN attributes (like the one stored in 'member' property):
http://msdn.microsoft.com/en-us/library/ms676930(v=vs.85).aspx
My suggestion here would be: use some tool to generate 'ugly' query for you (using syntax mentioned above) and "feed" your tool with end result. Can't see any option, sorry...
I just try to reformulate your question, but it's to much text for a comment.
You are trying to find all the groups the user CN=UID belongs to begining from the nod OU=MC,DC=ads,DC=myCompany,DC=com,DC=au.
This can be done by retreiving the memberOf attribute of the user itself. The only problem (perhaps not in your case) is that the primary group is not in this list of DN, it's coded appart using primaryGroupId attribute.
so
(&(objectCategory=user)(CN=UID))
Will do the job test :
ldifde -f t.ldf -D "OU=MC,DC=ads,DC=myCompany,DC=com,DC=au" -r "(&(objectCategory=user)(CN=UID))" -l memberof
Remark : samAccountName or userPrincipalName are attributes you can rely on for uniqueness of the entry in Active-Directory, that is not the case of CN (an admin can change it)

Resources