Fr

This book is a one-stop guide on managing Microsoft

Azure services using PowerShell. Administrators and

What you will learn from this book

developers will learn how to use PowerShell to create

and manage Azure websites, virtual machines, SQL

Connect to Microsoft Azure with PowerShell

databases, and so on.

Starting with an introduction to Windows PowerShell,
this book will assist you in connecting to Microsoft Azure
with PowerShell. Next, the book covers how to create
and manage Azure storage accounts, including file, blob,
and table storage. Moving on, this book covers creating
and managing Azure virtual machines, SQL databases,
websites,

virtual

networks,

traffic

manager,

cloud

services, and Active Directory. Finally, this book covers

how to automate complex tasks using Azure automation

Manage storage blobs, tables, and queues

with PowerShell
Create virtual machines with PowerShell
Query SQL databases with PowerShell
Deploy websites and cloud services
with PowerShell
Create virtual networks and traffic manager
profiles with PowerShell

Automating Microsoft Azure with PowerShell

Automating Microsoft
Azure with PowerShell

runbooks.

This book is designed to help administrators and

developers better automate Azure management tasks.

Perform Active Directory management tasks

with PowerShell
Automate complex tasks using automation
runbooks

No prior knowledge of PowerShell is required.

professional expertise distilled

P U B L I S H I N G

Prices do not include

local sales tax or VAT
where applicable

Visit www.PacktPub.com for books, eBooks,

code, downloads, and PacktLib.

Aman Dhally

$ 29.99 US
19.99 UK

John Chapman

Who this book is written for

ee

Sa

pl
e

P r o f e s s i o n a l

E x p e r t i s e

D i s t i l l e d

Automating Microsoft Azure

with PowerShell
Automate Microsoft Azure tasks using Windows PowerShell
to take full control of your Microsoft Azure deployments

John Chapman

Aman Dhally

professional expertise distilled

P U B L I S H I N G

In this package, you will find:

The authors biography

A preview chapter from the book, Chapter 9 'Managing Azure Active
Directory with PowerShell'
A synopsis of the books content
More information on Automating Microsoft Azure with PowerShell

About the Authors

John Chapman is a software engineer in the Phoenix area. Having also worked
in the higher education, telecommunications, and enterprise software industries,
John's development experience includes .NET, SharePoint, Swift, Objective-C
and other languages, markup, and platforms. You can visit his website at
http://www.johnchapman.net/.
I would like to thank my wife, Simone. Her support and patience
have made what I have accomplished in my life possible.

Aman Dhally is a PowerShell MVP and founder of New Delhi PowerShell User
Group. He has more than 14 years of experience in the IT industry. His main focus
is the automation of manual tasks using PowerShell. He came in to contact with
PowerShell in 2010. Since then, he has published a wealth of articles, videos, blogs,
and PowerShell scripts. He loves teaching PowerShell and speaking at User
Group events.
Aman works as a network analyst for Analysys Mason Limited, which he describes
as a "cool" company to work for. Here, he works on various IT projects, and his
PowerShell skills bring a unique approach to solving IT issues and improving
efficiency within the company.
He is fascinated by anything to do with life: philosophy, self-help techniques,
and biographies of famous people, which he finds inspiring. In his free time, you
will often find him reading a book on any of these subjects. His philosophy can be
summed up by his phrase: "You see a mousetrap, I see free cheese and a challenge!"

Automating Microsoft Azure

with PowerShell
Microsoft Azure offers a plethora of cloud-based services that can integrate into
an enterprise organization's data center infrastructures. From Active Directory to
virtual machines, organizations that make full use of Azure services have a lot to
configure and manage. Using PowerShell, most Azure configuration and management
tasks can be streamlined and automated. This book explores using Microsoft Azure
PowerShell to manage the commonly used services of Microsoft Azure.

