As part of creating a service for syncing an internal application's calendar with Outlook Calendar (Exchange) I need a way to get all of the events from the calendars of a list of users. Through EWS I can get access to a user's calendar with their credentials but I won't have access to the password of the users I need to get the calendar's for. Is there any way to get at any user's data using admin credentials and that user's mail address?
Answering my own questions here but the answer is through impersonation. I had come across impersonation early but at first glance it wasn't what I was looking for but after reading more carefully it seems to be exactly what i need.
MSDN article on Impersonation
I'll have the server admin set up an account with impersonation permissions then connect to each account through their username/address and pull the calendar data I need with the GetUserAvailability method.
Related
I am building a platform using NextJS in which I need to grab my users' Google Calendar events and be able to add events to their calendars.
I have a service account set up and would like my service account to access my users' calendar data.
After researching, I have found that one way to do so is to have the user share their calendar manually with my service account.
However, I was wondering if there is a way for my users to be able to give my service account permission without having to do it manually, so for example, pressing a button on my platform that will let them share their calendar with the service account.
service account are intended for use with a calendar that you the developer control. Service accounts also only work with google calendar if you have a google workspace account. You will also need to use a google workspace domain account in order to set up domain wide delegation on your service account to use it with google calendar.
There is no way for a user to share a standard google calendar account with a service account. That was shut down by google a number of years ago. The only option now is domain wide delegation
That being said you will need to use Oauth2 to request consent of your users to access their google calendar accounts. Something like this would be a good place to start Node.js quickstart
I'm trying to set up a Service Account that can access the GMail API, but for security purposes I want it limited to only a single mailbox (I don't want the development team to have full access to all mailboxes in the organization.)
My understanding of how Google handles service accounts and permissions is limited. I can't seem to find specific details about how this would be set up. I have set up a service account with client ID and secret. And I have associated that with an API client that has the GMail read-only scope. But how does that get associated with a specific mailbox? I do see a setting that allows "domain wide delegation", which seems concerning.
Maybe I'm just not understanding this correctly, but does that mean this service account can now read the contents of all mailboxes in the GSuite account?
How do I make sure this service account is limited to the one mailbox I want it to access?
I think you are talking about user impersonation using the service account. I am afraid that it is not possible to limit the access that the service account can have. The only possible limitations is related to the creations of credentials on the project and things like that, but if a service account has domain wide delegation to do user impersonation, then it is not possible to set up limitations to it.
You can find more info about the possible limitations here https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts
Microsoft has the tutorial showing how to use Data Factory to extract Office 365 data, but that seems to only extract Outlook email information?
Is there a way to use Data Factory (and a tutorial hopefully) to connect to Azure AD and extract all the Active Directory users? Microsoft Graph API has the commands to do that, but I wasn't clear if that was the only way or if Data Factory can connect to it directly (like the O365 connector it has)?
Microsoft has the tutorial showing how to use Data Factory to extract Office 365 data, but that seems to only extract Outlook email information?
According to the Microsoft documentation,not only email information,there are many other information such as address book contacts, calendar events, user information, mailbox settings, and so on.
So you can get user information which contains aboutMe,companyName,etc. when you choose BasicDataSet_v0.User_v1 in dataset.(All properties you can get,please refer to this documentation)
By the way,your tenant admin need to opt-in to Microsoft Graph data connect if you do this.And there is no AAD connector.
Hope this can help you.
I used Azure Logic Apps and got through Azure AD group (get members) then used Office 365 Connector to Get Manager there is also another option get direct reports. If you are using Logic apps please make sure to turn the pagination on so you get all users.
This is were I started but once I get going I was able to figure it out myself
https://eax360.com/query-azure-active-directory-using-graph-api-logic-apps/
I’ve been asked by a customer to find a way to collect all permissions for all app registrations in the customer’s AzureAD tenant. The customer has 1500+ App Registrations, so checking each manually isn’t an option. Most of these are redundant but the customer wants to review all of them to look for Graph API permissions that they’ve deemed sensitive. The problem is, there isn’t a way to export this info in the portal and Get-AzADApplication doesn’t give me actual permissions, just friendly descriptions of them. The customer would like the ACTUAL Graph API, such as Mail.Read.
I’ve attempted to script this with the assistance of a few more senior PFEs, but we’ve been unable to make any progress passing various properties between Get-AzAdApplication, Get-AzADServicePrincipal and Get-AzureADOAuth2PermissionGrant. We reached the point where we were able to get the Graph API permissions from the Service Principals, but the resultant permissions were in an unusable format.
If anyone has any suggestions on how to get this information into a concise format with (preferably) the Graph API permissions as mentioned above, I’d greatly appreciate it. I’d rather not go back to the customer and say it isn’t possible, as this is a new customer and I’d rather not say ‘No’ to my first task. 😊
Use Microsoft Cloud App Security for that purpose. This is tool designed, beside other features, especially for that purpose.
You open https://security.microsoft.com/ as a Global or Security Administrator, then you have quick overview on central place:
This will bring you to the MCAS portal, where you have solicit view on all applications with a rating, according to Microsoft standards for "Highly priviledged" access:
A direct view to applications, which users are using these applications, what permissions are granted. It even has filtering capabilities allowing you filter apps based on access level sevirity or even some Graph permissions - like Access e-mail on behalf of the user.
Your customer should really be using the Microsoft Security Center and monitor their security score: https://learn.microsoft.com/en-us/microsoft-365/security/mtp/overview-security-center
Then looking at MCAS: https://www.microsoft.com/en-us/microsoft-365/enterprise-mobility-security/cloud-app-security
You can use this script to list all delegated permissions and application permissions in Azure AD.
The key of the script is Get-AzureADServicePrincipalOAuth2PermissionGrant -ObjectId.
Based on my test, the permissions in the result is in this format: email offline_access openid profile User.Read.
I think it's what you need.
We have installed SharePoint Server 2010 and Project Server 2010 without AD. We're a disconnected bunch and thought we'd take it for a spin since being part of BizSpark. But now I'm seeing an issue with editing user account info like email address. Can anyone give me some hints on how life might be like without AD or how to supplement what we might be missing by running the system without AD. Many posts note it is supported but little has notes on what you might be missing.
Thanks in advance.
What you need is to check out the User Profile Service Application area.
Go to SharePoint Central Administration
Go to Manage Service Applications
Select User Profile Service Application
This area is the home of the accounts that are in SharePoint, as well as all the information about the users and how it is displayed on their "My Site"/profile page areas.
If you select Manage User Profiles, this is the area where you can override information from Active Directory about users that are in sharepoint. If you connect to AD, you'll see a little database icon next to the fields that indicates it is synchronized. Even if you use AD, these field can be individually overriden with new information. If you don't have AD, then these will all need to be populated manually by you.
If you go to Manage User Properties you will find all the options to show which fields are editable and which fields are not on a user's profile. This includes, but is not limited to:
Email
Display Name
Homepage/Url
Department
Manager
If you have AD, you'll rarely visit this service admin page, because everything will just work. If you don't, then you'll need to check out this area to change the information about the people that are using your SharePoint instance.
Hope that helps!