With the assumption that you already know about Microsoft Graph and its capabilities I will directly jump in with the steps and instructions to call Microsoft graph Endpoints as a daemon app using Application permissions with the help of HTTP connector. Calling graph from a flow opens a wide range of possibilities which are not available with the prebuilt connectors. As of now you will not be able to call Microsoft graph with application permissions using a custom connector.
Pre-Requisites:
Access to HTTP Premium Connector in Power Automate
Register an application in Azure AD and obtain the client id, client secret & tenant id for the registered application. In this example I have added the Application permission Calendars.Read to access all the recent events of a user from Outlook.
It is not required in the Azure AD application to have a redirect URI.
Power Automate Flow:
It is now time to generate the graph token using the HTTP connector in flow which is a pre-requisite to call the Graph API endpoint. The only authentication flow to generate a access token for application permissions is Client credentials.
To generate a token
Store the Client Secret on a String variable
Make a HTTP request using the HTTP connector with the following details. Make sure to replace the string for tenantId, azureAdAppclientId and azureAdAppclientSecret
Method 1:
Add a HTTP connector action to the flow for making a POST request per the following information
For the client secret make sure to URL encode using the expression encodeUriComponent(variables(‘clientSecret’)) else the request will fail due to the presence of special characters.
To extract the token from the above request, add the parse JSON action with Content from the HTTP request body and the following schema
Summary: I have written a blog to get the attendee details of a meeting using this approach to Microsoft graph event endpoint API. Hope you have found this informational & thanks for reading. If you are visiting my blog for the first time, please do take a look at my other Microsoft graph in Power Automate blogposts.
If you have a requirement to access graph endpoint as a signed in user/account on an instant/automated/scheduled flow, this blog post will help you with instructions and steps to access the Microsoft graph API with delegated permissions using the
HTTP connector
Invoke an HTTP request connector
There are resources (Presence information, Planner etc) in Microsoft graph which is available only as delegated permissions and not as application permission. Application permissions can be granted only by an administrator but users can register an application with delegated permission (Except All permission) unless the IT team has restricted the app registration by users.
Access Graph API using HTTP connector:
I have used the HTTP connector to generate a token for accessing the Graph API using the OAuth resource owner Password Credentials grant authentication flow supported by Microsoft Identity platform with the User ID and Password. Once we have the access token, the request to the Graph API endpoint will be made. To follow along this post be ready with the following
Pre-Requisites:
Access to HTTP Premium Connector in Power Automate
Register an application in Azure AD and obtain the client id, client secret & tenant id for the registered application. In this example I have added the delegated permission Presence.Read to get the presence information of the service account.
Add the redirect URI for the web http://localhost as shown on the screenshot below.
The Web redirect URI http://localhost/ is required to provide consent for the Azure AD application for the permission scope by the service account. The consent can be provided by an admin to use this application in flow by all users or the consent has to be provided by an individual user. To provide consent by an individual user in this case by the service account, construct the following url using the tenant ID, Client ID and the scope (ex. Presence.Read)
Now login to Office.com with the service account and enter the above User Consent url on a separate tab for the consent which will bring up a screen similar to the one shown below
Now Click the Accept button to provide consent for the requested permission for the service account. After the Accept button is clicked there will be a message stating that this site cannot be reached or something similar with the url like below on the browser address bar
The consent is provided, to validate the consent login to My Applications link url and the select the Azure AD application from the list and then click Manage your application as shown below
Find below screenshot with consent for Presence.Read permission. To revoke the permission, click Revoke permissions
To provide Admin consent for all the users to use this app in the flow, the URL is
Now we are ready to generate the graph token using the HTTP connector in flow which is a pre-requisite to call the Graph API endpoint. To generate a token in Flow
Store the Client Secret on a String variable
Make the following HTTP request using the HTTP connector
For the client secret and password (only if there is special character), make sure to URL encode using the expression encodeUriComponent(variables(‘clientSecret’)) else the request will fail due to the presence of special characters.
If there is no consent provided by the user/service account for the Azure AD application then the above HTTP request will generate the following error
{“error”:”invalid_grant”,”error_description”:”AADSTS65001: The user or administrator has not consented to use the application with ID ‘xxxxxxx-65xx-47e0-xxxx-xxxxx0bb22′ named AzureADAppName’.
To extract the token from the above request, add the parse JSON action with Content from the HTTP request body and the following schema
Add the Body from the dynamic content from the HTTP – GET Token action to the content of the Parse JSON action
Include the access token when calling the Microsoft Graph API on the Headers sections as shown below. The access_token is from the output of the Parse JSON action
If you run the flow, you can now see the response with the presence information of the service account as shown below
Use Azure Key vault connector to secure the Client Secret & Password information in the flow.
Invoke a HTTP Request connector:
This connector can be used to fetch resources from various web services authenticated by Azure AD including Microsoft Graph in more easier way. Look for the action with the keyword invoke an HTTP request
If it is accessed for the first time, enter https://graph.microsoft.com on both Base and Azure AD resource URI and then click Sign In
Enter the Graph API endpoint on the Url of the request and select the Method
The API is executed in the context of the action’s connection as shown below. In this example it gets the profile information of the serviceaccount
If you get an error similar to { “error”: { “code”: “Forbidden”, “message”: “” } }, then it could be because the connector has a limited set of scopes. Getting Presence information is not supported with this connector as of now. If your scenario requires something more advanced or not currently supported by the connector, please use the �HTTP� connector as shown above or create a custom connector.
