In this post, let’s see how we can deploy a dot net 9 isolated runtime model project to a Linux based Azure function.

Prerequisites

Creating the hosting plan

It is not mandatory to create a hosting plan, as the resource will be auto created when you create the function, however it is recommended to create one as you can define your naming strategies and more controls. Here we are choosing the consumption plan. You can learn more about the hosting options Azure provides here. Below is the ARM template to create the consumption hosting plan.

{
    "type": "Microsoft.Web/serverfarms",
    "apiVersion": "2024-04-01",
    "name": "[parameters('funcAppServerFarmName')]",
    "location": "[parameters('funcAppLocation')]",
    "kind": "functionapp",
    "sku": {
        "name": "Y1",
        "tier": "Dynamic"
    },
    "properties": {
        "computeMode": "Dynamic",
        "reserved": true
    }
}

Creating the Azure function

Below is the ARM template to create the Azure function.

{
    "type": "Microsoft.Web/sites",
    "apiVersion": "2024-04-01",
    "name": "[parameters('FuncName')]",
    "location": "[parameters('funcAppLocation')]",
    "kind": "functionapp,linux",
    "identity": {
        "type": "SystemAssigned"
    },
    "properties": {
        "reserved": true,
        "alwaysOn": true,
        "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('funcAppServerFarmName'))]",
        "linuxFxVersion": "DOTNET-ISOLATED|9.0",
        "siteConfig": {
            "linuxFxVersion": "DOTNET-ISOLATED|9.0",
            "appSettings": [
                {
                    "name": "AzureWebJobsStorage",
                    "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};EndpointSuffix={1};AccountKey={2}', parameters('StorageName'), environment().suffixes.storage, listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('StorageName')), '2022-05-01').keys[0].value)]"
                },
                {
                    "name": "APPINSIGHTS_INSTRUMENTATIONKEY",
                    "value": "[reference(resourceId('Microsoft.Insights/components', parameters('InsightsComponentName')), '2020-02-02').InstrumentationKey]"
                },
                {
                    "name": "FUNCTIONS_EXTENSION_VERSION",
                    "value": "~4"
                },
                {
                    "name": "FUNCTIONS_WORKER_RUNTIME",
                    "value": "dotnet-isolated"
                },
                {
                    "name": "linuxFxVersion",
                    "value": "DOTNET-ISOLATED|9.0"
                },
                {
                    "name": "WEBSITE_USE_PLACEHOLDER_DOTNETISOLATED",
                    "value": "1"
                },
                {
                    "name": "CosmosConnectionString",
                    "value": "[concat('@Microsoft.KeyVault(SecretUri=', 'https://',parameters('KeyVaultName'),'.vault.azure.net/secrets/CosmosConnectionString)')]"
                }
            ],
            "minTlsVersion": "1.3"
        },
        "runtime": {
            "name": "dotnet-isolated"
        },
        "httpsOnly": true
    },
    "dependsOn": [
        "[resourceId('Microsoft.Insights/components', parameters('InsightsComponentName'))]",
        "[resourceId('Microsoft.Web/serverfarms', parameters('funcAppServerFarmName'))]",
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('StorageName'))]"
    ]
}

Please make sure to set the values linuxFxVersion, WEBSITE_USE_PLACEHOLDER_DOTNETISOLATED or you may get the error below when you deploy your code to the Azure function.

Failed to sync triggers for function app ‘funcsintest03’. Error: BadRequest – Encountered an error (BadGateway) from host runtime. (CODE: 400)

I have a detailed post on the error here on Stack Overflow. Here is a doc on Automate resource deployment for your function app in Azure Functions.

Create Azure function application

You can easily create the Azure function using the Visual Studio by following this post. Please be noted that for my Azure function I am choosing my function to run in an isolated worker process to get the benefits like standard dependency injection, you can read more on this here.

