Graph version of `Set-AzureADApplicationProxyApplicationCustomDomainCertificate`

[timja]

Hi

I'm looking to upload application proxy custom domain certificates.
The only way outside the portal I can find to do this is:
https://learn.microsoft.com/en-us/powershell/module/azuread/set-azureadapplicationproxyapplicationcustomdomaincertificate?view=azureadps-2.0

Which is in the deprecated AzureAD module that has big warnings around using it:
https://learn.microsoft.com/en-us/powershell/azure/active-directory/migration-faq?view=azureadps-2.0#what-happens-to-azure-ad-powershell-come-june-2023

Is there a graph endpoint or an alternative to this deprecated SDK?

[erose96]

I have ran into the same issue and I have not seen a replacement for this functionality in the Graph API (or any of the SDKs which call it).

This doc indicates you can use the graph api to update a cert for an enterprise application but only for the keyCredentials properties which are unrelated to app proxy custom domain certs. Other cmdlets have been created for the rest of app proxy configuration management. The AzureAD -> Graph API cmdlet map also does not have any replacements listed for the app proxy application management cmdlets.

This article updated last in October 2022 recommends to use the old Set-AzureADApplicationProxyApplicationCustomDomainCertificate cmdlet which is soon to be deprecated. According to the FAQ, these cmdlets should continue to work even after the official deprecation date but I would like to migrate my workflows before then.

[timja]

There are these resources documented for the beta graph API https://learn.microsoft.com/en-us/graph/api/resources/onpremisespublishing?view=graph-rest-beta

But I wasn't able to work it for verifiedCustomDomainKeyCredential and verifiedCustomDomainPasswordCredential it just gave me bad request with message invalid JSON

[erose96]

I was able to work out the syntax some, I was able to get the following REST request to work in the Graph Explorer with global admin credentials ({applicationObjectId} being replaced with the application registration's object id):

PATCH https://graph.microsoft.com/beta/applications/{applicationObjectId}/onPremisesPublishing
BODY:
{
    "isTranslateLinksInBodyEnabled": true
}

No C# / PowerShell code snippet was available which makes me think this functionality does not exist in the C# / Pwsh SDKs yet.

Here is the javascript snippet it generated:

const options = {
	authProvider,
};

const client = Client.init(options);

const onPremisesPublishing = {isTranslateLinksInBodyEnabled: true};

await client.api('/applications/{appObjId}/onPremisesPublishing')
	.version('beta')
	.update(onPremisesPublishing);

But I have the same issue with the metadeta property that you do as it's read-only.

I tried a POST to the /addPassword endpoint of the application with verifiedCustomDomainPasswordCredential as the property in the body and got a 204 after I sorted the permissions out. But I do not see a way to update the cert file / thumbprint using the onPremisesPublishing properties.

The explorer offered the following PowerShell snippet for the request I got a 204 for (replace "123" with your password string):

Import-Module Microsoft.Graph.Applications

$params = @{
	verifiedCustomDomainPasswordCredential = "123"
}

Add-MgApplicationPassword -ApplicationId $applicationId -BodyParameter $params

[timja]

Yes the other stuff is fine, I've written an app here that can handle most of it:
https://github.com/hmcts/azure-app-proxy-manager

but I can't figure out ssl certificates

[timja]

Support / product group were able to figure it out via Graph API:

Import-Module Microsoft.Graph.Applications
 
Connect-MgGraph -Scope Directory.ReadWrite.All
 
Select-MgProfile -Name Beta
 
$applicationId = "REPLACE" # ObjectId in App Registration
$certPfxFilePath = "REPLACE" # File path to the pfx file, like C:\test\cert.pfx
$certPassword = "REPLACE" # Password that protects the pfx file
 
$params = @{
      onPremisesPublishing = @{
            verifiedCustomDomainKeyCredential = @{
                  type="X509CertAndPassword";
                  value = [convert]::ToBase64String((Get-Content $certPfxFilePath -AsByteStream));
            };
            
            verifiedCustomDomainPasswordCredential = @{ value = $certPassword };
      }
}
 
Update-MgApplication -ApplicationId $applicationId -BodyParameter $params

Implemented in my CLI in hmcts/azure-app-proxy-manager#5

[nextxpert]

The procedure with the beta version of Microsoft.Graph.Applications no longer works.

We resolved this using Invoke-RestMethod and the following code:

    $clientID = "REPLACE" # ClientID for App Registration running the script
    $tenantId = "$tenantID_Prefix.onmicrosoft.com"
    $MSGraphCert = Get-ChildItem Cert:\CurrentUser\my\$Certificate
    $Token = Get-MsalToken -ClientId $clientID -TenantId $tenantID -RedirectUri "http://localhost" -ClientCertificate $MSGraphCert -ForceRefresh

    $AccessToken = $Token.AccessToken
    $applicationId = "REPLACE" # ObjectId in App Registration
    $certPfxFilePath = "REPLACE" # File path to the pfx file, like C:\test\cert.pfx
    $certPassword = "REPLACE" # Password that protects the pfx file
    
    $body = @{
        onPremisesPublishing = @{
            verifiedCustomDomainKeyCredential = @{
                type="X509CertAndPassword";
                value = [convert]::ToBase64String((Get-Content $certPfxFilePath -AsByteStream));
            };

            verifiedCustomDomainPasswordCredential = @{ value = $certPassword };
        }
    }

    $jsonBody = if ($body) { $body | ConvertTo-Json -Depth 10 -Compress }

    $Uri = 'https://graph.microsoft.com/beta/applications/$AppRegId'
    $header = @{Authorization = "Bearer $AccessToken" }
    if ($ConsistencyLevel) {
        $header.add('ConsistencyLevel', $ConsistencyLevel)
    }

    Invoke-RestMethod -Uri $Uri -Method $Patch -ContentType 'application/json' -Headers $Headers -Body $jsonBody -ErrorAction Stop