Summary: There are many endpoints available with Microsoft graph which can be leveraged for different use cases. Keep in mind the HTTP connector in Power Automate is Premium, you can also consider using this approach in Azure Logic apps. The access token is valid only for an hour, if you have to call a graph api after an hour from the initial token generation time the token has to be obtained again. Hope you have found this informational & thanks for reading. If you are visiting my blog for the first time, please do take a look at my other blogposts.
Microsoft graph is the gateway to data and intelligence in Microsoft 365 which connects multiple services like SharePoint, Teams, Planner etc and devices. Microsoft graph has one common endpoint that is RESTful Web API enabling you to access Microsoft Cloud service resources. With that said if you want to communicate with Microsoft Graph Services or any API services, custom connectors can be used to address needs which are not available as prebuilt connectors in Power Apps and Power Automate. The purpose of this blog post is to show how to
Call Microsoft Graph API in Power Apps using custom connector
Call Microsoft Graph API in Power Automate using custom connector
Custom connector supports the following authentication types
Anonymous (No Authentication)
Basic Authentication (UserName & Password)
API Key
OAuth 2.0
As of the time I am writing this article, custom connector supports only authentication flow Authorization code & not client credentials. If you use OAuth 2.0, it means you can use only delegated permissions & not application permissions as permission type in the custom connector. To be more precise, the logged in user from PowerApps or flow actions/trigger connection user should have access to the resource to be accessed from Microsoft Graph & cannot access the resource as a daemon app (Application Permission). Find below the pre-requisite for the custom connector
Premium Plan (App/user based) for all users intended to use the custom connector in Power Apps or Power Automate. To test the custom connector you can also get a community plan if you do not have a premium plan.
Create & setup Custom Connector to call Microsoft Graph API:
Custom connector can be created from Power Apps maker portal or Power Automate portal. Custom connector created from any of the above-mentioned interfaces can be used in a Power App or Power Automate cloud flow. A custom connector is nothing but a wrapper around a REST API that allows Power Apps or Power Automate and Azure Logic Apps to communicate with that REST API.
Azure Active Directory Application:
To access the Microsoft Rest API there must be an Azure AD app registered with appropriate graph permission intended for the operations through a custom connector. For this example I have registered an AD application with the following delegated permissions
Calendars.Read
To display the users recent events in Power Apps gallery control
Sites.Manage.All
To create a New list item in SharePoint list from Power Apps and Power Automate
User.Read
To display users profile information from an Extension Attribute in Power Apps
Obtain the Client ID from the Overview section of the Azure AD app and create a secret from the Certificates & secrets under Manage blade. Once the secret is created, copy the value to be used in the custom connector.
The Redirect URI is common and will be created while creating the custom connector. Now we are ready to create the custom connector, go to Power Automate portal and expand Data on the left panel > Custom connectors > + New custom connector > Create from blank
After entering the connector name, you will get the below screen. Do not have the word SharePoint part of your connector name to avoid issues.
Enter graph.microsoft.com on Host and some description about the connector. You can also change the logo to a custom one. Now click Security on the right bottom corner to enter the Azure AD application information for the OAuth 2.0 authentication type. Under the section OAuth 2.0
Change the Identity provider to Azure Active Directory
Enter the Client id & Client secret of the Azure AD application
Enter the Scope as Calendars.Read Sites.Manage.All User.Read based on the permissions you have added on the Azure AD app. Leave a space between each permission
After the above information is filled in, click Create connector which will autogenerate the Redirect URL https://global.consent.azure-apim.net/redirect. This is the URL we have added as a Redirect Web URI in the Azure AD application. The connector is now ready to add actions based on Graph API endpoint to
Get users recent events from the users default Outlook calendar
Create a List item in SharePoint List
Get users custom extension attribute from users Active directory profile
Get users recent events from the Outlook calendar:
After the custom connector is created in the above step, now click the Definition tab of the Custom Connector > click + New action which will create the following screen to enter information about the action
After the Summary, Description and Operation ID is entered. Click + Import from sample under the Request section to the enter the Graph API endpoint url https://graph.microsoft.com/v1.0/me/calendar/events.
It is Okay to exclude the url https://graph.microsoft.com since we have provided the information in the Security tab.
Now we are ready to provide default response for the action. To get the request response sample for the graph api endpoint, SignIn to the Graph Explorer with your organizational ID to copy the response of the API request to be used in the custom connector action
After running the query in the graph explorer tool, copy the whole content (CTRL+A) from the Response preview section as shown on the above screenshot. If there is any error related to permissions while executing the http request in the explorer tool, make sure you have consented to the permissions in the Modify permissions tab.
Click + Add default response and then paste the content copied from the graph explorer tool on Body as shown below
Click Import and then click Update connector. Let us add the second action to create a list item in a SharePoint list
You should replace the SiteId and listId in the above URL. Easy way to get the ListId and SiteId is by viewing the Viewing the page source of the SharePoint site with the list open
Request Body:
For this example I have a SharePoint list with a default column Title and a single line of text column by the name Location.
Once again click + New action on the Definition tab to add an action for creating a new list item.