Create the Azure DevOps pipelines

Before we create the pipelines, let’s create the template YAML with the file name as func-template.yml so that we can use it for all of our environments like Dev, Test, Prod etc.

parameters:
  - name: azureSubscriptionServiceConnection
    type: string
  - name: functionAppName
    type: string
  - name: stageName
    type: string

stages:
  - stage: ${{ parameters.stageName }}_Stage
    displayName: Release stage ${{ parameters.stageName }}
    jobs:
      - job: ${{ parameters.stageName }}_Release
        displayName: ${{ parameters.stageName }}_Release
        pool:
          vmImage: "ubuntu-latest"
        steps:
          # Download an artifact named 'WebApp' to 'bin' in $(Build.SourcesDirectory)
          - task: DownloadPipelineArtifact@2
            inputs:
              artifactName: "drop"
              targetPath: $(Build.SourcesDirectory)/bin
          - task: AzureFunctionApp@2 # Add this at the end of your file
            inputs:
              azureSubscription: ${{ parameters.azureSubscriptionServiceConnection }}
              appType: functionAppLinux # This specifies a Linux-based function app
              #isFlexConsumption: true # Uncomment this line if you are deploying to a Flex Consumption app
              appName: ${{ parameters.functionAppName }}
              package: $(Build.SourcesDirectory)/bin/*.zip
              deploymentMethod: "zipDeploy" # 'auto' | 'zipDeploy' | 'runFromPackage'. Required. Deployment method. Default: auto.
              #Uncomment the next lines to deploy to a deployment slot
              #Note that deployment slots is not supported for Linux Dynamic SKU
              #deployToSlotOrASE: true
              #resourceGroupName: '<RESOURCE_GROUP>'
              #slotName: '<SLOT_NAME>'
              runtimeStack: 'DOTNET-ISOLATED|9.0'

Here we use the task AzureFunctionApp@2 task, you can learn more about that task here. Next, create a YAML file func-template.yml with the contents below.

trigger:
  - main
stages:
  - stage: Build
    displayName: Build and push stage
    jobs:
      - job: Build
        displayName: Build
        pool:
          vmImage: "ubuntu-latest"
        steps:
          - task: UseDotNet@2
            inputs:
              packageType: "sdk"
              version: "9.0.x" # .NET 9 preview/stable depending on your needs
              installationPath: $(Agent.ToolsDirectory)/dotnet
          - checkout: self
          - script: |
              dotnet restore
              dotnet build --configuration Release
          - task: DotNetCoreCLI@2
            inputs:
              command: publish
              arguments: "--configuration Release --output publish_output"
              projects: "$(System.DefaultWorkingDirectory)/MyFunc.Func/MyFunc.Func.csproj"
              publishWebProjects: false
              modifyOutputPath: false
              zipAfterPublish: false
          - task: ArchiveFiles@2
            displayName: "Archive files"
            inputs:
              rootFolderOrFile: "$(System.DefaultWorkingDirectory)/publish_output"
              includeRootFolder: false
              archiveFile: "$(System.DefaultWorkingDirectory)/build$(Build.BuildId).zip"
          - task: PublishBuildArtifacts@1
            inputs:
              PathtoPublish: "$(System.DefaultWorkingDirectory)/build$(Build.BuildId).zip"
              artifactName: "drop"

  - template: func-template.yml
    parameters:
      azureSubscriptionServiceConnection: "MyFuncdevmi"
      functionAppName: "MyFuncfuncsindev03"
      stageName: "DEV"
  - template: func-template.yml
    parameters:
      azureSubscriptionServiceConnection: "MyFunctestmi"
      functionAppName: "MyFuncfuncsintest03"
      stageName: "TEST"

In the above YAML file, my function project name is MyFunc and I am using the MyFuncdevmi as the service connection to deploy the Azure function to the DEV environment MyFuncfuncsindev03 and MyFunctestmi to deploy to my TEST environment MyFuncfuncsintest03.

I am using managed identity to create those service connection. You can create a managed identity using the ARM template below.

{
    "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
    "apiVersion": "2024-11-30",
    "name": "[parameters('managedIdentityName')]",
    "location": "[parameters('location')]",
    "tags": {
        "{customized property}": "string"
    }
}     

You can follow this doc to create the service connection using the managed identity.

Create the pipeline using the YAMLs created

Go to the Pipeline menu and click on New pipeline button. Select your Azure DevOps repository and click on the option Existing Azure Pipelines YAML file.

Choose the path to your release pipeline YAML file, not the template YAML file, and run your pipeline. If your pipeline is successful, you should be able to see the output as below.

Conclusion

In this post we have learned how to,

• create the Azure function and consumption hosting plan with dotnet isolated worker process
• create the temple for the deploying the Azure function
• create the release YAML using the template file

About the Author

I am yet another developer who is passionate about writing and sharing knowledge. I have written more than 500 blogs on my blog. If you like this content, consider following me here,

• GitHub
• medium
• Twitter

Your turn. What do you think?