What This Book Covers

Chapter 1, Getting Started with Azure and PowerShell, introduces Windows
PowerShell, configures Microsoft Azure PowerShell tools, and connects
to Microsoft Azure using PowerShell.
Chapter 2, Managing Azure Storage with PowerShell, explores managing
the services offered by a Microsoft Azure storage account with PowerShell,
including file, blob, table, and queue storage.
Chapter 3, Managing Azure Virtual Machines with PowerShell, covers how
to create and manage virtual machines in Microsoft Azure using PowerShell.
Chapter 4, Managing Azure SQL Databases with PowerShell, examines the
basics of creating and managing SQL databases in Microsoft Azure
using PowerShell.
Chapter 5, Deploying and Managing Azure Websites with PowerShell,
delves into creating and publishing Microsoft Azure websites with PowerShell.
Chapter 6, Managing Azure Virtual Networks with PowerShell, explores Microsoft
Azure virtual networks and how to create and manage them with PowerShell.
Chapter 7, Managing Azure Traffic Manager with PowerShell, investigates
how to manage geo-redundant and high-availability services in Microsoft
Azure using Microsoft Azure's Traffic Manager with PowerShell.
Chapter 8, Managing Azure Cloud Services with PowerShell, covers
how to manage Microsoft Azure cloud services using PowerShell.
Chapter 9, Managing Azure Active Directory with PowerShell, explores how
to use and manage Active Directory in Microsoft Azure using PowerShell.
Chapter 10, Automating Azure with PowerShell, covers how to use
runbooks to automate Microsoft Azure management tasks using PowerShell.

Chapter 9

Managing Azure Active

Directory with PowerShell
By offering user and computer authentication and authorization, certificate
management, group policy, federated services, and so on, Microsoft Active Directory
is often the cornerstone of an organization's data center infrastructure. With Azure,
the capabilities of Active Directory are extended to the cloud to provide features
such as single sign-on with cloud services (including Office 365 and Salesforce.com),
multifactor authentication, and integration with existing on-premise deployments of
Active Directory.
Azure utilizes Active Directory domains to manage authentication and authorization
to Azure services. When a new Azure account is created, a default directory is
automatically configured. The Microsoft account used for the Azure account is
added to this directory as a Global Administrator.
Many organizations use scripting to manage their data center operations, and some
organizations even require it. Active Directory is typically involved in these processes.
In this chapter, we will explore how to automate some of the common tasks of Azure
Active Directory management with PowerShell. However, Active Directory itself is a
very large topic and one we will not cover in-depth in this chapter.
In this chapter, we will explore how to automate common tasks in Azure Active
Directory management with PowerShell. We will cover the following topics:

Connecting to Azure Active Directory

Creating a new Azure Active Directory domain

Configuring an Azure Active Directory domain

Managing Azure Active Directory users and groups

[ 99 ]

Managing Azure Active Directory with PowerShell

Using PowerShell to bulk-import users and groups to Azure Active Directory

A number of books and articles have been written about Active
Directory. For more in-depth information about Active Directory, here
are a few resources to get you started:
The Active Directory Design Principles article by Packt
Publishing (https://www.packtpub.com/books/content/
active-directory-design-principles-part-1)
The Active Directory Domain Services article by TechNet
(http://technet.microsoft.com/en-us/
windowsserver/dd448614)
The book Active Directory with PowerShell, Uma Yellapragada, Packt
Publishing (https://www.packtpub.com/networkingand-servers/active-directory-powershell)

Connecting to Azure Active Directory

The PowerShell tools for Azure Active Directory are separate from the tools used
to manage other Azure services, which we covered in Chapter 1, Getting Started with
Azure and PowerShell. Before you connect to Azure Active Directory, download and
install the following tools:

Microsoft Online Services Sign-In Assistant (http://www.microsoft.com/

en-us/download/details.aspx?id=41950)
Microsoft Azure Active Directory Module (http://go.microsoft.com/

fwlink/p/?linkid=236297)

After installing these tools, reboot the computer to complete the installation.
If you use the Azure Active Directory module, you will encounter
a known issue if you attempt to use the 32-bit version on a 64-bit
computer. If you use the 32-bit version on a 64-bit computer and
receive errors such as the term is not recognized, refer to http://
stackoverflow.com/questions/16018732/msonline-cantbe-imported-on-powershell-connect-msolservice-error.