After the Summary, Description and Operation ID is entered click + Import from sample under the Request section to the enter the Graph API endpoint url with the Verb now selected as POST and the request body or payload
Click Import. To get the request response sample for the graph api endpoint, go to the graph explorer to copy the request response as shown below for the above POST request to create the list item
Click + Add default response and then add the response copied from the graph explorer tool on the Body section as shown below
Click Import button and then click Update connector. Let us add the second action to read the users active directory profile to extract extension attribute information
Get users custom extension attribute from users Active directory profile:
On my tenant I have added additional properties on extension attribute in Azure AD profile of the user & displayed them on the User profile card using the profile card graph API. The graph API to get the extension attribute information of the user is in Beta as of now
Once again click + New action on the Definition tab to add the third action for getting the users profile information from Azure active directory.
After the Summary, Description and Operation ID is entered click + Import from sample under the Request section to the enter the Graph API endpoint url with the Verb selected as GET
Click Import. Go to the graph explorer to copy the request response for the GET request for https://graph.microsoft.com/beta/me and then click + Add default response to paste the request response copied from the graph explorer tool. Click Import button and then click Update connector. We have till now added three actions which can be tested in the same interface
Test the Action:
To test the different actions added in the connector, click the Test tab and then click + New connection.
You will be prompted to sign in using the Organization ID and provide a consent for the permissions requested as a scope on the custom connector.
After the connection is created, you can test the different actions available as shown below for one of the action CreateListItem in SharePoint
The custom connector creates the Swagger definition, you can also view and update the Swagger definition by turning on Swagger Editor
If you look at the security definitions in the above screenshot for the connector we have created till now, the authentication flow used to authenticate the user is Authorization code which supports only delegated permissions and not application permissions in MS Graph. The Swagger definition file can be downloaded from interface shown below
The Swagger definition file can be used to re-create the custom connector by clicking the Down arrow and then by clicking Import an OpenAPI file. On the popup window enter the Connector Name and select the downloaded Swagger file to recreate the connector after filling in information on the Security tab.
You download the Swagger definition file of the custom connector with the above mentioned actions from this github link.
Call Microsoft Graph API in Power Apps using custom connector:
To call a custom connector in Power Apps, the first step is to add the connector to the Power App by the app maker. Click Data on the left panel and then click the button Add data > look for the connector by the name > Click the connector name to create a connection.
Once the connection is created & added, you will be able to use it in the different controls added to the app
I added the following controls to
Label – To display the Extension attribute of the user from the action GetUserProfile
Gallery – To display the users recent calendar events from the action
Button – To create new item on the list and to get information from Graph about the user calendar events and to get the users AD profile
A Button control to load the data from Microsoft Graph GET actions GetUserProfile & GetMyEvents on a context variable.
Once we have the data loaded on the context variable using the OnSelect button click event, the data can be displayed on different controls. Use the graph explorer tool to validate the response of the request and to help with display the data on a control. Find below the response for the me endpoint which provides the profile information of user including the extension attribute.
To display the Extension attribute1 information on a label control, the code is
I have added a gallery control to display the calendar events. First step is to bind the gallery control to the context variable (userCalendarEvents) using Items property of the control
Items: userCalendarEvents
On the gallery control fields
field1: ThisItem.subject
field2: ThisItem.organizer.emailAddress.name
For constructing the above formula (Field1 and Field2) for displaying the information on the different fields in the control, graph explorer response preview will help you
I have added a button control to create the list item using the action CreateListItem with the following formula on the OnSelect event
The user has to create a connection to the Custom Connector & provide consent for the Graph permission (User.Read Sites.Manage.All Calendars.Read) for the first time
The users of the app should have premium license (App/user based)
Call Microsoft Graph API in Power Automate using custom connector:
To use a custom connector by a user in a flow Instant/Scheduled/Automated, it
Must be shared to the user by the custom connector Owner/creator
Premium license for the flow user
Consent to be provided for the graph permissions. The consent can be individual or admin consent
Add the action to the flow by clicking Custom and then select the custom connector as shown below
Now select the action
It will ask you to Sign In to create the connection and there will be a prompt to provide consent to the permission for the AD application for the first time as shown below
Enter the parameter values to create the list item
Summary: Microsoft Power Apps and Power Automate are great and simple to get started with no code. If you are a pro developer and want to extend the capabilities with Microsoft Graph & other external/custom RESTFul API’s you can do so with the custom connector. Hope you have found this informational & thanks for reading. If you are visiting my blog for the first time, please do take a look at my other blogposts.
As per this announcement made on Feb 2021, Microsoft graph now provides option to have granular permissions level using Sites.Selected application permission for the AD application instead of granting permission for all the sites in the tenant. The permission Sites.Selected does not provide access to any SharePoint site collections for the application unless the AD application has been assigned with permission roles read or write by an Admin. On this post let us see how to grant a site permission (Read or Write) to an AD Application with Sites.Selected permission by using postman client. As of the time I am writing this post there is no user interface to assign permissions to specific site collections for the application.
Pre-Requisite:
Register Azure AD Application (APP 1) in Azure AD Portal with the following permissions
Sites.Selected (Admin Consented)
Another AD Application (APP 2) with following permission only for the admins to assign selected roles to the above App
Sites.FullControl.All (Admin Consented)
App Registration:
Start with registering the above said two Azure AD applications
Another app for admins for granting roles to APP 1
Grant permission role to the SharePoint site for the Azure AD Application:
This step is grant permission for the Azure AD application with Sites.Selected application permission to a given site collection. Perform the following steps to grant the role (Read/Write or Read and Write) to the AD app (APP 1)
Gather the Client ID, Tenant ID and Client secret of the admin app
In PostMan, make a HTTP request to generate the access token for the admin app – APP 2
Copy the access_token to be used for granting roles.
