AdminAPI.ps1

# This file contains functions utilising https://admin.microsoft.com API

# Approves the delegated admin request
# Sep 22nd 2021
function Approve-MSPartnerDelegatedAdminRequest
{
<#
    .SYNOPSIS
    Assigns Delegated Admin Permissions (DAP) for the given partner organisation.

    .DESCRIPTION
    Assigns Delegated Admin Permissions (DAP) for the given partner organisation.

    .Parameter TenantId
    TenantId of the partner organisation.

    .Parameter Domain
    Any registered domain of the partner organisation.

    .Example
    PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
    PS C:\>Approve-AADIntMSPartnerDelegatedAdminRequest -Domain company.com
    
    responseCode message
    ------------ -------
    success 

    .Example
    PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
    PS C:\>Approve-AADIntMSPartnerDelegatedAdminRequest -TenantId c7e52a77-e461-4f2e-a652-573305414be9
    
    responseCode message
    ------------ -------
    success 
#>
    [cmdletbinding()]
    Param(
        [Parameter(ParameterSetName='TenantId',Mandatory=$True)]
        [guid]$TenantId,
        [Parameter(ParameterSetName='Domain',Mandatory=$True)]
        [String]$Domain,
        [Parameter(Mandatory=$False)]
        [String]$AccessToken
    )
    Process
    {
        if($Domain)
        {
            $TenantId = Get-TenantID -Domain $Domain
        }

        $body = @{
            "authorizeDelegateAdminData" = [ordered]@{
		        "msppId"         = 0
		        "partnerId"      = $TenantId
		        "companyName"    = " "
		        "indirectCSPId"  = ""
		        "userTenantId"   = (Read-Accesstoken $AccessToken).tid
		        "enableDap"      = $true
		        "invitationType" = "Administration"
		        "address"        = $null
		        "roles" = @(
			        "62e90394-69f5-4237-9190-012177145e10" # Global Administrator
			        "729827e3-9c14-49f7-bb1b-9608f156bbb8" # Helpdesk Administrator
                )
		        "userPrincipalName" = $null
	        }

        }

        try
        {
            $response = Invoke-AdminAPI -Method Post -AccessToken $AccessToken -Url "fd/commerceMgmt/partnermanage/partners/csp/delegatedaccess?api-version=2.1" -Body ($body | ConvertTo-Json)
        }
        catch
        {
            Write-Error ($_.ErrorDetails.Message | ConvertFrom-Json).error.message
            return
        }
        
        $response
    }
}

# Gets the list of partners
# Dec 9th 2021
function Get-MSPartners
{
<#
    .SYNOPSIS
    Shows organisation's partners.

    .DESCRIPTION
    Shows organisation's partners using Admin API.

    .Parameter AccessToken
    Access token to retrieve partners.

    .Example
    PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
    PS C:\>Get-AADIntMSPartners
    
    Identity         : b1f6d5cc-f1d3-41d9-b88c-1d177aaf171b
    DisplayName      : Partner Ltd
    Email            : pmanager@company.com
    Website          : http://www.company.com
    Phone            : +1234567890
    Relationship     : Indirect Reseller and Admin
    TypeDetail       : PartnerAdmin
    CanDelete        : False
    CanRemoveDap     : True
    AllDataRetrieved : True
#>
    [cmdletbinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken
    )
    Process
    {
        try
        {
            $response = Invoke-AdminAPI -AccessToken $AccessToken -Url "admin/api/Partners/GetPartners" -Method Post
        }
        catch
        {
            if($_.ErrorDetails.Message)
            {
                throw $_.ErrorDetails.Message
            }
            else
            {
                throw $_.Exception.Message
            }
            return
        }
        
        $response
    }
}

# Returns access token for the requested resource
# Dec 9th 2021
function Get-AccessTokenUsingAdminAPI
{
<#
    .SYNOPSIS
    Gets access token for the requested resource using Admin API.

    .DESCRIPTION
    Gets access token for the requested resource using Admin API.
    The client id of the retuned access token is 00000006-0000-0ff1-ce00-000000000000 (Microsoft Office 365 Portal).

    .Parameter Access
    Some supported type of access token.

    .Parameter TokenType
    The type of the access token to return. Can be one of "PortalAT","BusinessStoreAT"

    .Parameter Resource
    Gets an access token for the given resource. Can be one of "https://management.core.windows.net/","https://graph.microsoft.com/"

    .Example
    PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
    PS C:\>$at = Get-AADIntAccessTokenUsingAdminAPI -TokenType PortalAT

    .Example
    PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
    PS C:\>$at = Get-AADIntAccessTokenUsingAdminAPI -Resource https://management.core.windows.net/

#>
    [cmdletbinding()]
    Param(
        [Parameter(ParameterSetName='Normal',Mandatory=$True)]
        [ValidateSet('PortalAT','BusinessStoreAT')]
        [String]$TokenType,
        [Parameter(ParameterSetName='Resource',Mandatory=$True)]
        [ValidateSet('https://graph.microsoft.com/','https://management.core.windows.net/')]
        [String]$Resource,
        [Parameter(Mandatory=$False)]
        [String]$AccessToken,
        [Parameter(Mandatory=$False)]
        [Microsoft.PowerShell.Commands.WebRequestSession]$WebSession,
        [Parameter(Mandatory=$False)]
        [bool]$SaveToCache=$False
    )
    Process
    {
        if($TokenType)
        {
            $access_token = Invoke-AdminAPI -AccessToken $AccessToken -Url "admin/api/users/getuseraccesstoken?tokenType=$TokenType" -Method Get -WebSession $WebSession
        }
        else
        {
            $access_token = Invoke-AdminAPI -AccessToken $AccessToken -Url "admin/api/users/token" -Method Post -Body "=$Resource"
        }

        if($SaveToCache)
        {
            Add-AccessTokenToCache -AccessToken $access_token
        }
        else
        {
            $access_token
        }
    }
}


# Approves the delegated admin request
# Dec 11th 2021
function Remove-MSPartnerDelegatedAdminRoles
{
<#
    .SYNOPSIS
    Removes Delegated Admin Permissions (DAP) from the given partner organisation.

