>> Hi. Welcome to Microsoft Build 2018.
I'm Jeff Sakowicz, a Program Manager on Microsoft Graph.
In this video, I'll show you how you
can use Microsoft Graph to build
custom workflows to help automate
User and Group Management and Azure Active Directory.
I'll start by explaining what
Microsoft Graph is to help give you some context.
Then I'll go over some useful Azure AD data
that's exposed in Microsoft Graph.
Finally, I'll show you how you can use it to build
powerful workflows and automate
complex business processes.
So, what is Microsoft Graph?
If I were to give it a textbook definition,
I would say that it's a unified REST API,
and comprehensive developer experience for integrating
with the data and intelligence
exposed by Microsoft services.
But what does this actually mean?
Microsoft Graph is your one stop shop for accessing data,
relationships and insights across Microsoft 365.
It's a REST API that lets you build rich applications,
by integrating with services that are used
by over 100 million active users.
These services include Azure Active Directory,
SharePoint,
OneDrive, OutLook, Teams, Intune, Windows and more.
There's also some exciting new security APIs,
and even APIs built specifically for the education space.
All in all, there are over eight trillion resources
available on Microsoft Graph.
Line of business developers can use
Microsoft Graph to build Apps that
work inside their organizations.
ISVs can use it to build SaaS apps for their customers.
But it's not just for developers,
IT admins and other power users can leverage
Microsoft Graph using tools like Azure Functions Flow,
PowerApps, PowerShell and Graph Explorer.
Now, lets talk about Azure Active Directory.
This is the identity and access management service,
and directory that's used by
every organization in Office 365 and Azure.
Over 15 million organizations
with one billion users use it,
including 90 percent of Fortune 500 companies.
There are also nearly half a million third-party Apps
integrated with Azure AD today.
There's a lot of useful Azure AD data
that's exposed to Microsoft Graph.
This includes user profiles, groups,
including group membership information
and APIs for checking group enroll membership,
organization details, role information,
such as directory roles
and privilege identity management.
There's also APIs to facilitate
B2B collaboration using our Invitation Manager,
there's Domains, Applications, Administrative Units,
Devices, Synchronization tasks, and more.
Hopefully, this is sparking some
ideas for how you can use
Microsoft Graph to integrate
Azure AD with your applications.
A few examples of things you can build include,
user onboarding and provisioning apps,
group management and compliance tools,
custom business workflows, automated security runbooks.
By the way, all of this is done securely,
since Microsoft Graph honors conditional access policies,
and all the other awesome security
functionality of the underlying Azure AD platform.
Now, we'll dig into a few specific workflows,
and I'll show you some examples of the calls that could
be made to Microsoft Graph for each scenario.
Imagine that your company,
or one of your customers companies has a series of
standard onboarding steps that
occur every time a new user is hired.
Instead of having a human walk
through those steps manually,
wouldn't it be nice if this process could be
automated and that person's time can be freed up?
Microsoft Graph can help.
So, first things first.
When the new hire comes in,
you can create a user object by
posting to this /users endpoint,
and set some basic attributes for that person.
You can also assign them some licenses,
set their manager, and set up a device,
seeking provision of a mobile device,
and then you can mark that user the owner of the device,
and then you could follow up to this by
registering that device to Intune,
with Intune, setting up some device policies,
conditional access policies, that are based
on that device, so on and so forth.
You can also authorize the user to have
access to certain resources that
they get access to by being a member of certain groups,
and you could have some
business logic in the background of
this App that automatically assigns people to groups,
based on what department they're
in or who their manager is,
and you could also have
some automatic role assignment happen.
If this person is a member of the help-desk,
you might want to assign them to a limited admin role,
or they might be a global admin as well.
Now, imagine that the same person
who was previously manually onboarding new employees,
also needed to do something
similar anytime a user change departments.
Let's take a look at what Microsoft Graph
can do to help you too and again,
we'll go through some pseudo REST calls.
So, first things first.
Microsoft Graph can help you
update the user's department by patching the user object,
and then you can go ahead
and get the user's current manager,
and you'll see why we got this later.