Get the Client ID of the Azure AD Application – APP 1 with Sites.Selected permission
Decide on the Role (Read or Write) for the granting the Site specific role for the APP 1 with Sites.Selected permission.
Get the SiteId of the SharePoint site to be assigned permissions for the application (App 1). An easy way to get the siteId is by viewing the page source from the browser with the site open.
In PostMan, make a HTTP request to grant the site role to the APP 1. Replace the siteId with the actual siteId which will be a guid
Paste the access token on the token box as shown below with Authorization type selected as Bearer Token
Send the request for granting the role for APP 1. After the request is made the APP 1 with the Sites.Selected permission has access to the site with write role we have granted to. The same way you can assign app access to multiple SharePoint sites.
Grant the Role using PnP PowerShell:
There is a PnP PowerShell cmdlet to grant access to SharePoint site for the registered AD application with Sites.Selected permission. The command to grant permission can be executed by the Site Collection administrator after creating a connection to the site
You will be prompted to enter credentials including the second factor. After the connection is created, enter the following command to grant Write permission to the AD App
To install PnP PowerShell module on the local workstation, enter the following command
Install-Module -Name PnP.PowerShell
There is also a PnP cmdlet to register an AD app in the Azure Active directory.
Grant the Role by an Admin using the Graph Explorer tool:
Role can also be assigned by an admin with out having the admin AD app (APP 2) using the graph explorer tool. This can be done only by an Admin
If there is any error related to permissions, make sure the admin consents to Sites.FullControl.All for the Graph tool. There is also an SPFx community webpart developed by a community member with User Interface for this operation
On this post we have seen how to grant access to Azure AD which has the Sites.Selected permission. You can also grant permission/role to an app with sites.selected permission programmatically. If you are using SharePoint API instead of Graph API in the Azure AD app registration, Sites.Selected is available on Application Permission as shown below
Hope you have found this informational & thanks for reading. If you are visiting my blog for the first time, please do look at my other blogposts.
Do you like this article?
Subscribe to my blog with your email address using the widget on the right side or on the bottom of this page to have new articles sent directly to your inbox the moment I publish them.
Power Automate cloud flows are widely used to automate many business processes and Email is one of most widely used action to send out notifications. Having said that, there will be definitely request to send the email from a generic address instead of the flow creator email address or the email action’s connection owner email address as shown below:
By default, the from Address of the mail generated from Power Automate uses the Flow creator email address as shown above under My connections. To send an email from generic email address, you can
Create a Shared mailbox in exchange online (No license required) and grant access to the flow creator and then use any of the following action in the flow
Send an email
Send an email from a shared mailbox
Use an existing Microsoft 365 group in
Send an email
Setup Shared Mailbox in Exchange Online & Power Automate email actions:
Find steps below to create a shared mailbox in Exchange online & provide delegated permission (Send as) to the flow creator.
Sign into Exchange Admin center. Go to Recipients > Shared and then click New Add Icon. Enter the Name, email address & domain for the shared mailbox and then click Create.
Open the newly created mailbox which opens the mailbox details pane as shown below. Click Manage mailbox delegation.
To use the action Send an email from a Shared Mailbox in the flow
Grant Read and manage and Send As permissions by clicking Edit button>Add permissions and then select the user (Flow Creator) you want to grant permissions to.
Find the flow action for reference
To use the action Send an email in the flow. Grant Send As permissions by clicking Edit button>Add permissions and then select the user (Flow Creator) you want to grant permissions to.
It takes approximately an hour for the permissions to be reflected so as to use in the Power Automate action.
Microsoft 365 group in Send an Email action:
If you have a Microsoft 365 group or a Microsoft Team, you can use the mailbox associated to group in Microsoft Flow for sending the email (Send as). Microsoft Teams creates a Microsoft 365 group whenever a team is created. Let us see how to enable a M365 group in order to use in Power Automate action Send an email action by providing Send as permissions to the flow creator or the email action’s connection owner. Find steps below to grant Send as permissions
Sign into Exchange Admin center. Go to Recipients > Groups and then click the Microsoft 365 group you wish to be used in the flow. Go to Settings>Click Edit manage delegates
Add the Flow creator email address and grant Send as permission
Save changes
Tip:
By default, the Microsoft 365 group are not capable to receiving emails from external senders. To enable it Check the box as shown on the above picture “Allow External senders to email this group”
If the permissions are not set right, you might get any of the following message in the flow
You are not authorized to send mail on behalf of the specified sending account
Specified folder not found. The error could potentially be caused by lack of access permissions. Please verify that you have full access to the mailbox
Summary:
To send an email from third party application you can use the trigger “When a HTTP request is received” with the email action. This trigger generates an anonymous API endpoint which could be used on applications to trigger the flow. Hope you have found this informational. If you are visiting my blog for the first time, please do look at my other blogposts.
Do you like this article?
Subscribe to my blog with your email address using the widget on the right side or on the bottom of this page to have new articles sent directly to your inbox the moment I publish them.
This post is in continuation to my journey with IoT leveraging Microsoft cloud services & it’s technology and based out of few questions I have been asked in few of the events I’ve spoken on the Topic Controlling Devices using Power Apps. In this post let us see how to turn on/off a LED connected to an Arduino UNO board by sending a message from Azure IoT hub or Power Apps with the help of a .NET core console application created from Visual studio code.
