Skip to content

Commit a855480

Browse files
merillmerill
authored
Merge pull request #92 from kylemar/main
Fix issues.
2 parents b19d13b + d1c5c55 commit a855480

7 files changed

+114
-34
lines changed

‎src/MSIdentityTools.psd1‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ NestedModules = @('.\agentid\Add-MsIdClientSecretToAgentIdentityBlueprint.ps1',
8181
'.\agentid\EnsureRequiredModules.ps1',
8282
'.\agentid\Get-MSGraphServicePrincipalId.ps1',
8383
'.\agentid\Get-SponsorsAndOwners.ps1',
84+
'.\agentid\Get-MsIdAgentIdentity.ps1',
8485
'.\agentid\Get-MsIdAgentIdentityToken.ps1',
8586
'.\agentid\New-MsIdAgentIdentityBlueprint.ps1',
8687
'.\agentid\New-MsIdAgentIdentityBlueprintPrincipal.ps1',
@@ -208,6 +209,7 @@ FunctionsToExport = 'Add-MsIdClientSecretToAgentIdentityBlueprint',
208209
'New-MsIdAgentIdentityBlueprint',
209210
'New-MsIdAgentIdentityBlueprintPrincipal',
210211
'New-MsIdAgentIDForAgentIdentityBlueprint',
212+
'Get-MsIdAgentIdentity',
211213
'Get-MsIdAgentIdentityToken',
212214
'New-MsIdAgentIDUserForAgentId', 'New-MsIdWsTrustRequest',
213215
'New-MsIdClientSecret', 'New-MsIdSamlRequest',

‎src/agentid/Add-MsIdPermissionToCreateAgentUsersToAgentIdentityBlueprintPrincipal.ps1‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ function Add-MsIdPermissionToCreateAgentUsersToAgentIdentityBlueprintPrincipal {
2929
[string]$AgentBlueprintId
3030
)
3131

32-
# Use provided ID or fall back to stored ID
32+
# Use provided ID or fall back to stored ID
3333
if (-not $AgentBlueprintId) {
3434
if (-not $script:CurrentAgentBlueprintId) {
3535
throw "No Agent Blueprint ID provided and no stored ID available. Please run New-MsIdAgentIdentityBlueprint first or provide the AgentBlueprintId parameter."
@@ -50,15 +50,21 @@ function Add-MsIdPermissionToCreateAgentUsersToAgentIdentityBlueprintPrincipal {
5050
else {
5151
Write-Host "Connected to Microsoft Graph as: $($context.Account)" -ForegroundColor Green
5252
}
53-
53+
5454
try {
5555
Write-Host "Adding permission to create Agent Users to Agent Identity Blueprint Principal..." -ForegroundColor Green
56+
Write-Verbose "Retrieving Blueprint Service Principal ID from tenant..."
57+
$blueprintServicePrincipal = Get-MgServicePrincipal -Filter "appId eq '$AgentBlueprintId'" -Select "id,appId,displayName"
5658

57-
# Check if we have the service principal ID from New-MsIdAgentIdentityBlueprintPrincipal
58-
if (-not $script:CurrentAgentBlueprintServicePrincipalId) {
59-
throw "No Agent Identity Blueprint Service Principal ID available. Please run New-MsIdAgentIdentityBlueprintPrincipal first."
60-
}
59+
if (-not $blueprintServicePrincipal) {
60+
throw "Blueprint Service Principal not found in tenant"
61+
}
62+
63+
# Cache the result
64+
$script:CurrentAgentBlueprintServicePrincipalId = $blueprintServicePrincipal.Id
6165

66+
Write-Verbose "Blueprint Service Principal found - ID: $script:CurrentAgentBlueprintServicePrincipalId, Display Name: $($blueprintServicePrincipal.DisplayName)"
67+
6268
$servicePrincipalId = $script:CurrentAgentBlueprintServicePrincipalId
6369
Write-Host "Using stored Agent Identity Blueprint Service Principal ID: $servicePrincipalId" -ForegroundColor Yellow
6470