[ 100 ]

Chapter 9

Creating an administrator account

Microsoft accounts and single sign-on accounts (for instance, using Active Directory
Federation Services from an on-premise Active Directory domain) typically do not
work to connect to Azure Active Directory in PowerShell. As a result, we will create
a new Active Directory domain user in the Azure web portal that we can use to
connect. To do this, follow these steps:
1. Log in to the Azure portal in a web browser at https://manage.
windowsazure.com.
2. From the left-hand side navigation panel, select ACTIVE DIRECTORY
and then select Default Directory, as shown in the following screenshot:

[ 101 ]

Managing Azure Active Directory with PowerShell

3. Select the USERS tab and then click on ADD USER at the bottom of
the screen:

4. Enter the name in the USER NAME field and click on the next button:

[ 102 ]

Chapter 9

5. Select Global Administrator for ROLE and provide FIRST NAME, LAST
NAME, DISPLAY NAME, and ALTERNATE EMAIL ADDRESS for the
new user. Click on the next button:

6. Click on CREATE.

[ 103 ]

Managing Azure Active Directory with PowerShell

7. Make a note of the full username and the temporary password for
the new user:

8. To enable this user to create new Active Directory domains, rather than just
manage the Default Directory, we will need to add this user as an Azure
Administrator. From the left-hand side of the Azure management portal,
select SETTINGS, ADMINISTRATORS, and then click on ADD, as shown
in the following screenshot:

[ 104 ]

Chapter 9

9. In the EMAIL ADDRESS field, enter the full username of the user we
created (for example, [email protected]), select
SUBSCRIPTION, and click on the checkmark button to complete the
process of adding the user:

[ 105 ]

Managing Azure Active Directory with PowerShell

10. Before the newly created account can be used, we need to change the
temporary password. First, log out from the Azure portal by selecting your
account name in the top-right corner of the page and clicking on SIGN OUT.
11. Click on SIGN IN to return to the login page.
12. Use the username and temporary password of the newly created account
to log in.
13. When prompted, provide a new password for the account.
With the new administrator account created and the password set, we can now
connect to Azure Active Directory with PowerShell.

Connecting to Azure Active Directory

When we installed the Azure Active Directory module for PowerShell, the MSOnline
module was registered with PowerShell. To make the cmdlets from the module
available, we can either select the Windows Azure Active Directory Module for
Windows PowerShell entry from the Start menu, or we can manually import the
MSOnline module. To do this, follow these steps:
1. Open Windows Azure Active Directory Module for Windows PowerShell
from the Start menu or add the module to an existing PowerShell session
using the following command:
PS C:\> Import-Module MSOnline

2. Use the Connect-MsolService cmdlet to connect to Azure Active Directory.

You will be prompted to enter your credentials. Use the full username and
password for the administrator account we created:

[ 106 ]

Chapter 9

The PowerShell session is now connected to Azure Active Directory.

In the event you receive an error message while attempting to connect
to Azure Active Directory, Microsoft has some troubleshooting steps
that will resolve most cases; refer to http://support.microsoft.
com/kb/2494043.

For more information about Azure Active Directory and the cmdlet used in this
section, refer to the following resources:

What is Azure Active Directory? (http://azure.microsoft.com/en-us/

documentation/articles/active-directory-whatis/)
Manage Azure AD using Windows PowerShell (http://msdn.microsoft.

com/en-us/library/azure/jj151815.aspx)

The Connect-MsolService cmdlet (http://msdn.microsoft.com/en-us/

library/azure/dn194123.aspx)