    .DESCRIPTION
    Removes Delegated Admin Permissions (DAP) from the given partner organisation.

    .Parameter TenantId
    TenantId of the partner organisation.

    .Parameter Domain
    Any registered domain of the partner organisation.

    .Example
    PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
    PS C:\>Remove-AADIntMSPartnerDelegatedAdminRoles -Domain company.com
    
    responseCode message
    ------------ -------
    success 

    .Example
    PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
    PS C:\>Remove-AADIntMSPartnerDelegatedAdminRoles -TenantId c7e52a77-e461-4f2e-a652-573305414be9
    
    responseCode message
    ------------ -------
    success 
#>
    [cmdletbinding()]
    Param(
        [Parameter(ParameterSetName='TenantId',Mandatory=$True)]
        [guid]$TenantId,
        [Parameter(ParameterSetName='Domain',Mandatory=$True)]
        [String]$Domain,
        [Parameter(Mandatory=$False)]
        [String]$AccessToken
    )
    Process
    {
        if($Domain)
        {
            $TenantId = Get-TenantID -Domain $Domain
        }

        try
        {
            $response = Invoke-AdminAPI -Method Delete -AccessToken $AccessToken -Url "fd/commerceMgmt/partnermanage/partners/csp/$TenantId/delegatedaccess?api-version=2.1"
        }
        catch
        {
            Write-Error ($_.ErrorDetails.Message | ConvertFrom-Json).error.message
            return
        }
        
        $response
    }
}

# Returns tenant organisation information 
# Jan 26th 2022
function Get-TenantOrganisationInformation
{
<#
    .SYNOPSIS
    Returns organisation information for the given tenant.

    .DESCRIPTION
    Returns organisation information for the given tenant using commercial API used to get Partner Tenant information.

    .Parameter AccessToken
    Access Token used to fetch information. Can be any standard user of any tenant.

    .Parameter TenantId
    TenantId of the target tenant.

    .Parameter Domain
    Domain name of the target tenant.

    .Example
    PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache

    PS C:\>Get-AADIntTenantOrganisationInformation -Domain "company.com"
    
    TenantId         : 043050e2-7993-416a-ae66-108ab1951612
    CompanyName      : Company Ltd
    StreetAddress    : 10 Wall Street
    ApartmentOrSuite : 666
    City             : New York
    StateOrProvince  : NY
    PostalCode       : 10005
    CountryCode      : US
    PhoneNumber      : 1234567890
    FirstName        : John
    LastName         : Doe
#>
    Param(
        [Parameter(Mandatory=$False)]
        [String]$AccessToken,
        [Parameter(ParameterSetName='Domain',Mandatory=$True)]
        [String]$Domain,
        [Parameter(ParameterSetName='TenantId',Mandatory=$True)]
        [guid]$TenantId
    )
    Process
    {
        # Get from cache if not provided
        $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://admin.microsoft.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c"

        if($Domain)
        {
            [guid]$TenantId = [guid](Get-TenantID -Domain $Domain)
        }

        if($TenantId -eq ([guid](Read-AccessToken $AccessToken).tid))
        {
            Write-Error "Can't query information from your own tenant. Log in to another tenant and try again."
            return
        }

        $headers = @{
            "Authorization" = "Bearer $AccessToken"
            "Accept" = "application/json; charset=utf-8"
        }
        $response = Invoke-WebRequest -UseBasicParsing -uri "https://admin.microsoft.com/fd/commerceMgmt/partnermanage/partners/csp/$($TenantId.toString())/delegatedaccess?invType=Administration&api-version=2.1" -Headers $headers

        # Content is utf-8 encoded json, but response headers don't have encoding information
        $responseBytes = New-Object byte[] $response.RawContentLength
        $response.RawContentStream.Read($responseBytes,0,$response.RawContentLength)
        $responseObj = ConvertFrom-Json -InputObject ([text.encoding]::UTF8.GetString($responseBytes))
        
        $tenantInfo = $responseObj.authorizeDelegateAdminData

        $attributes = [ordered]@{
            "TenantId"         = $tenantInfo.partnerId
            "CompanyName"      = $tenantInfo.companyName
            "StreetAddress"    = $tenantInfo.address.line1
            "ApartmentOrSuite" = $tenantInfo.address.line2
            #"Line3"            = $tenantInfo.address.line3
            "City"             = $tenantInfo.address.city
            "StateOrProvince"  = $tenantInfo.address.state
            "PostalCode"       = $tenantInfo.address.postalCode
            "CountryCode"      = $tenantInfo.address.countryCode
            "PhoneNumber"      = $tenantInfo.address.phoneNumber
            "FirstName"        = $tenantInfo.address.firstName
            "LastName"         = $tenantInfo.address.lastName
        }

        New-Object psobject -Property $attributes
    }
}