Thanks a lot for reading. Did I miss anything that you may think is needed in this article? Could you find this post useful? Kindly do not forget to share your feedback.

Prerequisites

1. You must have a repository that has your static files
2. You must have access to Azure portal

Create Azure Static Web App

Go to the Azure portal and select the static web app. Under the deployment settings, make sure you select the Azure devops repository where the static files are pushed.

For the build preset, select one that suits your project, here I am selecting HTML. The app artefact location or output location is based on the preset that you select. For HTML it is “/”, you can learn more on that here.

When you click on the Review + Create button on the portal, the build and release pipeline will be created with YAML file that you can edit later.

You may get the error below when you click the Create button.

Failed to create a Personal Access Token for this user in Azure DevOps. Please deploy your app using the ‘Other’ deployment source instead of ‘Azure DevOps’. After the app is created, open it and follow the instructions to get the token and deploy your app.

If that happens, as the error suggested, select the deployment source as Other and proceed. We will need to configure the deployment once the app is created.

You can also create the static web app using the ARM template, Bicep or Terraform. Read about that here and here.

Configure CI & CD deployment

Once the app is created, you can go to the URLs given for your app and you should see a start page as below.

Click on the Manage Deployment Token button under the overview pane and copy the deployment token. We will be setting this value as a secret in our pipeline later.

Go to your Auzre DevOps and click on the Pipelines. Click on the New pipleline and select your repository from Azure DevOps. In the configure tab, select Starter pipeline. Replace the content with the below codes.

https://gist.github.com/SibeeshVenu/1c9eeb3a54ebb4bc6a240de46e1e4f61

trigger:
  - main

pool:
  vmImage: ubuntu-latest

steps:
  - checkout: self
    submodules: true
  - task: AzureStaticWebApp@0
    inputs:
      app_location: '/' # App source code path relative to cwd
      # api_location: 'api' # Api source code path relative to cwd
      # output_location: 'public' # Built app content directory relative to app_location - optional
      # cwd: '$(System.DefaultWorkingDirectory)/myapp' # Working directory - optional
      azure_static_web_apps_api_token: $(deployment_token)

Click Save and run, the pipeline will fail for the first time as we have not set the deployment_token varible in the pipeline yet. Go to the created pipeline and click on Edit, click on Variables and then click New variable. Set the variable name as deployment_token and paste the deloyment token we copied as the value. Remember to set the value as secret. There are many ways to set the secret for your pipelines, you can read about those here and here.

Run your pipeline again. This time, the pipeline should be successful and you should be able to load your Static web app with your contents now.

Configure Custom Domain

Goto your Static web app and then click on the Add a custom domain tile.

Select the appropriate option as per your needs. I am selecting Custom domain on other DNS.

Enter the domain and select the Hostname record type, here I am selecting CNAME.

If you give the domain without www in it, you may get the below error.

Request Envelope is invalid. Apex Domains must use dns-txt-token as the ValidationMethod.

You can learn more about the custom domain here. Copy the CNAME hostname record and add it to your DNS provider to confirm your domain ownership. It can take up to 48 or 72 hours for DNS entry changes to take effect. Once that period is over, you can come here and try to add the custom domain again. Once it is added you should see a Status as “Validated”.

If you want to add the custom domain without “www” in it, then you must add a TXT record with the host as “@” and value as the code generated in the static web app’s custom domain section in your domains DNS configuration. You can learn more here.

Learn More

You can learn more about the Static Web App from the tutorials below.

1. Comparing Azure Static Web Apps vs Azure WebApps vs Azure Blob Storage Static Sites
2. Quickstart: Build your first static web app
3. Static Web Apps pricing

Conclusion

In this post we have seen how easily we can creat an Azure static web app, how to deploy or configure CI & CD with your new static web app, and how to configure the custom domain name to your static web app.

About the Author

I am yet another developer who is passionate about writing and sharing knowledge. I have written more than 500 blogs on my blog. If you like this content, consider following me here,

• GitHub
• medium
• Twitter

Your turn. What do you think?

Thanks a lot for reading. Did I miss anything that you may think is needed in this article? Could you find this post useful? Kindly do not forget to share your feedback.

