Skip to content

Switch ExecuteAzCommandRobustly calls to Invoke-Az with native array format #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

Switch ExecuteAzCommandRobustly calls to Invoke-Az with native array format #144

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a4a5a2f
Initial plan
Copilot May 5, 2026
761d02e
Switch ExecuteAzCommandRobustly calls to Invoke-Az and eliminate dire…
Copilot May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 17 additions & 18 deletions SCEPman/Private/app-service.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ function CreateSCEPmanAppService ( $SCEPmanResourceGroup, $SCEPmanAppServiceName
}

function GetAppServicePlan ( $AppServicePlanName, $ResourceGroup, $SubscriptionId) {
$asp = ExecuteAzCommandRobustly -azCommand "az appservice plan list -g $ResourceGroup --query `"[?name=='$AppServicePlanName']`" --subscription $SubscriptionId" | Convert-LinesToObject
$asp = Invoke-Az @("appservice", "plan", "list", "-g", $ResourceGroup, "--query", "[?name=='$AppServicePlanName']", "--subscription", $SubscriptionId) | Convert-LinesToObject
return $asp
}

Expand All @@ -166,11 +166,11 @@ function IsAppServicePlanLinux ($AppServicePlanId) {
}

function GetAppServiceHostNames ($SCEPmanResourceGroup, $AppServiceName, $DeploymentSlotName = $null) {
if ($null -eq $DeploymentSlotName) {
return ExecuteAzCommandRobustly -azCommand "az webapp config hostname list --webapp-name $AppServiceName --resource-group $SCEPmanResourceGroup --query `"[].name`" --output tsv"
} else {
return ExecuteAzCommandRobustly -azCommand "az webapp config hostname list --webapp-name $AppServiceName --resource-group $SCEPmanResourceGroup --slot $DeploymentSlotName --query `"[].name`" --output tsv"
$command = @("webapp", "config", "hostname", "list", "--webapp-name", $AppServiceName, "--resource-group", $SCEPmanResourceGroup, "--query", "[].name", "--output", "tsv")
if ($null -ne $DeploymentSlotName) {
$command += @("--slot", $DeploymentSlotName)
}
return Invoke-Az -azCommand $command
}

function GetPrimaryAppServiceHostName ($SCEPmanResourceGroup, $AppServiceName, $DeploymentSlotName = $null) {
Expand All @@ -183,7 +183,7 @@ function GetPrimaryAppServiceHostName ($SCEPmanResourceGroup, $AppServiceName, $
}

function GetAppServiceVnetId ($AppServiceName, $ResourceGroup) {
$vnetId = ExecuteAzCommandRobustly -callAzNatively -azCommand @("webapp", "show", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--query", 'virtualNetworkSubnetId', "--output", "tsv")
$vnetId = Invoke-Az @("webapp", "show", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--query", 'virtualNetworkSubnetId', "--output", "tsv")
return $vnetId
}

Expand All @@ -192,7 +192,7 @@ function SetAppServiceVnetId ($AppServiceName, $ResourceGroup, $vnetId, $Deploym
if ($null -ne $DeploymentSlotName) {
$command += @("--slot", $DeploymentSlotName)
}
$null = ExecuteAzCommandRobustly -callAzNatively -azCommand $command
$null = Invoke-Az -azCommand $command
}

function CreateSCEPmanDeploymentSlot ($SCEPmanResourceGroup, $SCEPmanAppServiceName, $DeploymentSlotName) {
Expand All @@ -204,15 +204,14 @@ function CreateSCEPmanDeploymentSlot ($SCEPmanResourceGroup, $SCEPmanAppServiceN
Write-Information "Specified Production Slot Activation as such via AppConfig:AuthConfig:ManagedIdentityEnabledForWebsiteHostname"
}

