{"id":3537,"date":"2017-08-13T23:45:59","date_gmt":"2017-08-14T06:45:59","guid":{"rendered":"http:\/\/www.cloudidentity.com\/blog\/?p=3537"},"modified":"2017-08-13T23:46:55","modified_gmt":"2017-08-14T06:46:55","slug":"whos-your-admin","status":"publish","type":"post","link":"https:\/\/www.cloudidentity.com\/blog\/2017\/08\/13\/whos-your-admin\/","title":{"rendered":"Who’s your Admin?"},"content":{"rendered":"

Last week I saw a StackOverflow question<\/a> where a user was wrestling with an app requesting admin consent. The user wanted to contact an administrator, to ask for the app to be consented, and didn\u2019t know how to do that.<\/p>\n

That\u2019s actually an excellent question. I asked around, and it would appear that there\u2019s no efficient way find out who\u2019s a tenant admin (the exact role denomination is \u201ccompany administrator\u201d) in our current portals. Eran Dvir, a good friend on the directory team, suggested that one could simply use the Graph to find out who\u2019s a member of that particular role\u2026 so yesterday night I wrote a quick&dirty app that does just that. I called it Who\u2019s your admin, and you can find it here<\/a>.<\/p>\n

The code is really super simple. First, I get a token for the graph; any directory user will do, given that I am giving the app permission to sign in as the current user and this kind of query can be done by anyone in the org (as long as you do it in a native app).<\/p>\n

