Logic Apps on JanBakker.tech

Trigger Logic App on group membership changes in Entra ID

Sat, 11 Oct 2025 10:14:26 +0000

A couple of years ago, I stumbled upon a neat Logic App / Power Automate connector that can respond to changes in group membership. Act on group membership changes in Azure Active Directory - JanBakker.tech

Today, I’d like to give it some more love, since this is a very powerful, but underrated and probably also unknown piece of magic that will help you in a lot of automation scenarios. Especially when you are responsible for IAM Governance and lifecycle, but probably for a ton of other use cases.

Poor man’s IGA: Generate Temporary Access Pass for joiners

Tue, 10 Jun 2025 18:31:40 +0000

This post is part of the “Poor Man’s IGA” series. The idea is simple: we pick one feature from the Entra ID Governance stack, and think of an alternative, cheap(er) way to get it done. Why?

Every organization deserves proper IAM tools.
Entra ID Governance is excellent, but too expensive for most organisations.
Get the most out of your existing license and built-in features.

Most of all, making solutions as outlined in the post is like playing with LEGO. You will have different building blocks that can also be (re)used in other processes. Working with Logic Apps, managed identities, and Graph API will give you great flexibility to create your own creative solutions.

Microsoft 365 end-user notifications for changes in authentication methods

Wed, 21 Feb 2024 22:25:20 +0000

When moving away from traditional and weak authentication methods like passwords to stronger ones like Authenticator App and passkeys, it’s essential to keep informed when some of these methods change. Organizations moving to modern authentication are facing new challenges around onboarding and recovery of authentication methods, as attackers can also use this to settle in someone’s account by simply adding an extra authentication method. Entra ID will log this event, but no out-of-the-box feature informs the user.

A love story about Role Based Access Control for Applications in Exchange Online, Managed Identities, Entra ID Admin Units, and Graph API

Wed, 15 Nov 2023 21:41:34 +0000

I’ve learned something new today. Hear me out.

Up until now, sending emails using managed identities trough Graph API was a bit of a hassle. You needed to grant access using Graph API or Powershell first, but before you could do that, you needed to find the correct IDs for Graph API, the Managed Identity, and the permission itself. Lucky for us, Jan Vidar spoiled us with this nice blog post, which I used pretty often.

How to create a Temporary Access Pass using Logic Apps

Sat, 21 Oct 2023 09:22:26 +0000

Now that more and more organizations are moving towards passwordless, a Temporary Access Pass becomes indispensable for onboarding and recovery. Using Logic Apps (or Power Automate), organizations can automate and integrate the creation of Temporary Access Passes in their current IT processes. Logic Apps can be triggered from customer service tools like ServiceNow or TOPdesk, to start fully automated workflows.

Mailbox usage reports, Graph API, and Logic Apps. What's not to like?

Thu, 29 Dec 2022 17:40:37 +0000

Exchange Online does a pretty good job when it comes to alerting on mailbox storage. Exchange Online provides three kinds of notifications when a user’s mailbox is nearing or at capacity:

Warning: The user receives an email warning that the mailbox is approaching the maximum size limit. This warning is intended to encourage users to delete unwanted mail.
Prohibit Send: The user receives a prohibit-send notification email when the mailbox size limit is reached. The user can’t send new messages until enough email is deleted to bring the mailbox below the size limit.
Prohibit Send/Receive: Exchange Online rejects any incoming mail when the mailbox size limit is reached and sends a non-delivery report (NDR) to the sender. The sender has the option to try resending the mail later. To receive messages again, the user must delete emails until the mailbox is below the size limit.

And still, we find ourselves getting helpdesk tickets about mailboxes that can no longer send or receive email. It’s time to dive into the Exchange Storage reports. A good report can be downloaded from the Microsoft 365 admin center, but that is a manual action. What if we could download the report automatically, and use it to trigger some actions?

How to keep track of changes on Microsoft Docs & Learn?

Sun, 09 Oct 2022 21:01:04 +0000

When working with cloud services like Microsoft 365 or Azure Active Directory in particular, it’s very important to stay on top of new features and/or product changes. As you might know, the documentation for these services is stored on GitHub. This is where those changes will often reflect.

Automate issuing Temporary Access Pass for joiners with LifeCycle Workflows

Mon, 03 Oct 2022 13:31:49 +0000

On September 30th, 2022, Pim Jacobs and I did a session on the brand new Lifecycle Workflows feature in Azure AD Identity Governance. During that session, I did a demo showing the integration with Logic Apps. Using this extension, I could use the Graph API to create a new Temporary Access Pass for a new hire, 7 days before the first workday. This post will describe the steps to build the solution.

Use Microsoft Graph Security for end-user notifications

Wed, 19 Aug 2020 13:11:23 +0000

In this short blog post, I want to show how you can use the Microsoft Graph Security to send alerts and notifications to your end-users. I also want to show you that it is super easy to set up. All you need is:

Bulk dismiss risky users with Power Automate or Logic Apps

Thu, 06 Aug 2020 07:48:02 +0000

Update 08-10-2020: Microsoft released an official connector for Azure AD Identity Protection. This would be much easier to use, since you don’t have to create a service principal to authenticate the custom connector. However, at the time of writing the official connector does not have the action to get all the risky users. Will keep an eye on things.

Prepopulate phone methods using a Custom Connector in Power Automate

Thu, 30 Jul 2020 07:30:00 +0000

This blog post shows the custom connector that is built on top of the Microsoft Graph API. With this connector, you can do bulk actions on Azure AD and provision phone numbers for your users. They can be used for MFA and SSPR. To understand how the connector works, please also read the first part of the blog where I explain the API in detail. In the second part, I have added a step-step-guide on how to create the custom connector and use it in an automation flow.

Prepopulate phone methods for MFA and SSPR using Graph API

Thu, 30 Jul 2020 07:29:00 +0000

Use Power Automate as your Conditional Access Police Department

Sat, 04 Jul 2020 07:10:42 +0000

Last week, I was working on a new blog for the Secure Score Series regarding global admin and break glass accounts. I came to the point where I was thinking of possible scenarios that could go wrong with these accounts. What if someone accidentally added these users to a certain group? What if that group would be triggered in some policy or maintenance tasks? A lot of these actions can be discovered using Microsoft Cloud App Security and Azure Monitor. This way, you will be alerted when someone touches the accounts in any way, or if the account is used to sign-in.

Use Power Automate or Logic Apps to keep an eye on your licenses

Sat, 27 Jun 2020 18:37:43 +0000

I guess we’ve all been there; you ran out of licenses in your Azure AD or Office 365 tenant. Despite you hang out in your admin portal every day, you were still taken by surprise when you discover an issue, caused by a license shortage. More often this is caused by the fact that the people who are responsible to buy these licenses, are not always IT admins. So it’s easy to run out of licenses. Time to get this fixed.

Use Graph API data in Power BI using Logic Apps

Sat, 09 May 2020 12:50:34 +0000

Some things in the modern connected world seem so common that you just assume it’s possible by nature. Getting your Microsoft Graph API data into Microsoft Power BI for example. That must be easy peasy right? Well….

When I start looking for ways to do this, I assumed there was a builtin connector available in Power BI that I could use. Guess what? There is not (yet). There is a connector for the Microsoft Security Graph, but that one “only” gives back the data from the security products. Just good to know that it’s out there, but that’s not what we’re looking for.