$azOutput = az webapp deployment slot create --name $SCEPmanAppServiceName --resource-group $SCEPmanResourceGroup --slot $DeploymentSlotName --configuration-source $SCEPmanAppServiceName
$null = CheckAzOutput -azOutput $azOutput -fThrowOnError $true
$null = Invoke-Az @("webapp", "deployment", "slot", "create", "--name", $SCEPmanAppServiceName, "--resource-group", $SCEPmanResourceGroup, "--slot", $DeploymentSlotName, "--configuration-source", $SCEPmanAppServiceName)
Write-Information "Created SCEPman Deployment Slot $DeploymentSlotName"

return Convert-LinesToObject -lines $(az webapp identity assign --name $SCEPmanAppServiceName --resource-group $SCEPmanResourceGroup --slot $DeploymentSlotName --identities [system])
return Convert-LinesToObject -lines $(Invoke-Az @("webapp", "identity", "assign", "--name", $SCEPmanAppServiceName, "--resource-group", $SCEPmanResourceGroup, "--slot", $DeploymentSlotName, "--identities", "[system]"))
}

function GetDeploymentSlots($appServiceName, $resourceGroup) {
$deploymentSlots = ExecuteAzCommandRobustly -azCommand "az webapp deployment slot list --name $appServiceName --resource-group $resourceGroup --query '[].name'" | Convert-LinesToObject
$deploymentSlots = Invoke-Az @("webapp", "deployment", "slot", "list", "--name", $appServiceName, "--resource-group", $resourceGroup, "--query", "[].name") | Convert-LinesToObject
if ($null -eq $deploymentSlots) {
return @()
} else {
Expand Down Expand Up @@ -276,7 +275,7 @@ function ConfigureSCEPmanInstance ($SCEPmanResourceGroup, $SCEPmanAppServiceName
if ($null -ne $DeploymentSlotName) {
$azCommand += @("--slot", $DeploymentSlotName)
}
$null = ExecuteAzCommandRobustly -callAzNatively -azCommand $azCommand
$null = Invoke-Az -azCommand $azCommand
Write-Verbose "[$SCEPmanAppServiceName-$DeploymentSlotName] Backed up ApplicationKey"
}

Expand Down Expand Up @@ -318,7 +317,7 @@ function ConfigureCertMasterAppService($CertMasterResourceGroup, $CertMasterAppS
$isCertMasterLinux = IsAppServiceLinux -AppServiceName $CertMasterAppServiceName -ResourceGroup $CertMasterResourceGroup
$CertmasterAppSettingsJson = AppSettingsHashTable2AzJson -psHashTable $CertmasterAppSettings -convertForLinux $isCertMasterLinux

$null = ExecuteAzCommandRobustly -azCommand "az webapp config appsettings set --name $CertMasterAppServiceName --resource-group $CertMasterResourceGroup --settings '$CertmasterAppSettingsJson'"
$null = Invoke-Az @("webapp", "config", "appsettings", "set", "--name", $CertMasterAppServiceName, "--resource-group", $CertMasterResourceGroup, "--settings", $CertmasterAppSettingsJson)
}

function Update-ToConfiguredChannel {
Expand All @@ -342,8 +341,8 @@ function Update-ToConfiguredChannel {
} else {
Write-Verbose "Artifacts URL is $ArtifactsUrl"
if ($PSCmdlet.ShouldProcess($AppServiceName, ("Switching App Service to channel {0}" -f $intendedChannel))) {
$null = ExecuteAzCommandRobustly -azCommand @("webapp", "config", "appsettings", "set", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--settings", "WEBSITE_RUN_FROM_PACKAGE=$ArtifactsUrl") -callAzNatively
$null = ExecuteAzCommandRobustly -azCommand "az webapp config appsettings delete --name $AppServiceName --resource-group $ResourceGroup --setting-names ""Update_Channel"""
$null = Invoke-Az -azCommand @("webapp", "config", "appsettings", "set", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--settings", "WEBSITE_RUN_FROM_PACKAGE=$ArtifactsUrl")
$null = Invoke-Az @("webapp", "config", "appsettings", "delete", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--setting-names", "Update_Channel")
}
}
}
Expand Down Expand Up @@ -387,7 +386,7 @@ function SetAppSettings($AppServiceName, $ResourceGroup, $Settings, $Slot = $nul
$command += @('--slot', $Slot)
}