Prerequisites

1. You will need Python installed on your machine
2. You will need to create a Team and a channel in the Team

Setting up a channel

Creating a channel

You will need to set up Teams before you create a channel, and if you have enough access, it is an easy thing to do. Once the Team is ready to use, you can either use one of the existing channel, or create a new one from the context menu.

Setting up the connector

When you have decided which channel to use, click on the three dot on the right-side of your channel name, and then click on the Connectors and then search for the connector “Incoming Webhook” and then click on the button “Add”.

The above process might take a few minutes. If you are unable to perform this, you can try using the web version of Microsoft Teams.

Use of web verstion of Microsoft Teams

The above step will add the connector to your Teams, so that you can start configuring your Webhook. Click on the Configure button.

Provide a meaningful name for your Webhook and upload an image if required. Finally click on the Create button. A unique Url will be generated for your Webhook. Copy the Url and save it somewhere, we will later add this to Azure Key Vault and use from there. Click on the Done button. Your Webhook now should be shown as configured.

Post Message Using the Connector

Setting up Azure Key Vault

Configuring the Azure Key Vault is as easy as you set up any other Azure Resource. You may get the steps required from this post or this. Add a new secret and paste the Webhook Url value you copied earlier.

Make sure that you had set up the Access Policies on your Azure Key vault.

Access Policy

Copy your Azure Key Vault name and the Secret name, we will use this in our Python function.

Setting up Python Application

Let’s set up our Python application. Create a directory msteams-webhook and create a file requirements.txt with the preceeding contents.

pymsteams[async]
azure-identity
azure-keyvault-secrets

Now run the commands below to create a virtual environment, activate the environment and then install the requirements in our environment. If you get a message like “WARNING: You are using pip version 19.2.3, however version 22.2.2 is available.”, you can upgrade pip by running the command python -m pip install --upgrade pip

py -m venv .venv
.\.venv\Scripts\activate
py -m pip install -r requirements.txt

You can learn more abou the Virtual Environment here.

Python Virtual Envrronment

Get the Secret from Azure Key Vault

Let’s create a new Python file keyvault_helper.py with the codes below.

Send Message to Teams Channel

To send a message to the Teams channel, we are going to use a package pymsteams. This has been already added to our requirements file. Let’s create a file notify_teams.py with the codes below.

As we have all the set up done, let’s create main.py file with the codes below to start sending the messages to the Teams channel.

Before you run the main file, make sure that you have logged in to the terminal using az login with the account that you had set the access policy in your azure key vault. We can also set this access policies by using a managed identity, or a service principal, so that we can use it for more production scenarios. But for this post, let’s stick with a user account.

If you get the error, VisualStudioCodeCredential: The current credential is not configured to acquire tokens for tenant or SharedTokenCacheCredential: The current credential is not configured to acquire tokens for tenant you can set the values  exclude_shared_token_cache_credential=True or exclude_visual_studio_code_credential=True when you get tokens using DefaultAzureCredential in your get_key_vault_secret function in keyvault_helper.py file.

Keyvault Error

By this time, we can hope that you will be able to get the secret from the key vault and now we can execute py .\main.py file. Once the file is executed, you should get a response in your cli as preceding.

{"version":"1.1","content":{"headers":[{"key":"Content-Type","value":["text/plain; charset=utf-8"]}]},"statusCode":200,"reasonPhrase":"OK","headers":[],"trailingHeaders":[],"requestMessage":null,"isSuccessStatusCode":true}

You should also get a message on your Teams channel.

Source Code

You can also see the codes in this repository.

About the Author

I am yet another developer who is passionate about writing and video creation. I have written more than 500 blogs on my blog. If you like this content, consider following me here,

• GitHub
• medium
• Twitter

Your turn. What do you think?

Thanks a lot for reading. Did I miss anything that you may think is needed in this article? Could you find this post useful? Kindly do not forget to share your feedback.

Kindest Regards

Sibeesh Venu

PowerShell command to get the metadata

Here is the command to get the metadata of all of your blobs in your storage account.

Set your execution policy to Process if you get any policy errors.

Set-ExecutionPolicy -ExecutionPolicy ByPass -Scope Process

If you get an authorization error as follows, make sure to add a role assignment of Storage Blob Data Contributor. You can do this via Access Control (IAM) of your storage account. Read more about this role here.