‎src/agentid/Add-MsIdScopeToAgentIdentityBlueprint.ps1‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ function Add-MsIdScopeToAgentIdentityBlueprint {
5454

5555
# Prompt for missing parameters
5656
if (-not $AdminConsentDescription -or $AdminConsentDescription.Trim() -eq "") {
57-
$defaultDescription = "Access AI as the current user"
57+
$defaultDescription = "Allow the agent to act on behalf of the signed-in user"
5858
Write-Host "Default: $defaultDescription" -ForegroundColor Gray
5959
$userInput = Read-Host "Enter the admin consent description for the scope (press Enter for default)"
6060
if ($userInput -and $userInput.Trim() -ne "") {
@@ -66,7 +66,7 @@ function Add-MsIdScopeToAgentIdentityBlueprint {
6666
}
6767

6868
if (-not $AdminConsentDisplayName -or $AdminConsentDisplayName.Trim() -eq "") {
69-
$defaultDisplayName = "Access AI as user"
69+
$defaultDisplayName = "Access agent on behalf of user"
7070
Write-Host "Default: $defaultDisplayName" -ForegroundColor Gray
7171
$userInput = Read-Host "Enter the admin consent display name for the scope (press Enter for default)"
7272
if ($userInput -and $userInput.Trim() -ne "") {
@@ -78,7 +78,7 @@ function Add-MsIdScopeToAgentIdentityBlueprint {
7878
}
7979

8080
if (-not $Value -or $Value.Trim() -eq "") {
81-
$defaultValue = "access_AI_as_user"
81+
$defaultValue = "access_agent_as_user"
8282
Write-Host "Default: $defaultValue" -ForegroundColor Gray
8383
$userInput = Read-Host "Enter the scope value (used in token claims, press Enter for default)"
8484
if ($userInput -and $userInput.Trim() -ne "") {

‎src/agentid/EnsureRequiredModules.ps1‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ function EnsureRequiredModules {
1010
param()
1111

1212
$requiredModules = @(
13-
'Microsoft.Graph.Authentication',
1413
'Microsoft.Graph.Applications',
1514
'Microsoft.Graph.Identity.SignIns',
1615
'Microsoft.Graph.Users',

‎src/agentid/Get-MsIdAgentIdentity.ps1‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
<#
2+
.SYNOPSIS
3+
Gets an Agent Identity by its ID
4+
5+
.DESCRIPTION
6+
Retrieves an Agent Identity from Microsoft Graph using the provided Agent ID.
7+
Returns the agent identity object if found, or throws an error if not found.
8+
9+
.PARAMETER AgentId
10+
The ID of the Agent Identity to retrieve.
11+
12+
.EXAMPLE
13+
Get-MsIdAgentIdentity -AgentId "27a3cf14-5bdc-4814-bb13-8f1740ca9a4f"
14+
15+
.EXAMPLE
16+
try {
17+
$agent = Get-MsIdAgentIdentity -AgentId "27a3cf14-5bdc-4814-bb13-8f1740ca9a4f"
18+
Write-Host "Agent found: $($agent.displayName)"
19+
} catch {
20+
Write-Host "Agent not found or error occurred: $_"
21+
}
22+
#>
23+
function Get-MsIdAgentIdentity {
24+
[CmdletBinding()]
25+
param (
26+
[Parameter(Mandatory = $true)]
27+
[string]$AgentId
28+
)
29+
30+
# Ensure we're connected to Microsoft Graph
31+
$context = Get-MgContext
32+
if (-not $context) {
33+
Write-Error "Not connected to Microsoft Graph. Please run Connect-MgGraph first."
34+
return
35+
}
36+
37+
try {
38+
Write-Verbose "Retrieving Agent Identity: $AgentId"
39+
40+
# Call the Graph API to get the agent identity
41+
$uri = "https://graph.microsoft.com/beta/servicePrincipals/microsoft.graph.agentIdentity/$AgentId"
42+
$result = Invoke-MgRestMethod -Method GET -Uri $uri
43+
44+
Write-Verbose "Successfully retrieved Agent Identity"
45+
return $result
46+
}
47+
catch {
48+
# Check if it's a 404 (not found) error
49+
if ($_.Exception.Message -like "*404*" -or $_.Exception.Message -like "*NotFound*") {
50+
Write-Error "Agent Identity with ID '$AgentId' not found."
51+
}
52+
else {
53+
Write-Error "Failed to retrieve Agent Identity: $_"
54+
}
55+
throw
56+
}
57+
}