Creating a new Azure Active Directory

domain
Each new Azure account includes a Default Directory with a default domain
(for instance, azure.onmicrosoft.com) that contains the Microsoft account that
created the Azure account. While the default domain might be sufficient for small
organizations or organizations that do not use Azure Active Directory for their
user authentication and authorization, larger organizations and organizations that
rely heavily on Azure Active Directory will want to create a new Active Directory
domain and customize it based on their needs.
Active Directory domains are assigned with fully qualified domain names. This
provides a mechanism to find the domain within a network as well as to identify
computers and so on within the domain. In a private network, Active Directory can
work with a DNS server (domain name server) to ensure the domain name points
to the Active Directory domain controllers (servers). However, with an Azure
Active Directory domain, a public domain name from a registrar is required and
the DNS settings for the domain are manually configured. In many organizations,
a single group in the organization manages public domain names. DNS settings
would have to be coordinated with this group. For other organizations or simple
testing environments, a domain name will need to be purchased from GoDaddy.
com, Name.com, or NetworkSolutions.com.

[ 107 ]

Managing Azure Active Directory with PowerShell

Before you continue, ensure that you are connected to Azure Active
Directory in a PowerShell session, as outlined in the Connecting to
Azure Active Directory section.

In this tutorial, we will use PowerShell to create a new Azure Active Directory
domain in the default directory. However, we will not cover how to configure the
DNS settings. Microsoft has provided instructions on how to configure the DNS
settings at various registrars on MSDN (http://msdn.microsoft.com/library/
azure/jj151803.aspx#BKMK_cname). To create a new Azure Active Directory
domain in the default directory, follow these steps:
1. Use the New-MsolDomain cmdlet to create a new Active Directory domain
and assign it to a PowerShell variable. The name provided should be in the
form of a fully qualified domain name (FQDN). It should match the domain
name purchased from a registrar or should be provided by the group in the
organization that manages public domain names:
PS C:\> $domain = New-MsolDomain Name PowerShell.local

2. Enter the variable and press Enter. The variable can be used to retrieve
information about the new domain or to configure it:
PS C:\> $domain

3. Use the Get-MsolDomainVerificationDns cmdlet to retrieve the label

to be used when updating the DNS settings of the domain name:
PS C:\> Get-MsolDomainVerificationDns -DomainName
PowerShell.local
[ 108 ]

Chapter 9

4. Use the label for the domain to add a TXT or MX record to the DNS settings
for the domain name. In the sample used for the screenshots, the TXT record
will be ms43896406, and the MX record will be ms43896406.msv1.invalid.
Microsoft provides instructions to update the DNS records at many of the
common domain name registrars on MSDN at http://msdn.microsoft.
com/library/azure/jj151803.aspx#BKMK_cname.
Once DNS records are updated, it can take up to 48 hours for
them to propagate.

5. Once the DNS records for the domain are configured, use the ConfirmMsolDomain cmdlet to process the verification of the domain:
PS C:\> Confirm-MsolDomain -DomainName PowerShell.local

For more information about verifying domain names and the cmdlets used in this
section, refer to the following resources:

The New-MsolDomain cmdlet (http://msdn.microsoft.com/en-us/

library/azure/dn194081.aspx)
Verify a domain at any domain name registrar (http://msdn.microsoft.

com/library/azure/jj151803.aspx)

The Confirm-MsolDomain cmdlet (http://msdn.microsoft.com/en-us/

library/azure/dn194117.aspx)

[ 109 ]

Managing Azure Active Directory with PowerShell

Configuring an Azure Active Directory

domain
Once an Active Directory domain is created in Azure, there are a few options that
can be configured for the domain. These options include converting to and from a
federated domain, authentication settings, and password policy options.
Before you continue, ensure that you are connected to Azure Active
Directory in a PowerShell session, as outlined in the Connecting to
Azure Active Directory section.

