azure-graph-toolkit

azure-graph-toolkit

Lightweight python library for easily managing Azure AD (Entra ID) users and groups through the Graph API.
Explore the docs (work in progress)»

· Report Bug · Request Feature

Table of Contents

• About The Project
  • Built With
• Getting Started
  • Prerequisites
  • Installation
  • Usage
• Roadmap
• Contact

About The Project

There are many great Azure libraries available on GitHub; however, I didn't find one that really suited my needs, so I created this one to simplify and automate daily tasks.

Features:

• Add user to AAD group
• Remove user from AAD group
• Check if user is member of a group
• List all user membership groups
• Reset user password
• Disable/enable user
• Revoke user session tokens

Getting Started

Prerequisites

• Python >= 3.8
• Azure AD App Registration with the following role assigned:

Least privilege role	Delegation type	Description
GroupMember.ReadWrite.All	Application	To manage user membership groups.
GroupMember.Read.All	Application	List all the groups available.
User.ReadWrite.All, User Administrator role	Application	To change user password.
User.ManageIdentities.All, User.EnableDisableAccount.All	Application	To disable/enable user.
User.RevokeSessions.All	Application	To revoke user session tokens.

Installation

• Install azure-graph-toolkit library from PyPi

  pip install azure-graph-toolkit
  

• Profit 😁

(back to top)

Usage

Import library modules

from azure_graph_toolkit import graph_auth, graph_utils

App authentication and authorization. Once get the access token is possible to interact with Azure AD Graph API.

tenant_id = '<tenant Id>'
client_id = '<client (App) Id>'
client_secret = '<client secret>'

access_token = graph_auth.get_access_token(tenant_id, client_id, client_secret)

Add user to AAD group:

result = graph_utils.add_user_to_group('[e-mail]', 'block-usb-group', access_token)

print(result)

Remove user from AAD group:

result = graph_utils.remove_user_from_group('[e-mail]', 'block-usb-group', access_token)

print(result)

Disable user:

result = graph_utils.set_user_account_status('[e-mail]', enable_account=False, access_token)

print(result)

Revoke user sessions:

result = graph_utils.user_revoke_sessions('[e-mail]', access_token)

print(result)

Example Output

{'status_code': 204, 'message': 'Success. User [e-mail] added to AAD group block-usb-group.'}

{'status_code': 404, 'message': 'No AAD group with a name containing \'block-usb-group\' was found. Please try another group name.'}

(back to top)

Roadmap

• List user MFA status
• List user's owned devices
• List devices compliance status
• Add device to group
• Remove device from group
• Create and delete users
• Create and delete groups

(back to top)

Contact

Ivano Dibenedetto - @Linkedin - [e-mail]

Project Link: https://github.com/Ivanodib/azure-graph-toolkit

(back to top)