Powershell script to prompt for ObjectID disable AzureAD account revoke token

[bodminman]

Hi there,

 

I ain't no good with the Powershell stuff but that partly because I need to devote the time to it.

 

I currently do the following to disable an AzureAD account and to then revoke the token:

 

Connect-AzureAD

Install-Module AzureAD

Set-AzureADUser -ObjectID PERSONS_EMAIL_ADDRESS -AccountEnabled $false

Get-AzureADuser -ObjectID PERSONS_EMAIL_ADDRESS |Revoke-AzureADUserAllRefreshToken

 

My question is, is there a way to prompt for the value of ObjectID prior to running the disable and revoke token bits?

 

At the moment I'm editing the script each time I want to use it.

 

Thanks in anticipation.

 

Best wishes and keep safe!

[Steve21]

Depending on the type of that data you could just do something like

 

$id = Read-Host "Enter ID"

 

then use the $id instead of PERSONS_EMAIL_ADDRESS

 

Steve

[TechMonkey]

That's similar to what I have done

$user = Read-Host -Prompt 'Input user to disable (exclude the domain)'
$userDomain = $user +'@DOMAIN.TLD'

 

This way I have the username for some other code and the email for use with Azure.

[Davit2005]

Something like below to capture data which is then called later on. If you ever get into PowerShell get into the habit of commenting the scripts so you and anyone else gets the gist of what the script is doing.

 

 

#Create a variable and ask it to wait for an input, name of variable for this does not matter as long as the same vairiable is used where the data is called

$ObjectIDOrSomething = Read-Host "Enter the target email address"

 

 

Connect-AzureAD

Install-Module AzureAD

# Call the data captured by the input

Set-AzureADUser -ObjectID $ObjectID-Or-Something -AccountEnabled $false

Get-AzureADuser -ObjectID $ObjectID-Or-Something |Revoke-AzureADUserAllRefreshToken

 

Once you get into to powershel you can get quite creative, I am no expert but if you know what you want to do even if you have to break it down to small chunks a lot is possible. I can never remember much of the syntax because I do not use it a lot these days.

Edited January 29, 2021 by Davit2005

[bodminman]

Thanks @Steve21

 

The data would be the email address of the account that I want to disable. At the moment I am having to change the email address part before I run it. I would like it so that I'm prompted for the email address and could then just type it in once when the script is running.

 

So would the script then look like this?

 

Connect-AzureAD

Install-Module AzureAD

$id = Read-Host "Enter ID"

Set-AzureADUser -ObjectID $id -AccountEnabled $false

Get-AzureADuser -ObjectID $id |Revoke-AzureADUserAllRefreshToken

[Davit2005]

Thanks @Steve21

 

The data would be the email address of the account that I want to disable. At the moment I am having to change the email address part before I run it. I would like it so that I'm prompted for the email address and could then just type it in once when the script is running.

 

So would the script then look like this?

 

Connect-AzureAD

Install-Module AzureAD

$id = Read-Host "Enter ID"

Set-AzureADUser -ObjectID $id -AccountEnabled $false

Get-AzureADuser -ObjectID $id |Revoke-AzureADUserAllRefreshToken

 

Yes that should work @TechMonkey has a good point that you can save the typing by automatically adding the domain to what has been input at the prompt.

 

In actual fact that's how I used to do it with AD and Azure years back.

Edited January 29, 2021 by Davit2005

[bodminman]

Thanks everyone.

 

I have tested the following with success:

 

[HPlum78]

So for what it's worth as I have only just seen this you could setup a group in AD called CompromisedAccounts (what ever you want) and then have a script that looks at that group continually for accounts that get dropped in it and then runs all the bits to disable the account, remove the tokens and reset the password and such likes in one go. All you are then doing is dropping in the accounts to a group. This is what we do and you can limit who is able to add accounts to the group and what accounts are allowed to be added and how many accounts are processed in one go and all that jazz...