@ClaudioStallone Then I would recommend to raise a support ticket, e.g. there are specific topics for GDAP requests in Partner Center:
I did also reach internally and can update this thread once I learn more, still it would be good if all Partners that experience this raise tickets as well so there is some traction on this problem.
Hello @sansbacher and @JanoschUlmer ,
since this week we have the problem that this command works only for customers with active DAP:
$graphTok = New-PartnerAccessToken -ApplicationId $ApplicationId -Credential $credential -RefreshToken $refreshToken -Scopes "https://graph.microsoft.com/.default" -ServicePrincipal -Tenant $Customer.CustomerContextId
For customers with active GDAP we get the following error:
We have already checked the Graph permissions and Admin Consent on the Azure AD application with the print screens above. Also these were removed and set again unfortunately without success.
We appreciate any ideas or help you can give us.
I agree, you shouldn't need to do anything from a Customer Global Admin - I hope this is a typo "I consent with Global Admin account from the customer's tenant." You should be consenting with a Global Admin from your CSP/Partner Tenant.
No need to do anything with any accounts from any Customer tenants. In order to Consent you must use a Global Admin (since you are consenting on behalf of your entire organization - the CSP Partner). The UPN account (used for some of the connections) needs to be an AdminAgent (since it needs Delegated permissions to your Customers' tenants). These can be different accounts, but the UPN account needs to remain an AdminAgent (if you are using DAP).
I have tested with GDAP and confirmed that: removing a Customer from DAP, but adding them to GDAP, and then adding that UPN account to one of the GDAP Security Groups (eg. one with Global Admin role) works.
I'm not sure what the issue is. Have you tried with multiple Customers? If some work and some don't, can you see their Subscriptions when logged in to the Azure management web GUI from the Partner Center? If not, you may need to wrest control back.
You said "I managed to successfully connect to Partner Center, Exchange Online, AzureAD and MSOL" -- meaning you can connect to multiple Customers (one at a time) and access their data using, say, Get-Mailbox and Get-AzureADUser?
If the issue is just with the 'https://management.azure.com/user_impersonation' scope then I suspect some permission is missing from your Azure AD App Registration. Did you add the permissions for Azure Service Management and Microsoft Graph as "Delegated" (not Application) and they show as Status = Granted for YourTenantName with green check marks?
Like:
If so, maybe there are other ones that need to be added I had already added, but didn't know I needed. Here's the rest of mine:
Maybe add those too? I mainly use: Azure, Azure AD, MSol, and Exchange Online.
@JanoschUlmer I have used MgGraph module, you can connect with a new MS Graph Token:
$graphToken = New-PartnerAccessToken -ApplicationId $applicationId -Scopes ‘https://graph.microsoft.com/.default’ -RefreshToken $refreshtoken -Credential $credential -Tenant $tenantID
and:
Connect-MgGraph -AccessToken $graphToken.AccessToken
Then something like (or any Mg cmdlet):
Invoke-GraphRequest -Method GET -Uri 'https://graph.microsoft.com/v1.0/Groups/'
But I find it easier to just do direct API calls since all the many (MANY!) MgGraph cmdlets are just thin wrappers for every API endpoint and every REST verb, and don't provide much actual "value" in terms of wrapping up useful functions into PowerShell functions.
Anyway, @igor-stajcic you could try re-creating your Azure AD app, the official process is listed here, which has a section for Azure PowerShell.
But my money is on A) you need to double check the API permissions on the App Registration, and B) do all Consents with your Global Admin + AdminAgent accounts - not Customer ones. (AdminAgent if DAP, or whatever group with the correct Roles -> Group mapping you have set up for GDAP)
In looking at my code:
- I always connect to MY CSP Partner Tenant first, grab all the Customers/Clients, then disconnect.
- Then use a foreach ($Customer in $AllCustomers) { ... } loop
- In that loop I connect to the Customer's Azure AD (because I invariably need to) which involves getting all new Customer Azure AD and Graph tokens, and then Connect-AzureAD with them and the UPN account (which has AdminAgent permissions)
- I can then do things like: Get-AzureADUser, and not need to specify any -Tenant or -TenantID, etc.
- Then connecting to the Customer's Azure which involves getting all new Customer Graph and Azure tokens, running Clear-AzContext, then Connect-AzAccount with the Tokens and the UPN account.
- I can then do Azure things, like Get-AzContext or Get-AzVm without needing to add any -Tenant or -TenantID, it just works.
- When done I disconnect both before looping again. (if processes take longer than 60 mins you'll need to renew your AccessTokens...)
I'm using AzureAD module 2.0.2.135. For the Az module I'm using version 7.5.0. I think version 7 is the minimum version now. (it has Az.Accounts 2.9.0 and Az.Resources 6.0.1 - those are the critical ones to connect)
I hope some of that helps!
--Saul
