Changes for page Veeam Backup Restore

Summary

• Attachments (0 modified, 1 added, 0 removed)
  • Connect-VB365RestorePortal.ps1

Details

Connect-VB365RestorePortal.ps1

Author

...	...	@@ -1,0 +1,1 @@
	1	+XWiki.drupp

Size

...	...	@@ -1,0 +1,1 @@
	1	+5.7 KB

Content

...	...	@@ -1,0 +1,149 @@
	1	+##### Service Provider Configuration Area #####
	2	+# Modify the variable below to match your Enterprise Application ID
	3	+$applicationId = "09b57c6a-d506-4958-86dc-7cd28014bb05"
	4	+##### Warning: Do not edit the lines below #####
	5	+
	6	+function Connect-VB365RestorePortal {
	7	+ <#
	8	+.SYNOPSIS
	9	+ Enables a Microsoft 365 environment to use a Service Provider's Restore Portal.
	10	+
	11	+.DESCRIPTION
	12	+ The script logs in to a tenant Microsoft 365 environment and grants the required permissions so the tenant can leverage a service provider's Veeam Backup for Microsoft 365 Restore Portal.
	13	+
	14	+.PARAMETER ApplicationId
	15	+ Service Provider (Enterprise Application) Application ID. THIS IS PROVIDED BY YOUR SERVICE PROVIDER.
	16	+
	17	+.OUTPUTS
	18	+ Connect-VB365RestorePortal returns string output to guide the user
	19	+
	20	+.EXAMPLE
	21	+ Connect-VB365RestorePortal -ApplicationId 58a0f8e1-97bd-4804-ba69-bde1db293223
	22	+
	23	+ Description
	24	+ -----------
	25	+ Connects a Microsoft 365 environment to the specified (Enterprise Application) Application ID
	26	+
	27	+.EXAMPLE
	28	+ Connect-VB365RestorePortal -ApplicationId 58a0f8e1-97bd-4804-ba69-bde1db293223 -Verbose
	29	+
	30	+ Description
	31	+ -----------
	32	+ Verbose output is supported
	33	+
	34	+.NOTES
	35	+ NAME: Connect-VB365RestorePortal
	36	+ VERSION: 1.0
	37	+ AUTHOR: Chris Arceneaux
	38	+ TWITTER: @chris_arceneaux
	39	+ GITHUB: https://github.com/carceneaux
	40	+
	41	+.LINK
	42	+ https://helpcenter.veeam.com/docs/vbo365/guide/ssp_configuration.html
	43	+
	44	+.LINK
	45	+ https://helpcenter.veeam.com/docs/vbo365/guide/ssp_ad_application_permissions.html
	46	+
	47	+.LINK
	48	+ https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadserviceprincipal
	49	+
	50	+.LINK
	51	+ https://f12.hu/2021/01/13/grant-admin-consent-to-an-azuread-application-via-powershell/
	52	+
	53	+.LINK
	54	+ https://arsano.ninja/
	55	+
	56	+#>
	57	+
	58	+ [CmdletBinding()]
	59	+ param(
	60	+ [Parameter(Mandatory = $true)]
	61	+ [string]$ApplicationId
	62	+ )
	63	+
	64	+ # connecting to all things Microsoft
	65	+ try {
	66	+ Write-Verbose "Connecting to Microsoft Azure account"
	67	+ Connect-AzAccount -ErrorAction Stop | Out-Null
	68	+ $context = Get-AzContext
	69	+ Write-Verbose "Connecting to Azure AD account"
	70	+ Connect-AzureAD -TenantId $context.Tenant.TenantId -AccountId $context.Account.Id -ErrorAction Stop | Out-Null
	71	+ Write-Host "$($context.Account.Id) is now connected to Microsoft Azure" -ForegroundColor Green
	72	+ }
	73	+ catch {
	74	+ Write-Error "An issue occurred while logging into Microsoft. Please double-check your credentials and ensure you have sufficient access."
	75	+ throw $_
	76	+ }
	77	+
	78	+ # check if Enterprise Application already exists
	79	+ $sp = Get-AzureADServicePrincipal -Filter "AppId eq '$ApplicationId'"
	80	+ if ($sp) {
	81	+ Write-Verbose "Enterprise Application ($ApplicationId) already exists"