PowerShell AuthorizationPermissionMismatch Error

Get-AzStorageContainer : This request is not authorized to perform this operation using this permission.
RequestId:405a7e1a-f01e-004f-3acd-6a1168000000
Time:2022-05-18T15:38:30.5034936Z
Status: 403 (This request is not authorized to perform this operation using this permission.)
ErrorCode: AuthorizationPermissionMismatch
Content:
<?xml version=”1.0″ encoding=”utf-8″?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using
this permission.

Once you add the role, you can try running your PowerShell command after a few minutes. Please make sure to provide the values to the variables $containerName, $subscriptionid, $storageAccName. Happy coding with PowerShell!

About the Author

I am yet another developer who is passionate about writing and video creation. I have written close to 500 blogs on my blog. If you like this content, consider following me here,

• GitHub
• medium
• Twitter

Your turn. What do you think?

Thanks a lot for reading. Did I miss anything that you may think is needed in this article? Could you find this post useful? Kindly do not forget to share your feedback.

Kindest Regards

Sibeesh Venu

At this point, I will assume that you have a .net6 application, Azure Web App Service, and Azure DevOps project with permission to configure the Pipeline and to add a new service connection to the Azure Resource Group. If you are not sure about how to configure the Service Connection to the Azure Resource Group, this post will help you.

Create the YAML files needed

We will be creating 3 YAML files as listed below.

1. A template file with the all the tasks, so that we can reuse them for the environment specific pipelines
2. A pipeline for Test environment
3. A pipeline for the production environment

Template file

Let’s configure all the tasks needed in our template file. We will have 2 stages in our template. You can read this post if you are not sure how to configure the stages in the pipeline.

1. Build stage, for performing the tasks below
   • Install .Net Core SDK
   • .Net restore
   • .Net build
   • .Net publish
   • Publish to Azure DevOps artefacts
2. Deploy stage, to deploy the artefacts generated to the Azure Web App Service. This will involves the taks below.
   • Download the artefact
   • Deploy

Our final template file will look like this.

Add pipeline for Test environment

As we have a template available, we can use this to configure the pipeline for our test environment. All you have to do is to refer to this template and pass the required parameters. This is how our pipeline for our test environment can look like.

Here, the parameter azure subscription is the service connection name that you have created in your Azure DevOps project. Refer to this to know more. The wwebAppName is the name of your Azure Web App Service.

Add pipeline for Prod environment

Let’s create a new pipeline for our Prod environment to see how easily we can reuse the template.

Wasn’t that cool?

Configure the pipelines in the Azure DevOps

Just creating the YAML field will not create the pipelines in our DevOps, as Microsoft has removed that option due to some security concerns. So we will have to configure them manually for the first time. Let’s do it.

1. Go to the Pipelines section from your Azure DevOps and click on the New pipeline button.
2. Select Azure Repos Git (YAML) from the next screen.
3. Select the repository that you pushed your YAML file code changes.
4. Azure DevOps will analyze your repository and sugges the YAML templates. Select the Existing Azure Pipeline YAML file option.
5. Selct the branch and the path to your YAML file as in the preceding image, review the same and run the pipeline.

That’s it. Everything else will be working as expected from the next time as we have configured the triggers in the pipelines. If you are getting an error as “Task “NETSdkError” skipped, due to false condition; (‘$(_TargetFrameworkVersionWithoutV)’ > ‘$(NETCoreAppMaximumVersion)’) was evaluated”, you will have to make sure that you are installing the correct version of the .Net Core SDK as mentioned in this answer.

Source code

You can get the complete source code from this GitHub repository. Please feel free to fork/star.

Conclusion

Here in this post, we have learned the following things.

1. How to configure a YAML template
2. How to reuse a YAML template in the pipelines
3. How to deploy the .net 6 application to Azure Web App Service

About the Author

I am yet another developer who is passionate about writing and video creation. I have written close to 500 blogs on my blog. And I upload videos on my YouTube channels Njan Oru Malayali and Sibeesh Passion. Please feel free to follow me.

• GitHub
• medium
• Twitter

Your turn. What do you think?

Thanks a lot for reading. Did I miss anything that you may think is needed in this article? Could you find this post useful? Kindly do not forget to share your feedback.

Kindest Regards

Sibeesh Venu

Right-click on the project and click on the Connected Service

Click on the + icon in the Service Dependencies and then select Azure Application Insights from the list

Log in and select your subscription and the Azure Application Insight instance

Configure your connection string name and choose how you want to save your connections string locally. I would recommend saving it to a secret.json file. You can get more information about this here under the Secret Storage for Development Environment section.