So, we're going to store that for now,
and then we're going to set the new manager.
Now, in the background, this App,
or a dedicated App that's tracking changes to users,
could monitor for this sort of
department change and then
take a set of automated steps when that happens.
So, you're going to use Delta query for this,
which is our change tracking API.
When Delta query tells you
that a department change has happened,
you can go ahead and remove
the user from any groups that were giving them
access to resources they should no longer have access to,
and then add them to some newsgroups,
and possibly add them to roles.
If they weren't an admin before,
maybe they are now,
so you can add them to a directory role.
Now, you can take this a step further,
and actually start to save time
for the user and their manager,
and make things more efficient for everybody involved,
by doing some automation around
the hand-off of their work to somebody on their old team.
So, you can use some Insights APIs
to see what the user is working on,
look at the tasks that have been assigned
to them in planner,
and then you can use all this information,
bundle it up and create
an e-mail that goes out to the user's old manager,
new manager, and possibly
somebody taking over their work,
with a nice itemized list of
tasks that have links to detailed plans and
planner to let people know
what the user was on point for,
that's still in progress,
and make sure nothing gets dropped on the floor.
Now, there's an additional
enhancement that you could make
to both of the workflows that we talked about previously.
As you likely know, it's
good security hygiene to make sure that there
is as few persistent administrators
in the organization as possible.
Ideally, people would request
admin access just in time, only as needed,
and then they would be demoted
from being an admin as soon as they're
done with whatever task requires that level of access.
As you might already know,
Privilege Identity Management or
PIM is super useful for this today.
PIM exposes a series of APIs in
Microsoft Graph that can help you automate this process,
and build PIM powered workflows directly
into your existing Apps and new Apps you're building.
So, instead of adding someone
persistently to a directory role
with the call you can see right now,
you could use PIM to add them as
a candidate for a role and they
could request that just in time,
and they could be demoted from
the role when they're done with whatever their task is,
and this could be super helpful, for example,
to build Inline to a help-desk App,
and where people occasionally
need to do privileged things like,
perform password resets and other things like that.
Now, lets imagine the same company
has some special group naming rules that they need,
and they want to make sure that all their groups stay in
compliance of these naming conventions,
and they want to make sure this is kept in
check across the entire organization.
So, again Delta query can be helpful here,
and you can also use webhooks to optimize this as well,
and webhooks and Delta query
are generally used better together.
So, to start, you can read
all groups in the tenant and get a Delta token.
This will let you scan
all the existing groups and make sure they're compliant,
and then get a Delta token that will be
used later to actually come back and
learn what's changed to
the set of groups that exist in the tenant.
Once you reach steady state with Delta query,
and you've scanned all the existing groups
and checked them for compliance,
you can open up a webhook subscription by
posting to the subscriptions entity.
In the body of this post,
you're provided a URL,
where you want your application to get notified
whenever there is a change that it should be aware about.
So, then when that happens,
Microsoft Graph will reach out and
send a little poke to your webhooks endpoint,
and this won't contain any data,
it'll just let you know that there is
some new data to be retrieved,
and you can call back using that Delta token,
and get back only the groups that have changed,
and this can be new groups,
updated groups or deleted groups.
Now, you don't have to filter
through all the groups, the entire tenant,
and rescan them all,
or do some sort of div calculation,
mark what groups you've already checked.
Then, if you find some non-compliant groups in that list,
you can go ahead and either automatically
patch them to update the group name,
or ask somebody for input,
and ask them what a group name
should be within the compliance requirements,
and go ahead and make that update.
In this video, you've seen how you can use
Microsoft Graph to automate complex business processes,
and build custom workflows for user and group management,
and how it can help you squeeze
every ounce of value out of
Azure Active Directory and the REST of Microsoft 365.
To learn more, check out
our documentation at graph.microsoft.com,
and try out our samples on GitHub.
Be sure to tell us about your projects on Twitter,
and ask us any questions you have on
StackOverflow. Thanks for watching.