‎src/agentid/Invoke-MsIdAgentIdInteractive.ps1‎

Lines changed: 39 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,6 @@
1717
function Invoke-MsIdAgentIdInteractive {
1818
[CmdletBinding()]
1919
param()
20-
# Example usage of the MSIdentityTools Agent Identity module
21-
# Comprehensive demonstration of all Agent Identity Blueprint management functions
22-
# Following the recommended workflow order
23-
24-
# Import the module
25-
#Import-Module MSIdentityTools -Force -Verbose
2620

2721
# ===================================================================
2822
# PHASE 1: Create Agent Identity Blueprint
@@ -38,16 +32,15 @@ function Invoke-MsIdAgentIdInteractive {
3832
Write-Host "Agent Identity Blueprints and Agent Users" -ForegroundColor Yellow
3933

4034
# Ensure required modules are available and connect as admin
41-
Connect-MsIdEntraAsUser -Scopes @('AgentIdentityBlueprint.Create', 'AgentIdentityBlueprintPrincipal.Create', 'AppRoleAssignment.ReadWrite.All', 'Application.ReadWrite.All', 'User.ReadWrite.All')
42-
35+
Connect-MsIdEntraAsUser -Scopes @('AgentIdentityBlueprint.Create', 'AgentIdentityBlueprintPrincipal.Create', 'AppRoleAssignment.ReadWrite.All', 'Application.ReadWrite.All', 'User.ReadWrite.All') | Out-Null
4336

4437
$bluePrintDisplayName = Read-Host "Enter a display name for the Agent Identity Blueprint (or press Enter for default)"
4538
if (-not $bluePrintDisplayName -or $bluePrintDisplayName.Trim() -eq "") {
4639
$bluePrintDisplayName = "Agent Identity Blueprint Example $blueprintNumber"
4740
Write-Host "Using default display name: $bluePrintDisplayName" -ForegroundColor Gray
4841
}
4942

50-
# Get current user as sponsor
43+
# Get current user to suggest as sponsor
5144
try {
5245
$currentUserUpn = (Get-MgContext).Account
5346
# Get user's OID directly using their UPN
@@ -152,7 +145,7 @@ function Invoke-MsIdAgentIdInteractive {
152145
Write-Host "Configuring inheritable permissions..." -ForegroundColor Yellow
153146

154147
# Step 4: Configure inheritable permissions (what permissions agent users will get)
155-
$inheritablePerms = Add-MsIdInheritablePermissionsToAgentIdentityBlueprint -Scopes @("user.read", "mail.read", "calendars.read")
148+
$inheritablePerms = Add-MsIdInheritablePermissionsToAgentIdentityBlueprint
156149
Write-Host "Configured inheritable permissions: $($inheritablePerms.InheritableScopes -join ', ')" -ForegroundColor Cyan
157150
}
158151
else {
@@ -176,19 +169,6 @@ function Invoke-MsIdAgentIdInteractive {
176169
# Store the result for later use
177170
$hasAgentIDUsers = ($userResponse -eq "y" -or $userResponse -eq "yes")
178171

