Analyze Entra ID policies with Teleport Policy

# Connect to Microsoft Graph with the required scopes for directory and app role assignment permissions.
Connect-MgGraph -Scopes 'Directory.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All'

# Retrieve the managed identity's service principal object using its unique principal ID (UUID).
$managedIdentity = Get-MgServicePrincipal -ServicePrincipalId 'Principal ID'

# Set the Microsoft Graph enterprise application object. 
# This is a service principal object representing Microsoft Graph in Azure AD with a specific app ID.
$graphSPN = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"

# Define the permission scopes that we want to assign to the managed identity.
# These are Microsoft Graph API permissions required by the managed identity.
$permissions = @(
  "Application.Read.All"   # Permission to read applications in the directory
  "Directory.Read.All"     # Permission to read directory data
  "Policy.Read.All"        # Permission to read policies within the directory
)

# Filter and find the app roles in the Microsoft Graph service principal that match the defined permissions.
# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
$appRoles = $graphSPN.AppRoles |
    Where-Object Value -in $permissions |
    Where-Object AllowedMemberTypes -contains "Application"

# Iterate over each app role to assign it to the managed identity.
foreach ($appRole in $appRoles) {
    # Define the parameters for the role assignment, including the managed identity's principal ID, 
    # the Microsoft Graph service principal's resource ID, and the specific app role ID.
    $bodyParam = @{
        PrincipalId = $managedIdentity.Id  # The ID of the managed identity (service principal)
        ResourceId  = $graphSPN.Id         # The ID of the Microsoft Graph service principal
        AppRoleId   = $appRole.Id          # The ID of the app role being assigned
    }

    # Create a new app role assignment for the managed identity, granting it the specified permissions.
    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentity.Id -BodyParameter $bodyParam
}

# Connect to Microsoft Graph with the required scopes for directory and app role assignment permissions.
Connect-MgGraph -Scopes 'Directory.ReadWrite.All', 'AppRoleAssignment.ReadWrite.All'

# Retrieve the managed identity's service principal object using its unique principal ID (UUID).
$managedIdentity = Get-MgServicePrincipal -ServicePrincipalId 'Principal ID'

# Set the Microsoft Graph enterprise application object. 
# This is a service principal object representing Microsoft Graph in Azure AD with a specific app ID.
$graphSPN = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"

# Define the permission scopes that we want to assign to the managed identity.
# These are Microsoft Graph API permissions required by the managed identity.
$permissions = @(
  "Application.Read.All"   # Permission to read applications in the directory
  "Directory.Read.All"     # Permission to read directory data
  "Policy.Read.All"        # Permission to read policies within the directory
)

# Filter and find the app roles in the Microsoft Graph service principal that match the defined permissions.
# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
$appRoles = $graphSPN.AppRoles |
    Where-Object Value -in $permissions |
    Where-Object AllowedMemberTypes -contains "Application"

# Iterate over each app role to assign it to the managed identity.
foreach ($appRole in $appRoles) {
    # Define the parameters for the role assignment, including the managed identity's principal ID, 
    # the Microsoft Graph service principal's resource ID, and the specific app role ID.
    $bodyParam = @{
        PrincipalId = $managedIdentity.Id  # The ID of the managed identity (service principal)
        ResourceId  = $graphSPN.Id         # The ID of the Microsoft Graph service principal
        AppRoleId   = $appRole.Id          # The ID of the app role being assigned
    }

    # Create a new app role assignment for the managed identity, granting it the specified permissions.
    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentity.Id -BodyParameter $bodyParam
}

# Connect to Microsoft Graph with required scopes for application creation and app role assignment permissions.
Connect-MgGraph -Scopes "Application.ReadWrite.All", "AppRoleAssignment.ReadWrite.All"

# Import the Microsoft Graph module for managing applications.
Import-Module Microsoft.Graph.Applications

# Define application parameters, including the display name.
$params = @{
	displayName = 'Application name'  # Set the display name of the new application.
}

# Set the SAML application template ID.
# This ID corresponds to a non-gallery SAML application template.
$applicationTemplateId = "8adf8e6e-67b2-4cf2-a259-e3dc5476c621"

# Instantiate the application template to create a new application and its service principal.
$app = Invoke-MgInstantiateApplicationTemplate -ApplicationTemplateId $applicationTemplateId -BodyParameter $params

# Extract the Application ID, Object ID, and Service Principal ID of the newly created application.
$appId = $app.Application.AppId       # The unique identifier for the application (client ID).
$objectId = $app.Application.Id       # The unique object ID for the application in Azure AD.
$servicePrincipal = $app.ServicePrincipal.Id  # The unique object ID for the service principal.