$null = ExecuteAzCommandRobustly -callAzNatively -azCommand $command
$null = Invoke-Az -azCommand $command
$processedSettingsCount++
Write-Progress -Activity "Setting app settings" -Status "Processed $processedSettingsCount of $totalSettingsCount settings" -PercentComplete (($processedSettingsCount / $totalSettingsCount) * 100)
}
Expand All @@ -397,8 +396,8 @@ function SetAppSettings($AppServiceName, $ResourceGroup, $Settings, $Slot = $nul
}

function ReadAppSettings($AppServiceName, $ResourceGroup) {
$slotSettings = ExecuteAzCommandRobustly -azCommand "az webapp config appsettings list --name $AppServiceName --resource-group $ResourceGroup --query `"[?slotSetting]`"" | Convert-LinesToObject
$unboundSettings = ExecuteAzCommandRobustly -azCommand "az webapp config appsettings list --name $AppServiceName --resource-group $ResourceGroup --query `"[?!slotSetting]`"" | Convert-LinesToObject
$slotSettings = Invoke-Az @("webapp", "config", "appsettings", "list", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--query", "[?slotSetting]") | Convert-LinesToObject
$unboundSettings = Invoke-Az @("webapp", "config", "appsettings", "list", "--name", $AppServiceName, "--resource-group", $ResourceGroup, "--query", "[?!slotSetting]") | Convert-LinesToObject

Write-Information "Read $($slotSettings.Count) slot settings and $($unboundSettings.Count) other settings from app $AppServiceName"

Expand Down
18 changes: 9 additions & 9 deletions SCEPman/Private/appregistrations.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
function RegisterAzureADApp($name, $appRoleAssignments, $replyUrls = $null, $homepage = $null, $EnableIdToken = $false, $createIfNotExists = $true) {
$azureAdAppReg = Convert-LinesToObject -lines $(az ad app list --filter "displayname eq '$name'" --query "[0]" --only-show-errors)
$azureAdAppReg = Convert-LinesToObject -lines $(Invoke-Az @("ad", "app", "list", "--filter", "displayname eq '$name'", "--query", "[0]", "--only-show-errors"))

if($null -eq $azureAdAppReg) {
if ($createIfNotExists) {
Expand Down Expand Up @@ -28,7 +28,7 @@ function RegisterAzureADApp($name, $appRoleAssignments, $replyUrls = $null, $hom
}
}

$azureAdAppReg = Convert-LinesToObject -lines $(ExecuteAzCommandRobustly -callAzNatively -azCommand $azAppRegistrationCommand)
$azureAdAppReg = Convert-LinesToObject -lines $(Invoke-Az -azCommand $azAppRegistrationCommand)
Write-Verbose "Created app registration $name (App ID $($azureAdAppReg.appId))"

# Check whether the AppRoles were added correctly
Expand Down Expand Up @@ -60,7 +60,7 @@ function RegisterAzureADApp($name, $appRoleAssignments, $replyUrls = $null, $hom
if ($anything2Update) {
Write-Information "Adding new roles to app registration $name"
$appRolesJson = HashTable2AzJson -psHashTable $updatedAppRoles
ExecuteAzCommandRobustly -callAzNatively -azCommand @("ad", "app", "update", "--id", $azureAdAppReg.appId, "--app-roles", $appRolesJson)
Invoke-Az -azCommand @("ad", "app", "update", "--id", $azureAdAppReg.appId, "--app-roles", $appRolesJson)

# Reload app registration with new roles
$azureAdAppReg = Invoke-Az -azCommand $('ad', 'app', 'show', '--id', $azureAdAppReg.id) | Convert-LinesToObject
Expand All @@ -80,7 +80,7 @@ function RegisterAzureADApp($name, $appRoleAssignments, $replyUrls = $null, $hom
# ExecuteAzCommandRobustly -callAzNatively -azCommand @("ad", "app", "update", "--id", $azureAdAppReg.appId, "--web-home-page-url", $homepage, "--web-redirect-uris", $allReplyUrls)
}
$azCommandToAddReplyUrls += $existingReplyUrls + $replyUrlsToAdd
ExecuteAzCommandRobustly -callAzNatively -azCommand $azCommandToAddReplyUrls
Invoke-Az -azCommand $azCommandToAddReplyUrls
}
}
$azureAdAppReg.web.redirectUris
Expand All @@ -97,7 +97,7 @@ function CreateSCEPmanAppRegistration ($AzureADAppNameForSCEPman, $CertMasterSer
$servicePrincipalScepmanId = CreateServicePrincipal -appId $($appregsc.appId)

