Check for existing user account after user disable

Question

Hello,

When a user is disabled (firstname.lastname@company.com) we would like to to perform a check if a user account "admin-firstname.lastname@company.com" exists in 365/AzureAD/EntraID and send an email with this information. Could this be done with powershell?

Best Regards,

Maarten

Answer 1

Hello Maarten,

Yes, it is possible. The following SDK article will be helpful: https://www.adaxes.com/sdk/ServerSideScripting.

Comments

Thanks for the tip. The script below uses Graph API to check for a cloud user matching the user that was just disabled.

# concatenate admin account
$adminuser="admin-%firstname%.%lastname%@yourdomain.com"

#connect to Graph API
$token = $Context.CloudServices.GetAzureAuthAccessToken("https://graph.microsoft.com")
$token = $token | ConvertTo-SecureString -AsPlainText -Force
Connect-MgGraph -AccessToken $token

# E-mail settings
$to = "support@yourdomain.com" 
$subject = "Admin User Found"

if ( Get-MgUser -UserID $adminuser) {
    $body = "User %username% has been disabled and a matching administrator account was found: admin-%firstname%.%lastname%. Check if this adminstrator account also needs to be disabled!"
    $Context.SendMail($to, $subject, $NULL, $body)
}