What is Arduino UNO Board:
Arduino Uno is an open-source & low cost microcontroller board based on Microchip ATmega328P microcontroller. The board is equipped with digital and analog Input/Output pins that can be interfaced with other circuits. If there is a need to collect data from sensors (Temperature, Humidity etc) then the mode of the pin should be Input and for controlling devices or activating relays the pin mode must be Output. For this example since we will have to turn on/off a LED, the pin mode has to set as Output.
Arduino IDE:
The IDE is a cross platform application written using C++. If you have worked with an Arduino board already, you would have probably used the Arduino IDE to deploy code called as Sketch. The code written on the sketch is compiled to a HEX file (Machine language) which can be understood by the microcontroller once the sketch is uploaded. The hex file is then sent to the Arduino UNO board using the USB port.
Find below the design with information on the different components used:
Azure IoT Hub:
IoT hub is a managed service hosted in cloud that acts as a central message hub for bi-directional communication from the device to the cloud and the cloud to the device. There is an also a Free-Tier limited to one per subscription which can add up to 500 devices and 8000 msgs/day as of today based on the Pricing calculator. Create a IoT Hub for us to send a message to the Arduino UNO device as per the instruction given in the article. After the IoT hub is created.
A device must be registered with your IoT hub before it can connect. There are different ways to register a device like using Azure Cloud shell, in this case we will use portal. Click IoT Devices under the Explorers blade on the IoT hub and click on + New, enter the Device ID and click save.
Copy the Primary key of the registered device
Copy the Hostname from the IoT Hub Overview blade
These values will be used later in the .NET console application
Arduino Sketch:
Let us now create a simple Arduino project sketch from Visual studio code to send signal to Arduino Board using the serial port with the help of the Nuget package System.IO.Ports. Make sure the Arduino IDE and the Arduino extension for VS code is installed. The Arduino board can now be plugged in to the USB port of your laptop or computer with the provided cable. Follow the below mentioned steps to create an Arduino sketch template from VS Code
Create a folder on the development machine for the Arduino project and then open the folder in Visual Studio code
In VS Code, hit the key CTRL+Shift+P to open the command pallete
Type the command Arduino: Initialize which will try to create a file with name app.ino. Change the name of the file relevant to your project. I have named it as ControlDevicesforCSharp.ino.
You will now be prompted to select the name of the Arduino board. I have selected Arduino UNO. You can also select the board and port from the VS Code right bottom corner as shown below
The serial port will be visible if the board in plugged in and recognized by the computer. This is how it looks after the board and the port is selected.
Now update the code as shown below to receive signal from the console application. If it receives a value of A to the character variable inputValue from the console application, then the PIN 13 is set to HIGH which means it generates 5v as an output and if the inputValue is B the PIN 13 is set to LOW which means the Output of the pin will be zero as opposed to 5v when set to HIGH. If you want, you can connect a LED to the PIN 13 with a 220 ohm resistor bu the pin 13 has a in-built LED to test. You can also notice on the code the PIN mode for 13 is set to Output.
#define BaudRate 9600
char inputValue;
int led1 = 13;
void setup() {
// Initialize serial communication at 9600 bits per second
Serial.begin(BaudRate);
// Prepare the digital output pins
pinMode(led1, OUTPUT);
// Initially all are off
digitalWrite(led1, LOW);
}
// the loop function runs over and over again forever
void loop()
{
// Reads the input
inputValue = Serial.read();
if(inputValue == 'A')
{
// Turn on the LED
digitalWrite(led1, HIGH);
}
else if (inputValue == 'B')
{
// Turn off the LED
digitalWrite(led1, LOW);
}
}
Now you verify the sketch by pressing CTRL+AL+R if there is any compile error. If all is well, you can now upload the sketch by pressing the key CTRL+ALT+U. If the upload is successful, you will the following message on the VS output terminal
Now the sketch is ready, it is now time to create the console application to receive message from Azure IoT hub to control the LED from cloud applications like Power Apps.
.NET core console Application:
The package System.IO.Ports supports to control serial ports which will be used to send message to Arduino board (A or B) to turn on or off the LED. Follow the below given steps to create the console application
Use the same directory you have used to create the Arduino sketch. On the VS Code terminal window, enter the command dotnet new console to create a new console application
Add the package System.IO.Ports using the nuget package manager plugin by CTRL+SHIFT+P > NuGet Package Manager: Add Package or enter the command on the terminal window dotnet add package System.IO.Ports –version 6.0.0-preview.1.21102.12
Method Encoding.ASCII.GetString(receivedMessage.GetBytes()) reads the message
Method deviceClient.CompleteAsync(receivedMessage, _ct) deletes the message from the queue
The following code establishes the connection on the serial port COM4
// Initialises the serial port communication on COM4
SerialPort = new SerialPort("COM4")
{
BaudRate = 9600,
Parity = Parity.None,
StopBits = StopBits.One,
DataBits = 8,
Handshake = Handshake.None
};
// Subscribe to the event
SerialPort.DataReceived += SerialPortDataReceived;
// Now open the port.
SerialPort.Open();
With the help of the following method to Subscribe
static void SerialPortDataReceived(object sender, SerialDataReceivedEventArgs e)
{
var serialPort = (SerialPort)sender;
// Read the data that's in the serial buffer.
var serialdata = serialPort.ReadExisting();
}
The code SerialPort.Write(“A”) send the message to the Arduino Sketch.