# Expose SCEPman API
ExecuteAzCommandRobustly -azCommand "az ad app update --id $($appregsc.appId) --identifier-uris `"api://$($appregsc.appId)`""
Invoke-Az -azCommand @("ad", "app", "update", "--id", $appregsc.appId, "--identifier-uris", "api://$($appregsc.appId)")

Write-Information "Allowing CertMaster to submit CSR requests to SCEPman API"
$ScepManSubmitCSRPermission = $appregsc.appRoles.Where({ $_.value -eq "CSR.Request"}, "First")
Expand All @@ -124,7 +124,7 @@ function CreateCertMasterAppRegistration ($AzureADAppNameForCertMaster, $CertMas
$null = CreateServicePrincipal -appId $($appregcm.appId)

# Expose CertMaster API
ExecuteAzCommandRobustly -azCommand "az ad app update --id $($appregcm.appId) --identifier-uris `"api://$($appregcm.appId)`""
Invoke-Az -azCommand @("ad", "app", "update", "--id", $appregcm.appId, "--identifier-uris", "api://$($appregcm.appId)")

Write-Verbose "Adding Delegated permission to CertMaster App Registration"
# Add Microsoft Graph's User.Read as delegated permission for CertMaster
Expand All @@ -145,7 +145,7 @@ function Add-AzAsTrustedClientApplication {
param(
[Parameter(Mandatory=$true)]$AppId
)
$AppJson = ExecuteAzCommandRobustly -callAzNatively -azCommand @('ad', 'app', 'show', '--id', $AppId)
$AppJson = Invoke-Az -azCommand @('ad', 'app', 'show', '--id', $AppId)
$AppObject = Convert-LinesToObject -Lines $AppJson

$existingAzAuthorization = $AppObject.api.preAuthorizedApplications | Where-Object { $_.appId -eq $AzAppId }
Expand All @@ -160,7 +160,7 @@ function Add-AzAsTrustedClientApplication {
$preAuthorizationsBody = "{'api':{'preAuthorizedApplications':$($preAuthorizationsInner.Replace("delegatedPermissionIds", "permissionIds").Replace('"', "'"))}}"

if ($PSCmdlet.ShouldProcess("Application with id $($AppObject.id)", "Add az (App Id: $AzAppId) as authorized application")) {
$null = ExecuteAzCommandRobustly -callAzNatively -azCommand @('rest', '--method', 'patch', '--uri', "https://graph.microsoft.com/beta/applications/$($AppObject.id)", '--body', $preAuthorizationsBody, '--headers', 'Content-Type=application/json')
$null = Invoke-Az -azCommand @('rest', '--method', 'patch', '--uri', "https://graph.microsoft.com/beta/applications/$($AppObject.id)", '--body', $preAuthorizationsBody, '--headers', 'Content-Type=application/json')
}

return $true
Expand Down Expand Up @@ -188,6 +188,6 @@ function Remove-AzAsTrustedClientApplication {
$previousPreAuthorizationsBody = "{'api':{'preAuthorizedApplications':$($previousPreAuthorizationsInner.Replace("delegatedPermissionIds", "permissionIds").Replace('"', "'"))}}"

