Added script will revoke given Users all AD Access tokens by
using Azure AD PowerShell. Script will utilize sets of PowerShell Functions. When
script is run , it will ask for user instance name, it will then check to make
sure current PS session does have connectivity to O365 tenant, if not it will
ask credentials to authenticate against AzureAD PowerShell. Once this is done
script will also check to make sure user name exist, it will then revoke all
existing fresh AD tokens, Adding script MAP to demonstrate steps by step what
actions are being taken within the script.
Below script can be downloaded from TechNet Scripting center
|
<#
.NOTES
#=============================================
# Script :
Revoke-AzureADUserAllRefreshToken-V2.ps1
# Created : ISE 3.0
# Author(s) : Casey.Dedeal
# Date : 03/01/2020 02:00:56
# Org : ETC Solutions
# File Name : Revoke-AzureADUserAllRefreshToken-V2.ps1
# Comments : Remove all user AzureAD Tokens O365
# Assumptions : O365 Tenant
#==============================================
SYNOPSIS :
Revoke-AzureADUserAllRefreshToken-V2.ps1
DESCRIPTION : Remove all user tokens dues to
security concerns
Acknowledgements : Open license
Limitations : None
Known issues : None
Credits : Please visit:
https://simplepowershell.blogspot.com
https://msazure365.blogspot.com
.EXAMPLE
.\Revoke-AzureADUserAllRefreshToken-V2.ps1
MAP:
-----------
#(1)_.Create a Log folder
#(2)_.Check Folder existence
#(3)_.Timestamp function
#(4)_.Function Connect Azure AD
#(5)_.Attempt to connect AzureAD PowerShell
#(6)_.Capture User Instance Name
#(7)_.Check AzureAD User
#(8)_.Create Custom PS Object store User data
#(9)_.Provide Choice to Start AzureAD Revoke All Fresh Tokens, or
cancel
#(10)_.Revoke AzureAD All Fresh Tokens
#(11)_.Create Custom PS Object store changed User data
#(12)_.Present Results
#>
#(1)_.Create a Log folder
$name
= 'AzureAD-UserToken-Report'
$now
= Get-Date -format 'dd-MMM-yyyy-HH-mm'
$user
= $env:USERNAME
$desFol
= "C:\temp\Reports_\Report-$name\"
$filename
= "$name-$now.CSV"
$file
= $desFol + $filename
#(2)_.Check Folder existance
If (!(Test-Path $desFol))
{
New-Item -ItemType Directory -Force $desFol | Out-Null
}
#(3)_.Timestamp function
function Function-Get-TimeStamp {
return "[{0:MM/dd/yy} {0:HH:mm:ss}]" -f (Get-Date)
}
#(4)_.Function Connect Azure AD
function Function-Connect-AzureAD {
[CmdletBinding()]
param()
try {
$connection = Get-AzureADTenantDetail -ErrorAction Stop
write-host 'Already connected AzureAD PowerShell'
Write-host 'Time:' -NoNewline;
Function-Get-TimeStamp
Write-host $null
}
catch [Microsoft.Open.Azure.AD.CommonLibrary.AadNeedAuthenticationException]{
Write-Host 'You are not connected to AzureAD PowerShell'
write-host 'Connecting AzureAD now' -f DarkCyan
Connect-AzureAD -ErrorAction Stop
}
}
#(5)_.Attempt to connect AzureAD PowerShell
try {
Function-Connect-AzureAD -ErrorAction Stop
}
catch{
Write-host 'ERROR FOUND:'
write-host "ERROR: $($PSItem.ToString())"
}
#(6)_.Capture User Instance Name
Clear-Host
$user = Read-host 'Provide user Instance name'
#(7)_.Check AzureAD User existance
Try{
$Userdata = Get-AzureADUser | ?{$_.DisPlayName -eq $user}
$ObjectId = (Get-AzureADUser | ?{$_.DisPlayName -eq $user}).Objectid
if
($Userdata){
Write-host "Located user ($user)" -f DarkCyan
#(8)_.Create Custom PS Object store User data
$objectProperty = [ordered]@{
DisplayName = $Userdata.DisplayName
UPN = $Userdata.UserPrincipalName
AccStaus = $Userdata.AccountEnabled
TokenRefreshTime = $Userdata.RefreshTokensValidFromDateTime
}
$Results = New-Object -TypeName psobject -Property $objectProperty
$Results | fl
#(9)_.Provide Choice to Start AzureAD
Revoke All Fresh Tokens, or cancel
Read-host 'Press <ENTER> to Revoke all Tokens'
#(10)_.Revoke AzureAD All Fresh Tokens
Revoke-AzureADUserAllRefreshToken -ObjectId $ObjectId
write-host 'Completed succesfully' -ForegroundColor DarkGray
$Userdata = Get-AzureADUser | ?{$_.DisPlayName -eq $user}
$objectProperty = [ordered]@{
DisplayName = $Userdata.DisplayName
UPN = $Userdata.UserPrincipalName
AccStaus = $Userdata.AccountEnabled
TokenRefreshTime = $Userdata.RefreshTokensValidFromDateTime
}
#(11)_.Create Custom PS Object store
changed User data
$Results = New-Object -TypeName psobject -Property $objectProperty
$Results | export-Csv -Path $file -NoTypeInformation -Append
$Results | fl
}else{
Write-host "(a)_.CANNOT Locate user ($user)" -f DarkYellow
Write-host '(b)_.Check user name, and try again' -f DarkYellow
Write-Host '(c)_.Script will stop' -f DarkYellow
break;
}
}catch
{
Write-host 'ERROR FOUND:'
write-host "ERROR: $($PSItem.ToString())"
}
#(12)_.Present Results
write-host 'Default access Token Lifetime expiration is upto <1hr>' -f DarkYellow
write-host '<TokenRefreshTime> value indicates when new token was
issued' -f DarkYellow
Read-host 'Press <ENTER> to open report folder'
start $desFol
|
