Microsoft Flow and Azure AD – let’s automate!
When I speak with organizations we often discuss scenarios such as having an onboarding process that is in need of a front-end utility and automation. Many organizations have cloud services and on premises applications where the user onboarding process in some cases is still a manual procedure. To assist with these processes and many others, Microsoft offers as service called Microsoft Flow. I’m always looking for creative uses of applications and Microsoft Flow offers just what we need to help automate processes such as account management across applications and services. In addition, Microsoft Flow goes well beyond just automating a user management processes (e.g. onboarding) as discussed below.
What is Microsoft Flow?
“Microsoft Flow is a service that helps you create automated workflows between your favorite apps and services to synchronize files, get notifications, collect data, and more.”
Source: /en-us/flow/getting-started
Microsoft Flow allows you to create workflows to automate tasks, for example, when files are added to a folder in a cloud storage environment such as OneDrive or Box, notify a user. Or create an approval workflow process to manage tweets before they’re posted to Twitter.
Microsoft Flow offers connectors to connect to either cloud applications or on premises environments.
To view a list of Microsoft Flow connectors, please visit: https://us.flow.microsoft.com/en-us/connectors/
In addition, there are many pre-defined templates that may be utilized such as starting an approval process when a new item is added to SharePoint or save tweets to an Excel file or sync files between cloud drives or a file server via FTP. The list goes on and on…
To view a list of Microsoft Flow templates, please visit: https://us.flow.microsoft.com/en-us/templates/
Microsoft Flow Licensing
Some features are free and require premium Flow sku. For more details about Microsoft Flow licensing please visit: https://flow.microsoft.com/en-us/pricing/
Microsoft Flow FAQ: https://docs.microsoft.com/en-us/flow/frequently-asked-questions
For this post, I will utilize Microsoft Flow to create users in Azure AD as well as provide custom bonus flows! so let’s get started…
As an administrator, the first thing we need to do is access Microsoft Flow and create a new workflow.
Navigate to https://flow.microsoft.com and sign-in.
Search for Azure AD in the search box provided as shown below:
From the results page, locate and select “Create Azure AD User From Button”
From there select “Continue” to add the template:
For more details about the Microsoft Flow Azure AD connector and templates, please visit: https://us.flow.microsoft.com/en-us/connectors/shared_azuread/azure-ad/
From here you can use the template as is and select Create flow, or you change the name and edit the steps in the template provided:
I chose to edit the “Send an email” step in the flow as I wanted a little more detail, I began the editing process by selecting “Send an email”:
The default template only offers a one-line sentence of info, however I changed it to add information the manager and the end user would need:
We can also edit each flow step or add more if necessary by deleting or adding fields (if the field is used downstream in the flow you’ll need to delete the field first downstream):
“Adding an Azure AD User” Flow in action
The great thing about Microsoft Flow is a flow may be run on a schedule, via an event or trigger, or manually from the web or the Mobile app.
Additionally, Flow templates may be shared out to other users to access as well, so administrators don’t always need to be in the process. Ultimately a Flow template configuration is up to you and what works best for your processes within your organization
Flow Web App
To manually start the newly created Flow template, when in the Flow template select “More” from the top and then select “Run now”
From there the template with a list of fields will open for a user to manually fill in:
Once all the fields are filled in properly, select “Run flow” and a new user will be created in Azure AD. I show more details and results below using the mobile app.
Mobile App
I find the Microsoft Flow mobile app very easy to use, especially when on the go. In fact, flows may be created and edited directly from the Microsoft Flow app.
Download the Microsoft Flow app from your favorite app store, in my case I have the iOS app installed on my device. The first time Microsoft Flow app is launched you’ll need to sign into your Azure AD tenant (be sure that user has rights to create users, groups, access apps, etc.).
Select “Buttons” at the bottom of the app:
Locate the the button that will create the Azure AD User:
Fill out the form and submit:
Here are my inputs from my Flow template process, when finished select “Done” at the top of the app and the Flow will run:
Once the Flow has completed, we can look at the run history and the details of each flow process (great for troubleshooting as well):
Expanding the “Send an email” flow we see the following:
Below is the customized email received by a user or manager after the user is created (including a randomly generated password):
Lastly, below is the user that was created by the Flow process in the Azure AD admin portal:
Dynamic groups
Once users are created, dynamic group memberships may be used to automatically assign users to group, for example, any user may be dynamically assigned to Group A. Group A can also be assigned to licenses, SaaS applications or assigned to SharePoint Online/OneDrive, so as soon as a user is assigned to a group they’ll have access to the licenses and apps assigned to it.
Dynamic group membership eases the management process of adding and removing users to applications. Simply assign a group to the application permission and use dynamic group rules to automatically assign and remove users. You can even use attributes such as employeeId, mail, or companyName as attributes to look for, however there are many more attributes to choose from and depending where the users originates from, you may want to get creative. Finally, for applications that support provisioning, users may be automatically provisioned and provisioned to SaaS applications which provides full user lifecycle management.
For more details about Azure AD Dynamic Groups please visit: /en-us/azure/active-directory/active-directory-groups-dynamic-membership-azure-portal
BONUS FLOWS
Need to disable or enable sign-on for a user quickly in Azure AD (i.e. O365, Dynamics365, etc.) from your mobile device? I created Flows to do that.
Current sign-in state of the user shown in Azure AD and O365 Portals (it’s the same setting btw) shown below:
I created a button in Microsoft Flow and filling out the following fields in red:
When the flow is run, type in the UPN (email address) of the users and flow will disable sign-on for that user.
New sign-in state of the user shown in Azure AD and O365 Portals (it’s the same setting btw) now blocked shown below:
Enable sign-on for an Azure AD user
Follow the Flow creation process above to create a Flow to enable a user to sign-on, however change the “Account Enabled” setting to “Yes”. Note: Flows may be copied, to copy a flow select Save As for the flow you’d like to copy in the Flow portal and modify from there.
As a result we’ll end up with two flow as shown below:
And the flow buttons on my mobile device:
Delete Azure AD Users
Now a question you may have is “can we delete Azure AD Users using a button?” You could, however there is nothing built in with Flow or connectors today. A custom app would need to be developed with the proper permissions to the Microsoft Graph to delete an account then added to flow. So this would be more of a custom development approach that what I demonstrated in this post. As a result, using Microsoft Flow we can create a custom connector that will call into the app registered with Azure AD to make calls to delete users using a button flow in Microsoft Flow. Same holds true for resetting user passwords.
With Microsoft Flow, the possibilities are endless with the predefined templates and built-in connectors to services, you don’t have to be a developer to automate processes and workflows!