In this tutorial, we will configure the password policy for the domain that we
created in the Creating a new Azure Active Directory domain section. The password
policy includes two options: NotificationDays and ValidityPeriod. The
NotificationDays option sets how many calendar days the password change
notification should be sent before the password expires, and the ValidityPeriod
option sets how many calendar days the passwords are valid for. To configure the
password policy for the domain, follow these steps:
1. Use the Get-MsolPasswordPolicy cmdlet to view the current password
policy settings. By default, nothing will be set for the NotificationDays
and ValidityPeriod values:
PS C:\> Get-MsolPasswordPolicy -DomainName PowerShell.local

2. Use the Set-MsolPasswordPolicy cmdlet to set the password policy settings:

PS C:\> Set-MsolPasswordPolicy -DomainName PowerShell.local NotificationDays 14 -ValidityPeriod 90

For more information about the cmdlets used in this section, use the Get-Help
cmdlet in PowerShell, or refer to the following resources:

The Get-MsolPasswordPolicy cmdlet (http://msdn.microsoft.com/enus/library/azure/dn169219.aspx)

The Set-MsolPasswordPolicy cmdlet (http://msdn.microsoft.com/enus/library/azure/dn169224.aspx)

[ 110 ]

Chapter 9

Managing Azure Active Directory users

and groups
Active Directory can be used to manage a wide variety of objects, such as computers,
users, contacts, and printers. Of all these objects, users and groups are the most
commonly used. A user in Active Directory typically represents a person (or service
accounts used by other applications) and provides a mechanism to store personal
data about this person. A group in Active Directory can have users or other groups
as members, but does not actually contain them and does not provide hierarchal
organization to the domain; organizational units (OUs) provide hierarchal
organization. Groups can have policies, authorization, and so on assigned to them
that are inherited by the members in the group.
To illustrate how groups and users relate to each other, consider the following aspects:

We have three groups: Services, Support, and Development

We have two users: John and Jane

The membership of each group is as follows:

Services: Support

Support: John

Development: Jane

The Services group provides access to the Services file share, and the
Development group provides access to the Development file share

In this example, Jane has access to the Development file share as she is a member
of the Development group. In addition, John has access to the Services file share
because he is a member of the Support group that is a member of the Services group.
For more information about how Active Directory domains are structured, refer to
http://en.wikipedia.org/wiki/Active_Directory.
Before you continue, ensure that you are connected to Azure Active
Directory in a PowerShell session, as outlined in the Connecting to
Azure Active Directory section.

[ 111 ]

Managing Azure Active Directory with PowerShell

For this tutorial, we will create users and groups (described in the preceding example).
In addition, we will assign group membership. To do this, follow these steps:
1. Use the New-MsolUser cmdlet to create a user account for Jane and John and
assign them to variables. The username must include the domain name, for
example, [email protected], as shown here:
PS C:\> $jane = New-MsolUser -UserPrincipalName
"[email protected]" -DisplayName "Jane" -Password
"P@assword1234~"
PS C:\> $john = New-MsolUser -UserPrincipalName
"[email protected]" -DisplayName "John" -Password
"P@assword1234~"

2. Use the New-MsolGroup cmdlet to create a group for Support, Services,

and Development and assign them to variables:
PS C:\> $services = New-MsolGroup -DisplayName "Services"
PS C:\> $support = New-MsolGroup -DisplayName "Support"
PS C:\> $development = New-MsolGroup -DisplayName
"Development"

3. Use the Add-MsolGroupMember cmdlet to add Jane to the members of

Development and John to the members of Support. In addition, assign
Support to the members of Services:
PS C:\> Add-MsolGroupMember -GroupObjectId
$development.ObjectId -GroupMemberObjectId $jane.ObjectId
PS C:\> Add-MsolGroupMember -GroupObjectId $support.ObjectId GroupMemberObjectId $john.ObjectId
PS C:\> Add-MsolGroupMember -GroupObjectId $services.ObjectId
-GroupMemberObjectId $support.ObjectId -GroupMemberType Group

4. Use the Get-MsolGroupMember cmdlet to view the membership of each group:

PS C:\> Get-MsolGroupMember -GroupObjectId $services.ObjectId

Users and groups in Azure Active Directory have a number of properties that can be
set with PowerShell. Updating these properties can be done using the Set-MsolUser
and Set-MsolGroup cmdlets (for example, PS C:\> Set-MsolUser -ObjectId
$jane.ObjectId -City "London").
For more information about Active Directory and the cmdlets used in this section,
refer to the following resources:

Active Directory (http://en.wikipedia.org/wiki/Active_Directory)

