Skip to content

Latest commit

 

History

History
224 lines (178 loc) · 11 KB

README.md

File metadata and controls

224 lines (178 loc) · 11 KB
Raw
Graph Powershell Compatibility
Endpoint Versions Rest Options
v1.0, beta
Post,Get
PS 5.1 PS 6.2+ PS 7.0+
Y/N Notes
✖
Invoke-RestMethod commands are using the newer Authentication parameter, not compatible with 5.1
Y/N Notes
✔
N\A
Y/N Notes
✔
N\A

Generate Teams

This repository contains the code used for azure functions allowing a single Rest Post request to generate a new Microsoft Teams team based off of the information provided. This was originally created for use with TDx Web Request features to automate our workflows when creating Microsoft Teams.

Table Of Contents

Requirements

  • Service (User) Account
  • Azure App Registration
    • Application (client) ID
    • Client Secret
    • Graph Permissions:
      Graph API Permission Type Description Admin Consent Required
      Directory.ReadWrite.All Application Read and write directory data Yes
      Group.ReadWrite.All Application Read and write all groups Yes
      Team.Create Application Create teams Yes
      Team.ReadBasic.All Application Get a list of all teams Yes
      TeamSettings.ReadWrite.All Application Read and change all teams' settings Yes
  • Azure Resource Group
    • Technically optional, used to store and organize all of these resources mentioned.
  • Azure App Service
  • Azure Storage Account
    • Azure Storage Queue
    • Azure Storage Table

    • NOTE: Account name and key are not directly used in this script, instead the function.json files use the default "AzureWebJobsStorage" connection which provides this information to the functions.

Setup

  • Generate the Azure App Registration
    • Set the proper Graph permissions (listed in the requirement section)
    • Make note of the Application (client) ID
      • Generate a new client secret (description does not matter)

      • NOTE: Make note of the new client secret, you will not be able to view it later, if lost, a new client secret needs to be generated.

    • NOTE: The name of the App Registration will be visible when the team is created and the requestor is invited, Teams uses the name of the app registration for the notification and invites displayed in Microsoft Teams.

  • Create a new Azure Resource Group, this will be used to "store" all of the additional components
  • Create an azure storage account
    • Create a new Azure Storage Queue and Table
      • Make note of both the Queue and Table name, they will be needed later
  • Create a new App Service
    • The code from this Repo can be cloned down from git or use an SFTP transfer the file to the app service.

    • NOTE: Review the local.settings.json.template "values" section for a list of attributes that will need to exist in the "application settings and configuration" in the app service (set these using the Azure Portal GUI).

  • Review the hardcoded values section below and ensure that those entries are updated to match the current Azure storage.

Required Modules

No external modules are required.

Hardcoded Script Values

There are a few hardcoded values that are based on the configuration of the Azure Storage, These must match the name of their respective Azure Queue, Table, or Resource Group. Casing is very important for these values.

  • NewTeam\function.json
    • QueueName
    • TableName
  • TimedGalChanges\function.json
    • QueueName
  • TimedGroupCheck\function.json
    • TableName
  • TimedGalChanges\run.ps1
    • QueueName
    • ResourceGroup

TDx configuration

TDx User account permission

Application Security Role
Chat ✔
Client Portal Client + Knowledge Base, Services, Ticket Requests
Community ✔
IT Technician
TDNext ✔

Web Service Auth Account

Name type active
Existing user account Name TeamDynamix Web API ✔

Web Service Provider

Name Base Service Provider URL Active
Azure Teams Creator https://AzureAppName.azurewebsites.net/api/ ✔

Workflow and Usage

Workflow img

  • UserPrecheck Function is triggered via a get request
    • Returns the queried user account and provides information regarding the user's licence status
  • NewTeam Function is triggered via a post request
    • A new O365 Group is generated and populated with a single member (the owner of the group)
    • The group is then used to create a Microsoft Team via Microsoft Graph

      • NOTE: Currently this is best practice, Graph API calls newer 1.* may have a single Graph Request to create a team rather than a two part process.

    • This function takes a mixture of the Group and Team attributes and posts the results to the azure table for long term logging
    • Shortly after the new team is created, the owner (the one and only member) will be granted access to the team and receive a notification if their teams client is running
    • A queue message is generated to the storage queue
  • TimedGALChanges This function incrementally checks the storage queue to determine if there are any pending queue messages
    • If there are pending queue messages:
      • The function loads exchange, and attempts to set the visibility of the group in the GAL
        • If the function succeeds, the queue message is removed from the queue
        • If the function does not succeed, the queue message will be checked again the next time the function incrementally checks the queue
  • TeamGuestSettings Function is triggered via a get or post request
    • Team guest access is either enabled or disabled, and returns the current setting values
  • GetAllGuestEnabledTeams
    • Generates a list of all teams that currently allow guest access
    • supplemental function used as needed, is manually triggered

REST Examples

View the readme file within each function's respective folder for more information.

Example Hostname

The name is based off of whatever the Azure Function App Service name is:
  Host: https://<FUNCTIONAPPNAME>.azurewebsites.net

Port 7071 is currently the default port when using the local azure function apps for testing:
  Host: localhost:7071

Additional Notes

Additional comments regarding Graph, Powershell, Teams Roadmaps, ect...

Graph Settings

  • TeamDiscoverySettings within the Graph API is only available within beta
    • This includes the "ShowInTeamsSearchAndSuggestions" Graph API setting

Connect-ExchangeOnline

Team Discovery Settings

Current user based Options for Teams Membership

Troubleshooting

Troubleshooting in TDx

  • Open the TDx homepage
  • Click on the orange grid icon in the top left corner
  • Click the admin icon, this will open the TDx Admin interface
  • click "Applications"
  • Choose "IT"
  • Click "workflow web services >"
  • Choose "workflow web service logs"
  • Look through the list and choose the failed/unsuccessful entry
  • This shows the associated ticket, verify that this log matches the ticket number
  • Review the contents of the log for the exact error message

Troubleshooting in Azure

  • Open the Azure Portal
  • Search for "resource groups"
  • Open the resource group "Infra-TeamsAutomation"
  • Open the "TeamsCreate" function app
  • in the left hand pane, click on functions
  • Select the function to troubleshoot
  • Click "Monitor"
  • Review the individual invocations and the logs as needed

Manually change guest access settings using Microsoft PowerShell

Review Microsoft's solution to Change guest access settings using Microsoft PowerShell.