\n
\n
   1:<\/span> AuthenticationContext ac = new<\/span> AuthenticationContext(\"https:\/\/login.microsoftonline.com\/common\"<\/span>);<\/pre>\n
<\/p>\n
   2:<\/span> AuthenticationResult ar = ac.AcquireTokenAsync(\"https:\/\/graph.windows.net\"<\/span>,<\/pre>\n
<\/p>\n
   3:<\/span>     \"f357e8fa-87dd-44f2-84f4-40c2a53e3daf\"<\/span>,<\/pre>\n
<\/p>\n
   4:<\/span>     new<\/span> Uri(\"http:\/\/whatevs\"<\/span>),<\/pre>\n
<\/p>\n
   5:<\/span>     new<\/span> PlatformParameters(PromptBehavior.Auto)).Result;<\/pre>\n
<\/p>\n<\/div>\n<\/div>\n
Then, I find out what is the objectID of the company administrator <\/em>role in this particular tenant. I do that by getting all the roles and filtering for the one with display name \u201ccompany administrator\u201d. As usual, I prefer to do raw REST calls rather than using an SDK. Just personal preference \"Smile\"<\/p>\n
\n
\n
   1:<\/span> HttpClient client = new<\/span> HttpClient();<\/pre>\n
<\/p>\n
   2:<\/span> client.DefaultRequestHeaders.Authorization = new<\/span> AuthenticationHeaderValue(\"Bearer\"<\/span>, ar.AccessToken);<\/pre>\n
<\/p>\n
   3:<\/span> HttpResponseMessage response = client.GetAsync(\"https:\/\/graph.windows.net\/myorganization\/directoryRoles?api-version=1.6\"<\/span>).Result;<\/pre>\n
<\/p>\n
   4:<\/span> string<\/span> rez = response.Content.ReadAsStringAsync().Result;<\/pre>\n
<\/p>\n
   5:<\/span> JObject jo = JObject.Parse(rez);<\/pre>\n
<\/p>\n
   6:<\/span> JObject companyAdminRole = jo[\"value\"<\/span>].Values<JObject>().Where(m => m[\"displayName\"<\/span>].Value<string<\/span>>() == \"Company Administrator\"<\/span>).FirstOrDefault();<\/pre>\n
<\/p>\n
   7:<\/span> string<\/span> roleObjID = companyAdminRole[\"objectId\"<\/span>].ToString();<\/pre>\n
<\/p>\n<\/div>\n<\/div>\n
Once I have that, I can use it to retrieve all the members in that role. Given that I already set up all the HttpClient machinery, the code required is really tiny.<\/p>\n
\n
\n
   1:<\/span> response = client.GetAsync(string<\/span>.Format(\"https:\/\/graph.windows.net\/myorganization\/directoryRoles\/{0}\/members?api-version=1.6\"<\/span>, roleObjID)).Result;<\/pre>\n
<\/p>\n
   2:<\/span><\/pre>\n
<\/p>\n
   3:<\/span> rez = response.Content.ReadAsStringAsync().Result;<\/pre>\n
<\/p>\n
   4:<\/span> jo = JObject.Parse(rez);<\/pre>\n
<\/p>\n<\/div>\n<\/div>\n
Finally, I just print out some contact info from the results.<\/p>\n
\n
\n
   1:<\/span> foreach<\/span> (var adm in<\/span> jo[\"value\"<\/span>])<\/pre>\n
<\/p>\n
   2:<\/span> {<\/pre>\n
<\/p>\n
   3:<\/span>     \/\/ we only want people you can email, not bots<\/span><\/pre>\n
<\/p>\n
   4:<\/span>     if<\/span> (adm[\"objectType\"<\/span>].ToString() == \"User\"<\/span>)<\/pre>\n
<\/p>\n
   5:<\/span>     {<\/pre>\n
<\/p>\n
   6:<\/span>         Console.WriteLine(\"Admin found: {0} \"<\/span>, adm[\"displayName\"<\/span>]);<\/pre>\n
<\/p>\n
   7:<\/span>         \/\/ note: UPN!= email. Also, guess users will have an odd ID here<\/span><\/pre>\n
<\/p>\n
   8:<\/span>         Console.WriteLine(\"UPN: {0} \"<\/span>, adm[\"userPrincipalName\"<\/span>]);<\/pre>\n
<\/p>\n
   9:<\/span>         \/\/ note: mail is not always populated (for example in case of guest users).<\/span><\/pre>\n
<\/p>\n
  10:<\/span>         \/\/ Try getting otherMails too, for example. <\/span><\/pre>\n
<\/p>\n
  11:<\/span>         Console.WriteLine(\"Email: {0}\"<\/span>,adm[\"mail\"<\/span>]);<\/pre>\n
<\/p>\n
  12:<\/span>         Console.WriteLine(\"==========================\"<\/span>);<\/pre>\n
<\/p>\n
  13:<\/span>     }<\/pre>\n
<\/p>\n
  14:<\/span> }<\/pre>\n
<\/p>\n<\/div>\n<\/div>\n
Here there\u2019s the output for my usual test tenant. You can see some oddities due to the guest status of one of the users: please refer to the comments in code for some explanation and suggested actions.<\/p>\n
\"image\"<\/a><\/p>\n
Here there\u2019s the thing. This approach can help you if you find yourself precisely in the situation described by the StackOverflow poster, an app needs admin consent and you want to contact an administrator to grant that consent. But it will NOT help if the admin has turned off user consent for the tenant. Why? Well, the console app itself needs to receive your user consent at first run- but if the admin tuned that off, that can\u2019t happen to begin with. Other than sifting through the users in the directory in the portal to find who\u2019s an admin, I wouldn’t know what to do in that case as of today- apart from doing the Italian thing and simply ask my contacts \"Smile\".<\/p>\n
===<\/p>\n
Dang. Here you have it.
\nNote, it is perfectly possible that there\u2019s already a way to find this info without having to run some code (or equivalent powershell if you\u2019re an admin, I guess \"Smile\") \u2013 and if I find it, I\u2019ll break my habit of never updating posts and add the new relevant info here. Until then, have fun!<\/p>\n","protected":false},"excerpt":{"rendered":"
Last week I saw a StackOverflow question where a user was wrestling with an app requesting admin consent. The user wanted to contact an administrator, to ask for the app to be consented, and didn\u2019t know how to do that. That\u2019s actually an excellent question. I asked around, and it would appear that…<\/p>\n","protected":false},"author":1,"featured_media":3536,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3537","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts\/3537","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/comments?post=3537"}],"version-history":[{"count":2,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts\/3537\/revisions"}],"predecessor-version":[{"id":3540,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts\/3537\/revisions\/3540"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/media\/3536"}],"wp:attachment":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/media?parent=3537"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/categories?post=3537"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/tags?post=3537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}