Click Finish on the summary screen.

You will be able to see the progress in the next screen.

Click on the Git changes window, your changes should look like the image below.

Push your changes and deploy them to your web application.

Conclusion

Congratulations and thanks a lot for being with me this far. Here in this post, we learned how can we enable the Azure App Insights to our application. Happy Analysing!.

About the Author

I am yet another developer who is passionate about writing and video creation. I have written close to 500 blogs on my blog. And I upload videos on my YouTube channels Njan Oru Malayali and Sibeesh Passion. Please feel free to follow me.

• GitHub
• medium
• Twitter

Your turn. What do you think?

Thanks a lot for reading. Did I miss anything that you may think is needed in this article? Could you find this post useful? Kindly do not forget to share your feedback.

Kindest Regards

Sibeesh Venu

This will create a new Azure AD App Registration on your Azure AD and then a new service principal will be created to connect the Azure Resource group you have mentioned. By default, this will work with only one resource group as there is no UI to select multiple resource groups. But, I wanted to use the same service connection to connect to multiple resource groups, so that I can use the same service connection in a pipeline to connect to those resources when it is necessary by using the "azureSubscription"option in the pipeline tasks. I was getting the preceding error when I try with the existing service connection.

1. Starting: Publish app to installer website 
============================================================================== 
Task : Azure App Service deploy 
Description : Deploy to Azure App Service a web, mobile, or API app using Docker, Java, .NET, .NET Core, Node.js, PHP, Python, or Ruby 
Version : 3.184.1 
Author : Microsoft Corporation 
Help : https://aka.ms/azureappservicetroubleshooting 
============================================================================== 
Got connection details for Azure App Service:'weu-aps01' 
##[error]Error: Resource 'weu-aps01' doesn't exist. Resource should exist before deployment. 
Finishing: Publish app to installer website 

Here in this post, we will see how we can resolve this issue.

Azure AD App Registration and Service Prinicipals

Here are the screenshots of the AD app registered and the service principal created.

Now, if you just go to your Azure Resource group and then click on the Access Control, under the role assignments you should be able to see the new service principal for the new AD app with contributor access.

Azur DevOps Service Connection with Multiple Resource Group

As you might have guessed already, to connect multiple resource groups to the same azure DevOps service connection, all we have to do is to add a new role assignment with the new AD application registration. Get the name of the service principal created, by clicking on the manage Service Principal option in the Service Connection and then copy the value for the Display name from the next page.

Now, go to the resource group that you wish to give access to, click on the Access Control(IAM) and then the +Add button.

Select the Add role assignment option and then select the role as a contributor in the role grid, press next. From the next screen, select user, group, or service principal as the option for Assign access to. Click on the + Select members, search for our AD Registered app name, the display name and then select the same from the result, click on the select button. Finally, click the Review + assign button.

Testing Azure DevOps Service Connection with Multiple Resource Group

I had a pipeline that connects Azure Resources from different resource groups, so to test this, all I have to do is to run the pipeline, and see whether I am getting the same error I was getting earlier. If you ever get any error saying that, ##[error]Error: Virtual application doesn't exists : resources make sure that you have configured the virtual directory in your Azure Web App, here resources is my virtual application. I know that it is specific to my case, still thought to share this in this post.

Conclusion

In this post, we learned the preceding things.

• What is Azure DevOps service connection
• How to configure an Azure DevOps service connection with multiple azure resource groups

About the Author

I am yet another developer who is passionate about writing and video creation. I have written close to 500 blogs on my blog. And I upload videos on my YouTube channels Njan Oru Malayali and Sibeesh Passion. Please feel free to follow me.

• GitHub
• medium
• Twitter

Your turn. What do you think?

Thanks a lot for reading. Did I miss anything that you may think is needed in this article? Could you find this post useful? Kindly do not forget to share your feedback.

Kindest Regards

Sibeesh Venu

Install-Module -Name AzureAD

You will be prompted to accept the installation, give Yes or A.

Untrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the modules from 'PSGallery'?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "N"): A

You can also check whether this module is installed or not by using the command Get-Module AzureADPreview

Once you are done, it is time to connect to your Azure AD by using the command Connect-AzureAD. That will give you an output as in the preceding image.

Now, use the command below to change the properties of your user.

