>> Welcome to this week's episode of the DevOps Lab,
where we're covering off Episode 3
in our Identity series for developers.
Tune in as we automate with Azure automation and Microsoft Graph.
[MUSIC].
>> Welcome back to the DevOps Lab.
We're here with Episode 3 with Christos.
Welcome back again.
>> Nice to be here.
>> Good to have you. Today we're going to talk about
Azure AD automation and Microsoft Graph.
>> Yes, absolutely.
>> What is Microsoft Graph?
>> Microsoft Graph is a unified API,
allows you to access a lot of Azure and Azure
active data resources without having
to worry too much about the API consistency.
We took all the services OneDrive, SharePoint,
Dynamics, Azure Active Directory,
and we brought them under one umbrella.
There's obviously different endpoints,
but you have one consistent way
of authenticating and accessing these resources,
and it allows you to do a lot of
magic things like bulk inserting,
users to Azure Active Directory,
or automating things as we're going to see soon.
>> I love automation.
>> Yes.
>> I'm excited to see this. Why don't you take it away?
Probably we tell people why we should automate this first.
I mean, I believe in automating all the things.
Why do we need to automate it?
>> We do know that most of the failures in
IT happened due to human errors somewhere in the process,
whether it's creating code that doesn't run as it
should be or deploying something with the wrong credentials,
or messing something up.
We want to eliminate the human element as much as we can.
Sometimes automation helps with scaling up and scaling out.
With regards to DevOps and Identity,
there are a lot of things that we can do to
make developers lives easier
and IT people can look at
what they need to do to automate things,
so developers can just up and running
without having to work through the process.
Because we do know people screw up quite a bit
when they set up their Azure Active Directory for authentication.
>> Yeah. It's also things when
someone goes on leave, on vacation,
or on holiday and they've had a manual process set up,
like we need to mitigate that and automate that.
Go ahead and take it away and show us MS Graph.
>> Perfect. The easiest way to get started with
graph is to use the Graph Explorer.
There's a play area where you can go and test things out,
but it's super powerful because it gives you a lot of things.
You can come to the Graph Explorer ak dot MS forward-slash GE.
You can use it without an authenticated user.
You don't have to have a signing user.
You still get dummy data to play with.
But if you want to actually start
doing queries against your own data,
then it's nice because you can easily sign in.
Here, if I run this query just returns
the data for my object for myself.
On the left-hand side,
there's a lot of pre-fabricated queries
to allow you to do certain things.
But since we're talking about applications,
Azure Active Directory application registrations,
I'm going to use that as an example.
There's an application stop over here.
As you can see, I can list all my applications.
It already changed the query up here in the Query Explorer
and I run that and it brings back
all the operating decisions I have.
It can even filter things out if we want
to like this and there you go.
Now there are two things that are super useful here.
One is they're going to get an access token,
dump into your code,
and start playing around without having to
go through the authentication process first.
You can also find what kind of permissions you need to
use for every API endpoint because they're always different.
Then the biggest key
and the one that I love is I get code snippets.
If your boss says,
I know you can see because it's too far at the bottom,
but let's say your boss says,
"Hey I want you to go and build something with
the graph and it needs to pull e-mails".
Now you can spend a lot of time looking at the documentation,
you come to the Graph Explorer around
the query and then grab the code.
It's not cheating. Take the rest of the day
off and you're easy-peasy. Don't tell your boss.
>> It's not cheating. You're just leveraging
the advantage of the code to automate it for you.
>> Exactly.
>> Absolutely.
>> But I want to take it a step further.
Why I said, how can we use this tool to
automate Azure Active Directory opera registration?
This is a key because this again,
I've dealt with that many times.
A lot of developers had issues with this.
What I want to do now is I want to show you
a little bit of code that we can use to do all that.
In fact, I wrote it as a notebook.
Python notebooks are very well known because they can
automate things and they also come with a little bit of text,
they can explain why things happen.
Now we have a dot net version for that.
>> Awesome.
>> We also have JavaScript and PowerShell.
Whatever language you want to double with, you can do this.
In this example, we're going to set up an API with an SBA.
An API opera registration allows you to call an API,
authenticate it and then a single page app can be view,
it can be angular, it can be react.
We'll show you what settings
you need to get out of Azure Active Directory.
It will set everything up for you and you're able to run.
Let's run through the example.
First we can pull some dependencies
down and notebooks allow you to install dependencies.
Again you get packages for dot net,
not installed, take a couple of seconds.
Now we create a client or a credential
for our graph client and
that ran successfully as you can see down here.
Now we're ready to create an opera registration.
The credential can be a lot of different things.
I'm using an interactive one just to
show you how the authentication works.
But it can be a service principal,
it can be other credentials.
Now it should prompt me for
an authentication and I'm going to use the right account.
That should have already completed the run actually.
If we go down here.
We should see that it already generated
the Client ID that we need for our API.
The domain in the Tenant ID.
This is the information we need for a dot net API.
Then we need to create a service principle,
so we can actually interact with it in our tenant.
That's all done again.
Finally, we are creating the opera registration for our SBA.
Because we have already authenticated, it has a token.
It went and created that and it turned back the client ID,
SBA has only have client IDs and that's it.
Now if I go back to my Azure Active Directory tenant,
we should see the up registration has just been created.
We got my CRM demo API and the client one,
which we created. There you go.
I didn't have to do anything to
interact with Azure Active Directory.
I run it through the notebook.
Now you can run notebooks as part of your CICD pipeline.
Not dot net yet.
I'm afraid this is coming,
but in the meantime,
you can do the exact same thing with a Python notebook.
>> You can do in PowerShell.
>> You can do it PowerShell. That's true.
>> Awesome. Cool. Now you can take the rest the day off?
>> Yes. Thank you.
>> Just don't tell your boss. Awesome. Christos, thank
you for showing how to automate all of that from beginning to end.
Makes things a lot easier. Pops out
all the things we need to connect to those APIs.
Seems pretty easy. What's the catch?
>> There's no catch. Just download the codes.
It's on GitHub, so you can go and find it there.
We'll have the links below and you can start using today.
>> Cool. For everyone out there, check out the show notes.
We'll have the link to the GitHub repo,
so you can get started and do exactly what Christos did.
Probably don't take the rest of the day off,
but thank you everyone for joining today,
and join us on our next episode when we cover off
some more identity stuff for developers.
[MUSIC].