if ($PSCmdlet.ShouldProcess("Application with id $($AppObject.id)", "Remove az (App Id: $AzAppId) as authorized application")) {
$null = ExecuteAzCommandRobustly -callAzNatively -azCommand @('rest', '--method', 'patch', '--uri', "https://graph.microsoft.com/beta/applications/$($AppObject.id)", '--body', $previousPreAuthorizationsBody, '--headers', 'Content-Type=application/json')
$null = Invoke-Az -azCommand @('rest', '--method', 'patch', '--uri', "https://graph.microsoft.com/beta/applications/$($AppObject.id)", '--body', $previousPreAuthorizationsBody, '--headers', 'Content-Type=application/json')
}
}
10 changes: 5 additions & 5 deletions SCEPman/Private/key-vault.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@ function AddSCEPmanPermissionsToKeyVault ($KeyVault, $PrincipalId) {
$null = Invoke-Az @("role", "assignment", "create", "--role", "Key Vault Secrets User", "--assignee-object-id", $PrincipalId, "--assignee-principal-type", "ServicePrincipal", "--scope", $KeyVault.id)
} else {
Write-Information "Setting policy permissions for Key Vault"
$null = ExecuteAzCommandRobustly -azCommand "az keyvault set-policy --name $($KeyVault.Name) --object-id $PrincipalId --subscription $($KeyVault.SubscriptionId) --key-permissions get create unwrapKey sign"
$null = ExecuteAzCommandRobustly -azCommand "az keyvault set-policy --name $($KeyVault.Name) --object-id $PrincipalId --subscription $($KeyVault.SubscriptionId) --secret-permissions get list"
$null = ExecuteAzCommandRobustly -azCommand "az keyvault set-policy --name $($KeyVault.Name) --object-id $PrincipalId --subscription $($KeyVault.SubscriptionId) --certificate-permissions get list create managecontacts"
$null = Invoke-Az @("keyvault", "set-policy", "--name", $KeyVault.Name, "--object-id", $PrincipalId, "--subscription", $KeyVault.SubscriptionId, "--key-permissions", "get", "create", "unwrapKey", "sign")
$null = Invoke-Az @("keyvault", "set-policy", "--name", $KeyVault.Name, "--object-id", $PrincipalId, "--subscription", $KeyVault.SubscriptionId, "--secret-permissions", "get", "list")
$null = Invoke-Az @("keyvault", "set-policy", "--name", $KeyVault.Name, "--object-id", $PrincipalId, "--subscription", $KeyVault.SubscriptionId, "--certificate-permissions", "get", "list", "create", "managecontacts")
}
}

Expand Down Expand Up @@ -67,8 +67,8 @@ function New-IntermediateCaCsr {
#az keyvault certificate create --policy @C:\temp\certs\keyvault\rsa-policy.json --vault-name $vaultName --name $certificateName

# The direct graph call instead works
$creationResponseLines = ExecuteAzCommandRobustly -azCommand @("rest", "--method", "post", "--uri", "$($vaultUrl)certificates/$certificateName/create?api-version=7.0",
"--headers", "Content-Type=application/json", "--resource", $vaultDomain, "--body", $caPolicyJson) -callAzNatively
$creationResponseLines = Invoke-Az -azCommand @("rest", "--method", "post", "--uri", "$($vaultUrl)certificates/$certificateName/create?api-version=7.0",
"--headers", "Content-Type=application/json", "--resource", $vaultDomain, "--body", $caPolicyJson)
$creationResponse = Convert-LinesToObject -lines $creationResponseLines

Write-Information "Created a CSR with Request ID $($creationResponse.request_id)"
Expand Down
6 changes: 3 additions & 3 deletions SCEPman/Private/log-analytics.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -390,12 +390,12 @@ function AddLogIngestionAPISettings($ResourceGroup, $AppServiceName, $DcrDetails
function AddAppRoleAssignmentsForLogIngestionAPI($ResourceGroup, $AppServiceName, $DcrDetails, $SkipAppRoleAssignments = $false) {
$servicePrincipal = GetServicePrincipal -appServiceNameParam $AppServiceName -resourceGroupParam $ResourceGroup
if($null -ne $servicePrincipal.principalId) {
$azCommandToAssignRole = "az role assignment create --role 'Monitoring Metrics Publisher' --assignee-object-id $($servicePrincipal.principalId) --assignee-principal-type ServicePrincipal --scope $($DcrDetails.id)"
$azCommandToAssignRole = @("role", "assignment", "create", "--role", "Monitoring Metrics Publisher", "--assignee-object-id", $servicePrincipal.principalId, "--assignee-principal-type", "ServicePrincipal", "--scope", $DcrDetails.id)
if($SkipAppRoleAssignments) {
Write-Warning "Skipping app role assignment (please execute manually): $azCommandToAssignRole"
Write-Warning "Skipping app role assignment (please execute manually): az $($azCommandToAssignRole -join ' ')"
return
}
$null = ExecuteAzCommandRobustly -azCommand $azCommandToAssignRole
$null = Invoke-Az -azCommand $azCommandToAssignRole
Write-Information "Role 'Monitoring Metrics Publisher' assigned to the App Service $AppServiceName service principal"
} else {
Write-Information "$AppServiceName does not have a System-assigned Managed Identity turned on"
Expand Down
Loading