Now run the dotnet application using the command dotnet run. Now send a message from the Azure IoT explorer or from Azure portal IoT device explorer ON1 or Off1 to turn On/Off the LED connected to PIN 13
There are many organizations maintaining multiple domains on a single Microsoft 365 or Azure AD tenant, in those cases there might be a need to create dynamic Microsoft 365 groups, security groups & distributions list based on the user’s domain to manage the group’s membership. On this blogpost, let us see how to
Create Dynamic Microsoft 365 group based on the user’s domain for Teams & Yammer
Create a Dynamic distribution list based on user’s domain in Exchange online
To begin with let us see some basics of a Dynamic group. The membership of a dynamic group will automatically update as people join, leave, or move within the organization whenever the user’s Azure Active Directory attributes are changed. In simple terms, rules determines the group membership. The users will be added or removed automatically as and when the user attributes change or users join and leave the tenant which reduces the administrative effort of adding and removing users from a group. Dynamic group can be created based on variety of attributes including role, location, department etc.
Create Dynamic Microsoft 365 group based on the user’s domain for Teams & Yammer
Microsoft Teams and Yammer (Microsoft 365 Connected) supports dynamic membership. It enables the membership of Team or Yammer to be defined by one or more rules that check for certain attributes in Azure AD. Microsoft Teams & Yammer creates a Microsoft 365 group in Azure AD. For this post, the membership rule will be simple one which is based on the user’s domain and country. You can also have a complex rule involving multiple Azure AD attributes like Title, Geography, Department etc. Before we proceed further, there are some pre-requisite & facts to be considered before creating a dynamic group.
User Administrator or Global administrator role in Azure AD
Users you foresee to be part of a dynamic group membership rule should have an Azure AD premium License P1 or P2
Microsoft 365 E3, E5, Front line workers MF3 & MF1 has Azure AD premium 1 service which should suffice.
An Azure AD organization can have maximum of 5000 dynamic groups.
Any number of Azure AD resources can be members of a single group.
Dynamic Membership based on Domain for Teams:
To create a Dynamic membership MS team, create a Microsoft 365 group first with Dynamic membership in Azure Active directory. You can create a dynamic group from PowerShell but here I will be using Azure Ad GUI to create the dynamic Microsoft 365 group with rule to add users based on their domain and country. I have added a domain m365pal.me to my Azure AD tenant which I will be using here for this example.
Sign in to Azure AD Admin center with administrator role in the Azure AD organization
Click Groups and then click + New Group
Select the Group type as Microsoft 365. Dynamic membership will also work with Security group but for team it should be Microsoft 365 group.
Enter the Group Name & Group email address
Select the Membership type as Dynamic User
Select the Owner and then
Under Dynamic user members section, click Add dynamic query
In Dynamic membership rules panel, add rule to define membership based on users domain & country
First rule for Domain: under Property column select userPrinicipalName, Operator should be Contains and the Value should be the domain name in format “@yourdomain.com”. This rule will add all users with the UPN user@yourdomain.com. Now click + Add expression to add the second rule
Second rule for country: under Property column select country, Operator should be Equals and the value should be the country name.
You can also validate the rules by clicking the link Validate Rules and then by adding users to check if the user satisfies the rule
Click Save. This is how it should look like
Click Create.
After waiting for couple of minutes, check the group membership. Please find below screenshot for the group which has two members satisfying the condition. You can also notice the + Add members link is disabled since the group is dynamic membership and not assigned. To modify the rules, click the link Dynamic membership rules link.
Now we are ready to create the MS Teams, go to https://teams.microsoft.com/ and then click Join or create a team at the left bottom corner and then Click Create a team
Click From a group or team and then click Microsoft 365 group
Now select the group you have created in Azure AD and then click Create.
The team is now created, you can find the team on the list. Check the membership of the team which will have the two users satisfying the rules and the owner of the group. One more thing to notice here is the message which says The membership settings prevents you from adding or removing members.
Voila! Dynamic Microsoft team is now created & setup.
If you have an existing team to be converted to a Dynamic team, find the Microsoft 365 group in Azure AD for the Team you wish to convert and then update the membership status from Assigned to Dynamic user with membership rules
Dynamic Membership based on Domain for Yammer:
Yammer (Microsoft 365 Connected) also supports dynamic membership. Find the steps below to create a dynamic yammer group based on the user’s domain. Find the steps below
Click Create a Community and then Enter the name of the Community
Click the button Create
Now sign in to Azure AD Admin center to the update the membership settings of the Microsoft 365 group connected to the Yammer community. Find the yammer group and then click
Click Properties under the Manage blade and then change the membership type from Assigned to Dynamic user
After updating the membership type to Dynamic user. You will now have option to enter the dynamic query. Click dynamic query
In Dynamic membership rules panel, add rule to define membership based on users domain
Rule for Domain: under Property column select userPrinicipalName, Operator should be Contains and the Value should be the domain name in format “@yourdomain.com”. This rule will add all users with the UPN user@yourdomain.com. Now click + Add expression to add rules based on need
Click Save
Click Save. Wait for couple of minutes for the membership to be updated.