179-
if ($hasAgentIDUsers) {
180-
Write-Host "Configuring redirect URIs for Agent ID users..." -ForegroundColor Yellow
181-
182-
# Step 5: Add redirect URIs for OAuth2 flows
183-
$redirectUri = Add-MsIdRedirectURIToAgentIdentityBlueprint
184-
Write-Host "Added redirect URI: $($redirectUri.RedirectUri)" -ForegroundColor Cyan
185-
}
186-
else {
187-
Write-Host "Skipping Agent ID user configuration (no redirect URIs needed)." -ForegroundColor Gray
188-
$redirectUri = $null
189-
}
190-
Write-Host ""
191-
192172
# ===================================================================
193173
# PHASE 6: Create and Configure Service Principal
194174
# ===================================================================
@@ -248,8 +228,16 @@ function Invoke-MsIdAgentIdInteractive {
248228
Write-Host "--- Creating Agent Identity #$agentCounter ---" -ForegroundColor Yellow
249229

250230
# Step 9: Create Agent Identity from the blueprint
231+
232+
if ($useSponsor) {
233+
Write-Host "Using current user as sponsor for Agent Identity." -ForegroundColor Gray
251234
$agentIdentity = New-MsIdAgentIDForAgentIdentityBlueprint -DisplayName "Agent Identity Example $agentCounter" `
252-
-SponsorUserIds @("7c2f8f10-cba8-4a8d-9449-db4b76d1ef80")
235+
-SponsorUserIds $SponsorUserIds
236+
}
237+
else {
238+
Write-Host "No sponsor specified for Agent Identity." -ForegroundColor Gray
239+
$agentIdentity = New-MsIdAgentIDForAgentIdentityBlueprint -DisplayName "Agent Identity Example $agentCounter"
240+
}
253241
Write-Host "Created Agent Identity ID: $($agentIdentity.id)" -ForegroundColor Green
254242
$allAgentIdentities += $agentIdentity
255243

@@ -265,6 +253,33 @@ function Invoke-MsIdAgentIdInteractive {
265253
$agentIDNeedsUser = ($userResponse -eq "y" -or $userResponse -eq "yes")
266254

267255
if ($agentIDNeedsUser) {
256+
Start-Sleep -Seconds 10 # Wait to for replication
257+
258+
# Verify Agent Identity was created successfully by retrieving it
259+
Write-Host "Verifying Agent Identity creation..." -ForegroundColor Yellow
260+
$retryCount = 0
261+
$maxRetries = 5
262+
$verificationSuccess = $false
263+
264+
while ($retryCount -lt $maxRetries -and -not $verificationSuccess) {
265+
try {
266+
$verifiedAgent = Get-MsIdAgentIdentity -AgentId $agentIdentity.id
267+
Write-Host "Agent Identity verified successfully" -ForegroundColor Green
268+
$verificationSuccess = $true
269+
}
270+
catch {
271+
$retryCount++
272+
if ($retryCount -lt $maxRetries) {
273+
Write-Host "Verification attempt $retryCount failed. Waiting 10 seconds before retry..." -ForegroundColor Yellow
274+
Start-Sleep -Seconds 10
275+
}
276+
else {
277+
Write-Error "Failed to verify Agent Identity after $maxRetries attempts: $_"
278+
throw
279+
}
280+
}
281+
}
282+
268283
Write-Host "Creating Agent Users as requested..." -ForegroundColor Yellow
269284
# Get current tenant's domain for UPN
270285
$tenantDomain = (Get-MgOrganization).VerifiedDomains | Where-Object { $_.IsDefault -eq $true } | Select-Object -First 1 -ExpandProperty Name

‎website/docs/commands/docusaurus.sidebar.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ module.exports = [
3232
'commands/Get-MsIdAdfsSampleApp',
3333
'commands/Get-MsIdAdfsWsFedToken',
3434
'commands/Get-MsIdAdfsWsTrustToken',
35+
'commands/Get-MsIdAgentIdentity',
3536
'commands/Get-MsIdApplicationIdByAppId',
3637
'commands/Get-MsIdAuthorityUri',
3738
'commands/Get-MsIdAzureIpRange',

0 commit comments

Comments
 (0)