Get-AdmPrincipalGroupMembership and Azure groups

Question

Hi

I'm trying to set up a process where when a user (on prem) is added to an Azure group, they are removed from some conflicting groups automatically.

When the script runs though, I get the following error

Get-AdmPrincipalGroupMembership : The given key was not present in the dictionary

Running the command in a standard powershell generates the same error and no Azure groups are listed in the results. Is there a way to get this to work?

Additionally, we have a number of child domains and the user can be in any of them.

The script as I have it is

Import-Module Adaxes
$userDomain = "root.domain"

$memberDomain ="%member%".Split(",")[-3]
if ($memberDomain -match "DC=") {
    $userDomain = $memberDomain.Split("=")[1] + "." + $userDomain
}

$user = Get-AdmUser -Identity "%member%" -Server $userDomain -AdaxesService localhost
$groups = Get-AdmPrincipalGroupMembership -Identity $user -AdaxesService localhost

foreach ($group in $groups) {
    if ($group.Name -match "Group nameing convention") { Remove-AdmGroupMember -Identity $group -Members $user -Server "domain.onmicrosoft.com" -AdaxesService localhost }
}

Thanks

Matt

Answer 1

Hello Matt,

Unfortunately, this is a known issue in Adaxes. it will be fixed in the upcoming release. As a solution, you can use dedicated Adaxes methods and search instead of the cmdlets. The following article should be helpful: https://www.adaxes.com/sdk/SampleScripts.SearchingGroups.

Comments

Thanks for the quick reply.

---

Hi

I thought that using native Azure powershell would be easier and cleaner to look at so I wrote the following

Import-Module Adaxes
$userDomain = "domain.com"

$memberDomain ="%member%".Split(",")[-3]
if ($memberDomain -match "DC=") { $userDomain = $memberDomain.Split("=")[1] + "." + $userDomain }

$userUPN = (Get-AdmUser -Identity "%member%" -Server $userDomain -AdaxesService localhost -Properties UserPrincipalName).UserPrincipalName
$Context.LogMessage("$userUPN", "Information")

#Get Credentials and connect to AzureAD
$cred = $Context.GetOffice365Credential()
Import-Module AzureAD
Connect-AzureAD -Credential $cred

$myVar = Get-AzureADTenantDetail
$Context.LogMessage("$($myVar.DisplayName)", "Information")


$userId  = (Get-AzureADUser -SearchString $userUPN).ObjectId
$Context.LogMessage("$userId", "Information")

Get-AzureADUser -SearchString $userUPN | Get-AzureADUserMembership | ForEach-Object {
    $Context.LogMessage("$($_.DisplayName)", "Information")
    if ($_.DisplayName -match "Group naming convention") {
        $Context.LogMessage("Remove $($_.DisplayName)", "Information")
        Remove-AzureADGroupMember -ObjectId $_.objectid -MemberId $userId
    }
}

Disconnect-AzureAD

However, for some reason the users Azure ObjectId never seems to be returned. I'm running this in a business rule which acts before adding a user to the group, but the users UPN is returned. We are quite far behind with the AzureAD module, but the same commands work fine in native powershell. Also, the Get-AzureADTenantDetail command works fine, so I know that I'm connected to AzureAD.

---

Hello Matt,

If your Microsoft 365 tenant is registered in Adaxes with the credentials of an Azure app, the GetOffice365Credential method will not work. This behaviour is by design. Also, the method is not available in Adaxes 2023. Using the AzureAD module is also not a good idea as it will be deprecated soon. As such, you have two options:

• Directly add/remove users from Azure AD groups in Azure. For an example of the script, have a look at method GetAzureAuthAccessToken in the following article: https://www.adaxes.com/sdk/CloudServicesScriptContextClass/#GetAzureAuthAccessToken_string_details.
• Use the approach with Adaxes search as we recommended above if your Azure AD domain is registered in Adaxes.

---

Hi

Thanks for the reply. We are currently still using the service account for connecting to Azure due to some restrictions with some of our other custom scripts which I am working through.

I find it strange as I know that we are connected to Azure because the tenant details are being returned to the log following these commands

$myVar = Get-AzureADTenantDetail
$Context.LogMessage("$($myVar.DisplayName)", "Information")

That said, I've managed to get Graph to work, thanks as always for your quick responses.

Matt

---

Hello Matt,

A new version of Adaxes containing a fix for the issue is released. You can download it from here.

What’s New

Upgrade Instructions