Now check the Yammer group in Yammer.com for the membership status. Please find below screenshot for your reference which will not have the + icon on the highlighted members section for adding users since this is now a dynamic yammer group
Also, Microsoft 365 group/Security group can be used for different use cases. See some sample use cases below
You can use to target SharePoint page/news to specific audience with the help of Microsoft 365 group or Security group. Will it not be more powerful if you use dynamic groups within a SharePoint to target content certain group of audience!
Assign Microsoft Licenses to users based on Dynamic Group.
Grant access to an App (PowerApps etc) using the dynamic group targeting certain departments, geographies etc
Create a Dynamic distribution list based on user’s domain in Exchange online:
Dynamic distribution groups are mail-enabled Active Directory group to distribute email messages to all its members within a Microsoft Exchange organization. Unlike regular distribution lists that contain a defined set of members, the membership list for dynamic distribution groups is calculated each time a message is sent to the group, based on the filters and conditions that you define in the group. You can create a Dynamic Distribution list from Exchange Admin center as shown below but the options to write advanced filter conditions or rules are limited so PowerShell is preferred.
Dynamic Distribution list from PowerShell:
Make sure the Exchange online PowerShell module is installed. There are some limitations to create a recipient filter (Rules) that worked based on user’s domain with the operator like or contains but there is a workaround. The filter works based on the exchange property WindowsEmailAddress which is always the primary SMTP address, you can also consider using the property WindowsLiveID. Follow the steps below to create a Dynamic Distribution list based on user’s domain
Load the module by the running the command Import-Module ExchangeOnlineManagement
After authentication, enter the following command to create the Dynamic DL based on User’s domain. I have added the RecipientTypeDetails in the RecipientFilter to apply the filter rule only to user mailboxes which excludes the SharedMailboxes
Summary: On this post we have seen how to create dynamic groups based on user’s domain. Do some planning to start using the dynamic groups which will help reduce lot of administrative overhead. Hope you have found this informational & helpful. Let me know any feedback or comments on the comment section below
Is there a need to find the type of Microsoft 365 license and the different services assigned for a user to troubleshoot an issue related to the service they have been assigned? You have come to the right place, this post will help you find the details using the Microsoft Graph API endpoints. In Microsoft 365, licenses from licensing plans also known as SKUs give users access to the Microsoft 365 services that are defined for those plans. To find the details, there are endpoints in Graph which gives you those details
There are various tools to make request against different graph endpoints but here I will be using Microsoft Graph Explorer tool.
After you login to Microsoft Graph Explorer tool, make a request to any of the above given endpoints. Find below screenshot for the GET request to the endpoint me/licenseDetails
In the above picture, the sku Id is nothing but the Microsoft 365 license plan and the service plans array shows list of the Microsoft 365 Services (SharePoint, Power Apps, Power Automate, Exchange, Yammer etc) enabled for the user. If there are multiple license assigned for the same user then you get the list as an array with different skuid’s.
For reference, here are some of the most common sku id information that you might need:
Name
ID
Office 365 E1
18181a46-0d4e-45cd-891e-60aabd171b4e
Microsoft 365 E3
05e9a617-0261-4cee-bb44-138d3ef5d965
Microsoft 365 E5
06ebc4ee-1bb5-47dd-8120-11324bc54e06
E5 Developer License
c42b9cae-ea4f-4ab7-9717-81576235ccac
Microsoft 365 F1
17b4a1d6-2c65-478e-a046-51cf40d25d76
Power BI (Free)
a403ebcc-fae0-4ca2-8c8c-7a907fd6c235
Flow Free
f30db892-07e9-47e9-837c-80727f46fd3d
Here are some of the most common Service plan Id information:
Name
ID
SharePoint Online
5dbe027f-2339-4123-9542-606e4d348a72
Yammer
7547a3fe-08ee-4ccb-b430-5077c5041653
Power Apps
9c0dab89-a30c-4117-86e7-97bda240acd2
Power Automate
07699545-9485-468e-95b6-2fca3738be01
AAD Premium 2
eec0eb4f-6444-4f95-aba0-50c24d67f998
Exchange Online
efb87545-963c-4e0d-99df-69c6916d9eb0
For more information on the different Microsoft 365 license & service details, refer the below link
The information can also be accessed from your Office Profile, after logging in to the Office.com
Click the Profile icon and then click View account which will take you to the below screen shown on the left side
Now click Subscriptions which will show the all the different SKU’s assigned to you & the different service plan’s. Refer to the above picture on the right side.
PowerShell:
To access this information with PowerShell, refer the following documentation:
Summary: On this post we have seen how to get information on the assigned Microsoft License & services details for a user. Hope you like this article & find it informational.
On this post let us see how to trigger or run a WebJob from Power Automate. WebJob is a powerful service in Azure keeping in mind the supported file types or programs it can run. Before proceeding with the instructions to call a WebJob in Power Automate, let us see some basics of an Azure WebJob. WebJobs is a feature of Azure App Service that enables you to run a program or script in the same instance of the Azure web app with no additional cost. As of now it is not supported in App service plan for Linux. There are two types of WebJobs
Continuous WebJob
Starts immediately when the WebJob is created. To keep the job from ending, the program or script typically does its work inside an endless loop.
Runs on all instances that the web app runs on. You can optionally restrict the WebJob to a single instance.
Triggered WebJob
Starts only when triggered manually or on a schedule based on CRON expression.
Runs on a single instance that Azure selects for load balancing.