The New-MsolUser cmdlet (http://msdn.microsoft.com/en-us/library/
azure/dn194096.aspx)
[ 112 ]

Chapter 9

The New-MsolGroup cmdlet (http://msdn.microsoft.com/en-us/

library/azure/dn194083.aspx)
The Set-MsolUser cmdlet (http://msdn.microsoft.com/en-us/library/
azure/dn194136.aspx)
The Set-MsolGroup cmdlet (http://msdn.microsoft.com/en-us/
library/azure/dn194086.aspx)
The Add-MsolGroupMember cmdlet (http://msdn.microsoft.com/en-us/
library/azure/dn194129.aspx)
The Get-MsolGroupMember cmdlet (http://msdn.microsoft.com/en-us/
library/azure/dn194085.aspx)

Using PowerShell to bulk import users

and groups into Azure Active Directory
While running one-off commands in PowerShell can be useful, managing Azure
Active Directory with PowerShell really comes into its own when scripting large
amounts of tedious tasks. With PowerShell, we can complete a process in a few
minutes that might take hours or days for a human to complete manually.
Imagine a medium-sized company with about 1,000 users. The company's human
resources system has details (such as names and contact information exported to a
spreadsheet in CSV format). The company implements Azure services as part of the
company infrastructure and needs to create a user account in Azure Active Directory
for each user. Someone could take days to complete it manually in the web interface
but, with PowerShell, this can be done in just a few minutes.
Before you continue, ensure that you are connected to Azure Active
Directory in a PowerShell session, as outlined in the Connecting to
Azure Active Directory section.

In this tutorial, we will create a .csv file with some user details, and we will use this
data to create users in Azure Active Directory with PowerShell. To do this, follow
these steps:
1. Create a .csv file with data that looks like the following code snippet:
"Username","Password","DisplayName","City"
"[email protected]","P@ssword1234~","Rose","London"
"[email protected]","P@ssword1234~","Jose","London"
"[email protected]","P@ssword1234~","Pierre","London"
"[email protected]","P@ssword1234~","Diego","London"
"[email protected]","P@ssword1234~","Sherlock","London"
[ 113 ]

Managing Azure Active Directory with PowerShell

You can create the .csv file with any plain text editor (such as
Notepad) or spreadsheet software (such as Microsoft Excel).

2. Use the Import-Csv cmdlet to import the user data from the .csv file
to a PowerShell object:
PS C:\> $users = Import-Csv C:\Files\Users.csv

3. Use the ForEach-Object and New-MsolUser cmdlets to enumerate each user

in the imported data and create the user account:
PS C:\> $users | ForEach-Object { New-MsolUser UserPrincipalName $_.Username -Password $_.Password DisplayName $_.DisplayName -City $_.City }

[ 114 ]

Chapter 9

For more information about the cmdlets used in this section, use the Get-Help
cmdlet in PowerShell, or refer to the following resources:

The Import-Csv cmdlet (http://technet.microsoft.com/en-us/

library/hh849891.aspx)

The ForEach-Object cmdlet (http://technet.microsoft.com/en-us/

library/hh849731.aspx)

The New-MsolUser cmdlet (http://msdn.microsoft.com/en-us/library/

azure/dn194096.aspx)

Summary
Azure Active Directory offers a myriad of features and services for Azure customers.
In this chapter, we covered the basics of how to manage Azure Active Directory
from PowerShell and showcased an example where PowerShell automation can save
administrators time and effort. Using these techniques and ideas, many mundane
and repetitive tasks can be automated to allow administrators to focus on more
important tasks.
In the next chapter, we will explore how to automate Microsoft Azure tasks in
PowerShell using runbooks and automation cmdlets.

[ 115 ]

Get more information Automating Microsoft Azure with PowerShell

Where to buy this book

You can buy Automating Microsoft Azure with PowerShell from the
Packt Publishing website.
Alternatively, you can buy the book from Amazon, BN.com, Computer Manuals and most internet
book retailers.
Click here for ordering and shipping details.

www.PacktPub.com

Stay Connected: