Entra ID application provisioning and user re‐enablement

Entra ID application provisioning and user re-enablement

This page documents the PowerShell script eid-resetapp-set-direct.ps1, which provisions or updates an Entra ID application, adds a secret, ensures the service principal exists, assigns application permissions, and can optionally re-enable a user through Microsoft Graph.

The script uses Microsoft Graph directly via the Microsoft Graph PowerShell SDK and does not depend on Azure CLI.

Overview

The script is designed for administrators who need a production-friendly, low-dependency method to:

• create or update an Entra application registration
• add a client secret for app authentication
• ensure the application has a service principal
• assign Microsoft Graph application permissions
• generate an admin-consent URL for tenant-wide approval
• optionally re-enable a user account by UPN or object ID
• optionally run in app-only recovery mode without a delegated user sign-in

Prerequisites

Before running the script, confirm the following:

1. PowerShell 7 or later is installed.
2. The Microsoft Graph PowerShell authentication module is available:

   Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

3. The account running the script has sufficient permissions to:
   • create or update applications
   • create or update service principals
   • assign Graph application permissions
   • re-enable a user account when required

What the script does

Standard provisioning flow

When run without the app-only switch, the script:

1. connects to Microsoft Graph using an interactive device-code sign-in
2. looks for an existing application with the requested display name
3. creates or updates the application registration
4. adds a client secret
5. ensures a service principal exists
6. updates the application with the required Graph permissions
7. builds an admin-consent URL
8. optionally re-enables a user account

App-only recovery flow

When run with -AppOnly, the script uses the supplied application credentials to connect to Microsoft Graph without a delegated user login. This is intended for recovery scenarios where a break-glass application is used to re-enable a user account.

Parameters

Parameter	Description
-AppName	Display name for the application to create or update. Defaults to Reset-Operations-App if not supplied.
-Force	Skips confirmation prompts and runs non-interactively.
-SkipConsentUrl	Prevents copying the consent URL to the clipboard.
-TenantId	Tenant ID to target. Defaults to organizations for interactive tenant selection.
-UserPrincipalName	User principal name of the account to re-enable.
-UserObjectId	Object ID of the account to re-enable.
-ReEnableUser	Enables the user re-enable operation after provisioning or recovery setup.
-AppOnly	Uses app-based authentication instead of interactive sign-in.
-ClientId	Client ID of the app used for app-only authentication.
-ClientSecret	Client secret for the app used for app-only authentication.
-CertificateThumbprint	Certificate thumbprint to use for certificate-based app-only authentication.
-CertificatePath	Path to a certificate file to use for certificate-based app-only authentication.

Examples

Provision or update an application interactively

. .\eid-resetapp-set-direct.ps1 -AppName "Reset-Operations-App" -Force

Provision or update an application and re-enable a user

. .\eid-resetapp-set-direct.ps1 `
  -AppName "Reset-Operations-App" `
  -TenantId "<tenant-id>" `
  -ReEnableUser `
  -UserPrincipalName "director@contoso.com"

Run in app-only recovery mode

. .\eid-resetapp-set-direct.ps1 `
  -AppOnly `
  -ClientId "<app-client-id>" `
  -ClientSecret "<client-secret>" `
  -TenantId "<tenant-id>" `
  -ReEnableUser `
  -UserPrincipalName "director@contoso.com"

Use certificate-based app-only authentication

. .\eid-resetapp-set-direct.ps1 `
  -AppOnly `
  -ClientId "<app-client-id>" `
  -CertificateThumbprint "<thumbprint>" `
  -TenantId "<tenant-id>" `
  -ReEnableUser `
  -UserObjectId "<user-object-id>"

Permissions assigned by the script

The script assigns the following Microsoft Graph application permissions:

• User.EnableDisableAccount.All
• Directory.ReadWrite.All
• User.ReadWrite.All

These are broad administrator-level permissions and should be reviewed carefully before use in a production environment.

Admin consent

After the script creates or updates the application, it displays a consent URL. The URL can be copied to the clipboard and opened in a browser so a tenant administrator can grant consent.

Security considerations

• Use this script only in a controlled and approved administrative context.
• Store secrets securely and avoid hard-coding credentials into scripts or documentation.
• Prefer certificate-based authentication for production if available.
• Review the application permissions carefully before granting consent.
• App-only recovery mode should be limited to approved break-glass scenarios.

Notes

• The script uses direct REST calls to Microsoft Graph rather than relying on Azure CLI.
• The script is intended to be idempotent: running it again will update the existing application instead of creating duplicate objects.
• In app-only mode, the script skips the provisioning flow and focuses on the recovery workflow.

Expected output

The script prints a summary that includes:

• the operation status
• the tenant ID
• the application object ID
• the application client ID
• the app secret (when created)
• the service principal ID
• the consent URL
• the re-enabled user identity when applicable