Supported file types for scripts or programs:
The following file types are supported:
.cmd, .bat, .exe (using Windows cmd)
.ps1 (using PowerShell)
.sh (using Bash)
.php (using PHP)
.py (using Python)
.js (using Node.js)
.jar (using Java)
Check here the documentation from Microsoft to choose between Flow, Logic Apps, Functions & Webjobs for your automation services with comparisons against each other. If you are using a Function app with a Consumption plan your function can run only to a max of 10 mins. If you have a long running task on a webjob, set this property in the App service Application setting from the Configuration blade as shown below
The above setting is to avoid idling out if there is no CPU activity. The IDLE timeout setting is set to 1 hour in the above screenshot.
Azure WebJobs SDK:
There is a Powerful Azure WebJobs SDK which simplifies the task of writing background processing code that runs in WebJobs. It makes it easier to write code that reads or writes from Azure Storage account and it also facilitates to trigger the WebJob if there is any new data on the queue, blob, table, service bus for an event driven architecture. Azure functions is built on the WebJobs SDK. If you set your web app to run continuous or scheduled (timer-trigger) WebJobs, enable the Always on setting on your web app’s Azure Configuration page to ensure that the WebJobs run reliably. This feature is available only in the Basic, Standard, and Premium tiers of the App service plan.
Create and Deploy a WebJob:
To call a WebJob from Power Automate, let us create a Triggered WebJob (.Net Framework) from Visual Studio. There is a also support for .NET Core console apps as WebJobs. Refer this documentation from Microsoft to create a WebJob from Visual Studio. In Visual studio there is a template to create a WebJob project as shown below
This is how the VS project looks like
The Program.cs has the code to ensure that the Job will be running continuously, for this case it is not required comment or remove the code which is highlighted. The Functions.cs has the code to pick up the message from the Storage Queue (Event-Driven) through the WebJobs SDK runtime, the WebApp must set to Always on to make it work. For this example, it is not required since it is going to be a triggered Job so the file Functions.cs can be deleted.
If you have any arguments to be passed from Power Automate, you can access it on your code as shown below
To deploy the WebJob, right click the project and select Publish. If there is no publish profile yet, create one or export it from Azure WebApp and then Publish. To know more about the Publish settings In the Publish tab, choose Edit as shown below
The WebJob will be now in Azure. Go to your Azure WebApp or App Service and click WebJobs under the settings blade to find the WebJob deployed from Visual Studio. Find the WebJob in the Azure portal
WebJobs API endpoint for the WebJob:
There are API endpoints available for the Azure WebJob which will be used for triggering the WebJob from Power Automate. Go through the following documentation for more details on the list of available endpoints:
To Trigger or Start a WebJob, you should have the Webhook URL from the Azure Portal. To get the URL, click Properties after selecting the WebJob as shown below
Copy the Web hook URL, User Name and Password to be later used in Power Automate. Let us trigger the WebJob from Postman client using the above information
Till now we have the WebJob published in Azure, can we call an API in Power Automate. Yes, it is possible with the help of the Premium action HTTP as shown below
Voila! The WebJob has been triggered from Power Automate.
Summary: On this post we have seen how to call a WebJob using PowerAutomate. There is also a trigger to calla Flow from a PowerApp, which could be used to start the WebJob. Hope you have found this informational & helpful. Let me know any feedback or comments on the comment section below
When you create a Microsoft Team, a Microsoft 365 group is created to manage the team membership like Owners, members, guests. I would rather say the Microsoft 365 group is a backbone of a Team. Through the group you also get an email address for the MS team. Find the other Microsoft 365 services which gets created per this documentation whenever there is a Team provisioned
On this blogpost let us see how to enable a team which can also act as an email distribution list so that you can send an email to all the team members, by default this option is disabled. You will have to be an Owner of the team to set this up. There are couple of ways to do this
Graph Explorer
Outlook
Exchange Online Powershell
Exchange Online Administrator
Graph Explorer:
Graph explorer is a utility that will let you make requests and get responses against the different graph endpoints as a signed in user (Delegated User). To enable the email distribution functionality, we will have to get the group id of the team for setting a value to True for the property autoSubscribeNewMembers. To get the Group Id information go to the Team and click the Get link to team as shown below
Copy the content from the popup which should be in the below format
The Microsoft 365 group inbox for a Team is not available in Outlook but it can be accessed through the SharePoint site associated to the group. Open the SharePoint site from any of the Teams channel as shown below
On the Group Settings popup, enable the Subscription as shown below and then Save it. By default this setting is disabled for the Microsoft 365 group.
Exchange Online PowerShell:
The same setting can also be enabled from Exchange online PowerShell if you have Exchange online Administrator access on the tenant. Make sure the Exchange online PowerShell module is installed. Follow the steps below to turn on AutoSubscribeNewMembers which distributes emails to all users
Load the module by the running the command Import-Module ExchangeOnlineManagement
To disable the setting: Set-UnifiedGroup -Identity ” Team Display Name ” -AutoSubscribeNewMembers:$false
Refer to the documentation from Microsoft for more Exchange online commands related to the Microsoft 365 group.
Exchange Online Administrator
Login into the Exchange Online Admin center and click on Groups from the dashboard section. Execute the below steps
Find the group associated to the team (Team Display Name) from the list and then select
Click on Edit (Pencil Icon) from the ribbon
On the General tab, Enable the property Subscribe new members and then Save
Summary: The same setting can also be applied to a Team created through a Microsoft 365 group. Hope you have found this informational. There were already lot of blogs talking about groups
Mohamed Ashiq Faleel 