Does anyone have a script they use to check membership of Microsoft Entra groups? Everything I'm finding is Powershell, and I need something that can run natively on Macs out of the box.
Question
Shell script to check Entra (Azure) group membership
+26Depending on what you are trying to read you may be able to use the ldapsearch or the dhcl binaries, though a lot of Entra leans on Microsoft Graph API which you need PowerShell to use. Entra is a Microsoft utility, and the tool Microsoft makes to interface with their utility is PowerShell.
It's not out of the box macOS, but you can install PowerShell on Mac. Usually for people that need to lean heavy on Microsoft Workflows, I require them to get a Windows VM and just keep things native and simple.
+16So I went down a similar path a few years ago. I wasn't reading a membership, but I was adding to a group. I originally tried testing reading first, but adding accomplished that by just giving an alternate result saying no addition was needed. I'm not sure if it was a custom add or not, but someone from one of our internal dev teams mentioned that you could use an API to accomplish this.
I read the currently signed in user, then go and find the UPN that's signed into company portal
AADUser=$(/usr/libexec/PlistBuddy -c "Print :aadUserId" /Users/$whoami/Library/Application\\ Support/com.microsoft.CompanyPortalMac.usercontext.info)
Then take that result and run it through the below curl.
/usr/bin/curl -X POST 'https://yourdomain.azure.com/workflows/XXXXXXXXXXXX/triggers/manual/paths/invoke?api-version=2016-06-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=XXXXXXXXXXXX' -H 'Content-Type: application/json' -d '{ "RequesterUPN": "XXXXXXXXX@XXXXXXX.com", "TargetUserUPN": "'"$AADUser"'", "TargetGroupOID": "XXXXXXXXXXX-XXXXX-XXXXX", "Action": "add" }'
From there it was just formatting my API call properly.
+3Take a look at: MS Graph CLI
It has code samples for interactions with the binary in bash. We use it for password notifications to our end-users and currently looking to check the group memberships.
A piece of code goes something like this:
#Variables
currentUser=$( ls -l /dev/console | awk '{ print $3 }' )
export AZURE_TENANT_ID=
export AZURE_CLIENT_ID=
export AZURE_CLIENT_SECRET=
# Fetch UPN from Jamf Connect plist
UPN=$( defaults read /Users/"$currentUser"/Library/Preferences/com.jamf.connect.state.plist UserUPN )
# Should UPN be empty, fallback to manually set UPN
if [[ -z $UPN ]]; then
UPN="$currentUser@maildomain"
fi
# Login to MS Graph, fetch group membership and logout
/usr/local/bin/mgc login --strategy Environment
/usr/local/bin/mgc users member-of list --user-id "$UPN" --select "displayName,id" --consistency-level "eventual" | /usr/bin/jq -r ".[]"
/usr/local/bin/mgc logout 
+9Hi @MichielD.
Is there a good way to use a bash script and obtaining the group memberships?
I thought that the following would work and I could filter the group names using this. But sadly somehow that fails on me.
# Call Microsoft Graph API to get the user's group memberships
-H "Authorization: Bearer $ACCESS_TOKEN" \\
-H "Content-Type: application/json")
# Extract and print only the group names
GROUP_NAMES=$(echo "$RESPONSE" | jq -r '.value[].displayName')
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.