Set-AzureADUser -ObjectId user1@domain.com -OtherMails @("user2@domain.com") -Mobile "+353 000000000" -TelephoneNumber "+353 000000000"

You can also verify the changes by running the commands below.

Get-AzureADUser -ObjectID user@domain.com | select otherMails
Get-AzureADUser -ObjectID user@domain.com | select Mobile
Get-AzureADUser -ObjectID user@domain.com | select TelephoneNumber

After you have changed your mobile number, verify the same when it is asked, and you should be able to Enable the Two-Step Verification on the Security Information page.

References

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-authenticationdata#use-powershell-version-2

Get the PAT (Personal Access Token)

To connect to our DevOps using an API, we should authenticate and to do that, we need to create a PAT aka Personal Access Token. Goto your Azure DevOps and click on the User Settings button, and then Personal access tokens.

Click on the +New Token button and fill all the required fields in the next screen. Once it is done, click on Create button, this will generate a token for you. Please remember that you need to copy this token before you leave the page or reload, as this is not saved anywhere.

Setup PostMan

I usually create a collection in PostMan before I do any related calls. You can create a collection by clicking the + icon in the collection section. Once it is created, click on the Authorization tab and change the type to Basic Auth, past the token you copied from Azure DevOps in the password field. Please remember that you should leave the Username field blank.

Call the Azure DevOps APIs

As we have successfully set up our PostMan, now we are ready to execute the APIs.

Get Iterations

Create a GET request under the collection we have created using this format to get the Iterations as we will use this in our next API call. The example is given below.

GET https://dev.azure.com/{organization}/{project}/{team}/_apis/work/teamsettings/iterations?api-version=6.0

The Organization name and project name can be easily found on the Azure DevOps home page or from the URL you access your DevOps, for example, if you access your DevOps by this URL “https://dev.azure.com/sibeeshpassion/publicrepo“, sibeeshpassion is your organization name and publicrepo is your project name.

You can either use your team name or team id as the next parameter. If you want to use the Team id, the easy way to find it is to go to your team by accessing this URL “https://dev.azure.com/{orgName}/{projectName}/_settings/teams“, click on the Team you wish, and then click on either Notification or Dashboard.

A new page will be opened and you can get the Team id from the URL of the new page. For example, “https://dev.azure.com/{orgName}/{projectName}/_settings/notifications?teamId=989154f4f-32f6-4dab-b7f5-165457afsgd36f“. One thing to note here is to set the Type as “Inherit auth from parent” under the Authorization tab.

Click on the Send button now, and you should see the result. You can visualize the data you get by using the visualizer if you wish.

Get the capacity

As we now have all the iteration details we can perform the API call to get the capacity of each sprint. Create another GET request, by using this format and set the Authorization Type as “Inherit auth from parent”. The sample API looks like below,

GET https://dev.azure.com/{organization}/{project}/{team}/_apis/work/teamsettings/iterations/{iterationId}/capacities?api-version=6.0

Replace the {iterationId} from the result of the previous execution. When you click on the Send button, you should now get a JSON array with all the details as below.

Please be noted that I have removed all the values from the result. With the result, you can loop through the array and find the analytics data that you are looking for.

I am planning to create one front end application to do this, thus keep an eye here. You can also get the capacity of the team member by executing this API.

Conclusion

Thanks for reading this post, and here we learned,

1. How to get a personal access token from Azure DevOps?
2. How to authnticate the Azure DevOps APIs using the Personal Access Tokens and use the same in PostMan?
3. How to get the Team Iterations and Sprint Capacities of a Team in Azure DevOps?

About the Author

I am yet another developer who is passionate about writing and video creation. I have written close to 500 blogs on my blog. And I upload videos on my YouTube channels Njan Oru Malayali and Sibeesh Passion. Please feel free to follow me.

• GitHub
• medium
• Twitter

Your turn. What do you think?

Thanks a lot for reading. Did I miss anything that you may think is needed in this article? Could you find this post useful? Kindly do not forget to share your feedback.

Kindest Regards

Sibeesh Venu

Working with Microsoft Graph is fun, but it can get way too complex when the requirement is getting complex. Recently, I was working with such a requirement. I wanted to load users from different tenants, usually, this is too easy, and you just need an admin user in the tenant to load all the users using Graph API. But, in our case, there is no guarantee that the logged-in user is actually present in that tenant. And when the user tries to get the users from a different tenant, the Graph API returns an Unauthorized error, which is obvious and well handled.