# Define parameters for the token signing certificate used for SAML.
$principalTokenSigningCertificateParams = @{
	displayName = "CN=azure-sso"  # Common Name (CN) for the SAML token signing certificate.
}

# Add a token signing certificate to the service principal, which is required for SAML authentication.
$cert = Add-MgServicePrincipalTokenSigningCertificate -ServicePrincipalId $servicePrincipal -BodyParameter $principalTokenSigningCertificateParams

# Extract the thumbprint of the certificate, which will be used to configure SAML.
$thumbprint = $cert.Thumbprint

# Set additional SAML-specific properties for the service principal.
$updateServicePrincipalParams = @{
	preferredSingleSignOnMode = "saml"                    # Set SAML as the single sign-on mode.
	preferredTokenSigningKeyThumbprint = $thumbprint      # Use the thumbprint of the added certificate for token signing.
	appRoleAssignmentRequired = $false                    # Allow app access without explicit app role assignments.
}

# Update the service principal with the SAML configuration.
Update-MgServicePrincipal -ServicePrincipalId $servicePrincipal -BodyParameter $updateServicePrincipalParams

# Define the URL for the proxy (Teleport Auth Service address).
# This URL will be used as the Redirect URI and Identifier URI.
$proxyURL = 'https://example.teleport.sh:443'.TrimEnd("/").TrimEnd(":443")  # Remove the default 443 port for standard formatting.
$acsURL = $proxyURL+'/v1/webapi/saml/acs/Auth Connector Name'

# Define web properties, including the redirect URI for SAML authentication.
$web = @{
	redirectUris = @($acsURL)  # Set the application's redirect URI.
}

# Update the application with the web properties and identifier URI.
# This enables SAML-based authentication and includes security group claims.
Update-MgApplication -ApplicationId $objectId -Web $web -IdentifierUris @($acsURL)
# Define optional claims for the application to include group membership claims.
$optionalClaims = [Microsoft.Graph.PowerShell.Models.MicrosoftGraphOptionalClaims]::DeserializeFromDictionary(@{
	AccessToken = @(
      @{ Name = 'groups' }
   )
   IdToken = @(
	  @{ Name = 'groups' }
   )
   Saml2Token = @(
      @{ Name = 'groups' }
   )
})

Update-MgApplication -ApplicationId $objectId -GroupMembershipClaims "SecurityGroup" -OptionalClaims $optionalClaims


# Retrieve the tenant ID for display purposes.
$tenant = Get-AzTenant

# Output the Application ID, Tenant ID, and additional information for reference.
Write-Output "-------------------------------------------------------" "Copy and paste the following details:" "Application ID (Client ID): $appId" "Tenant ID: $tenant" "-------------------------------------------------------"

# Define the subject for the federated identity credential. This is a constant defined in Teleport.
$subject = "teleport-azure"

# Define the accepted audiences for the credential. It's a constant value.
$audiences = @("api://AzureADTokenExchange")

# Set the issuer to the Teleport cluster proxy URL. 
$issuer = $proxyURL

# Define a unique name for the federated identity credential. This name is used for identification within the application.
$name = "teleport-oidc"

# Create a new federated identity credential for the application in Microsoft Graph.
$credential = New-MgApplicationFederatedIdentityCredential -ApplicationId $objectId -Subject $subject -Audiences $audiences -Issuer $issuer -Name $name


# Configure the required permissions for the application.

# Retrieve the managed identity's service principal object using its unique principal ID (UUID).
$managedIdentity = Get-MgServicePrincipal -ServicePrincipalId $servicePrincipal


# Set the Microsoft Graph enterprise application object. 
# This is a service principal object representing Microsoft Graph in Azure AD with a specific app ID.
$graphSPN = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'"

# Define the permission scopes that we want to assign to the managed identity.
# These are Microsoft Graph API permissions required by the managed identity.
$permissions = @(
  "Application.Read.All"   # Permission to read applications in the directory
  "Directory.Read.All"     # Permission to read directory data
  "Policy.Read.All"        # Permission to read policies within the directory
)

# Filter and find the app roles in the Microsoft Graph service principal that match the defined permissions.
# Only include roles where "AllowedMemberTypes" includes "Application" (suitable for managed identities).
$appRoles = $graphSPN.AppRoles |
    Where-Object Value -in $permissions |
    Where-Object AllowedMemberTypes -contains "Application"

# Iterate over each app role to assign it to the managed identity.
foreach ($appRole in $appRoles) {
    # Define the parameters for the role assignment, including the managed identity's principal ID, 
    # the Microsoft Graph service principal's resource ID, and the specific app role ID.
    $bodyParam = @{
        PrincipalId = $managedIdentity.Id  # The ID of the managed identity (service principal)
        ResourceId  = $graphSPN.Id         # The ID of the Microsoft Graph service principal
        AppRoleId   = $appRole.Id          # The ID of the app role being assigned
    }

    # Create a new app role assignment for the managed identity, granting it the specified permissions.
    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $managedIdentity.Id -BodyParameter $bodyParam
}