	82	+ }
	83	+ else {
	84	+ # creating link to Service Provider Enterprise Application
	85	+ try {
	86	+ Write-Verbose "Creating new Azure AD Service Principal"
	87	+ $sp = New-AzureADServicePrincipal -AppId $ApplicationId -ErrorAction Stop
	88	+ Write-Host "$($sp.DisplayName) ($($sp.AppId)) has been linked your account" -ForegroundColor Green
	89	+ }
	90	+ catch {
	91	+ Write-Error "An unexpected error occurred while linking the Enterprise Application to your account."
	92	+ throw $_
	93	+ }
	94	+ }
	95	+
	96	+ # granting admin consent
	97	+ $token = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.TenantId, $null, "Never", $null, "74658136-14ec-4630-ad9b-26e160ff0fc6")
	98	+ $headers = @{
	99	+ 'Authorization' = 'Bearer ' + $token.AccessToken
	100	+ 'X-Requested-With' = 'XMLHttpRequest'
	101	+ 'x-ms-client-request-id' = New-Guid
	102	+ 'x-ms-correlation-id' = New-Guid
	103	+ }
	104	+ $url = "https://main.iam.ad.ext.azure.com/api/RegisteredApplications/$($sp.AppId)/Consent?onBehalfOfAll=true"
	105	+ Write-Verbose "Granting admin consent to the newly linked Azure AD Service Principal"
	106	+
	107	+ # loop waiting for change to actually take place
	108	+ while ($true) {
	109	+ try {
	110	+ Invoke-RestMethod -Uri $url -Headers $headers -Method POST -ErrorAction Stop | Out-Null
	111	+ break
	112	+ }
	113	+ catch {
	114	+ Write-Host "Waiting to grant admin consent... (this can take up to 15 minutes)"
	115	+ Write-Verbose "Error: $_"
	116	+ Start-Sleep -Seconds 5
	117	+ }
	118	+ }
	119	+ Write-Host "$($sp.DisplayName) ($($sp.AppId)) has been granted admin consent" -ForegroundColor Green
	120	+ Write-Host "You can now login to the Service Provider's VB365 Restore Portal!" -ForegroundColor Green
	121	+ Write-Warning "If you receive an error, wait 15 minutes and attempt login again."
	122	+
	123	+ # logging out of remote sessions
	124	+ Write-Verbose "Logging out of Azure AD account"
	125	+ Disconnect-AzureAD | Out-Null
	126	+ Write-Verbose "Logging out of Microsoft Azure account"
	127	+ Disconnect-AzAccount | Out-Null
	128	+}
	129	+
	130	+Write-Host "Installing required Azure PowerShell modules...Az.Accounts & AzureAd"
	131	+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
	132	+Find-PackageProvider -Name Nuget -ForceBootstrap -IncludeDependencies -Force | Out-Null
	133	+# Determine if Az.Account module is already present
	134	+if ( -not(Get-Module -ListAvailable -Name Az.Accounts)){
	135	+ Install-Module -Name Az.Accounts -SkipPublisherCheck -Force -ErrorAction Stop
	136	+ Write-Host "Az.Accounts module installed successfully" -ForegroundColor Green
	137	+} else {
	138	+ Write-Host "Az.Accounts module already present" -ForegroundColor Green
	139	+}
	140	+# Determine if AzureAd module is already present
	141	+if ( -not(Get-Module -ListAvailable -Name AzureAd)){
	142	+ Install-Module -Name AzureAD -SkipPublisherCheck -Force -ErrorAction Stop
	143	+ Write-Host "AzureAD module installed successfully" -ForegroundColor Green
	144	+} else {
	145	+ Write-Host "AzureAD module already present" -ForegroundColor Green
	146	+}
	147	+
	148	+Connect-VB365RestorePortal -ApplicationId $applicationId
	149	+#Connect-VB365RestorePortal -ApplicationId $applicationId -Verbose