So, we wanted something that can always perform these actions, no matter the logged-in user is present or not in the tenant given. I started with adding the Delegated permission to the Azure AD app registration, and in the end, the result was the same. Then I came to know about the application permission of Azure AD application registration and that sounded worth a try.

Here in this post, I will be sharing how did I achieve this requirement, it is not that problematic as it sounds.

Azure AD Application Set Up

Go to your Azure AD and select the App registration menu from the left pane. This will open the window where you can create and manage your app registrations.

When you are registering a new Azure AD application, make sure to select Multi-Tenant Support and give a redirect URL.

Now let’s say that you have created your application and now open the application and click on the permission menu from the left-pane.

As you can see that, all the permission types are Application, instead of the delegated ones. This will make sure that our application gets the privilege to act without a user, and will act as a Daemon user in the end. Please be careful in giving the application permissions as those are critical and should only be used when it is needed. So, just select only the permissions needed to complete your requirements.

Now, to make it work, we also need to set up a Client Secret in our application, which will then be used when we create a token. To do that, click on the Certificate & Secrets menu from the left pane. And click on the +New client secret.

Remember to make a note of the secret as you will not be able to see the values later. Now that our application is ready for action, let us write some code.

Code to Get Users from Multiple Tenants

I do this in my .Net Core API application, and I have a module called Admin which does all the Admin related kinds of stuff. Here I have configured my application using a vertical layered architecture, thus this admin module is independent of any other features in our application. Having said that, let’s look at the code in AdminController.

As you can see that, nothing fancy there. Here I am just calling the method in the Admin Service and some error handlings. Let’s look at the code in the Admin Service.

Here I have some custom error handling and also I am doing some logic related to my requirement, but the important part here is” var users = await _graphFacade.GetUsersUsingGraph(selectedTenant);” Let’ see that now.

I am a fan of keeping things separate, and that is the reason why you are seeing a lot of separations here. I promise that there will only be one more. Here we have a GraphAuthService, and that is when I actually create the graph client and return the provider. Shall we see that now?

Here we are creating a client credential provider with our tenant given and then create a graph client using that provider. Sounds good? We are getting all the other values from our configuration. In the non-development environment, I am loading the secret from a Key Vault, and for the development environment I load them using the secret.json file, I have already written a blog post about this, you can read it here.

As per your need, you should select the authentication provider, this post will help you choose one. And we use this client in our façade service to get all the users. You have already seen that. Follow this link to install all the dependencies, in short, install both “Microsoft. Graph” and “Microsoft.Graph.Auth” Nuget packages at least.

Execution

It is mandatory that you should have a UI application where an admin can grant access to our application, you can also prepare a URLS and sent it to your admin to give the consent, but the UI approach is more feasible. I have an application already that does this. Let’s run it now and see whether we are able to fetch the users from the different tenants or not.

In short, when the consent is given a new service principal of our application will be created in the tenant to which the admin is granted the consent. You can see this in the Enterprise application section in your Azure AD, check the left-side-pane. This is how the consent screen will look like.

Now, as you can see that in the above image, whatever permission our application is requesting, is showing in the consent screen, and some admins will not give the consent if they see a lot of permissions there. This is the reason why it is important to choose the permissions that are needed. In my case, I have one Azure app for the front end and one for the backend, that is the reason why my backend application name is mentioned in the consent screen.

You can update the permissions of your application anytime you wish, and delete the consent given by going to the Enterprise application section in the Azure AD (remember that this is something that you do in the tenant where the application consent is given) and click on the Delete button in the Properties window.

Now I have updated my application API permission to use only “User.Read.All” permission and let’s see the consent screen now.

As my requirement is to fetch only the users, this would still work as it is and here are the debug screenshots to show you that this is actually working.

Conclusion

Congratulations and thanks a lot for being with me this far. In this post, we have seen that how we can get the users from different tenants using the Azure AD App registration with application permission. Happy Coding!.

About the Author

I am yet another developer who is passionate about writing and video creation. I have written close to 500 blogs on my blog. And I upload videos on my YouTube channels Njan Oru Malayali and Sibeesh Passion. Please feel free to follow me.

• GitHub
• medium
• Twitter

Your turn. What do you think?

Thanks a lot for reading. Did I miss anything that you may think is needed in this article? Could you find this post useful? Kindly do not forget to share your feedback.

Kindest Regards

Sibeesh Venu