Microsoft Graph APIを利用して、Entra IDのアプリのシークレットを操作する

// PowerShellGetの最新化
PS> Install-Module PowerShellGet

// SDkのインストール。必要なApplicationサブモジュールのみ。
// 認証に必要な「Microsoft.Graph.Authentication」は自動的にインストールされる。
PS> Install-Module Microsoft.Graph.Applications -Scope CurrentUser

// インストール確認
PS> Get-InstalledModule
・・・
2.11.1               Microsoft.Graph.Applications    ・・・
2.11.1               Microsoft.Graph.Authentication　・・・
・・・

$cert = New-SelfSignedCertificate -Subject "CN=MS Graph Test" -CertStoreLocation `
    "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 `
    -KeyAlgorithm RSA -HashAlgorithm SHA256

Export-Certificate -Cert $cert -FilePath "./msgraph.cer"

$clientId = $env:AZURE_CLIENT_ID
$tenantId = $env:AZURE_TENANT_ID
$cert = "CN=MS Graph Test"

Connect-MgGraph -ClientId $clientId -TenantId $tenantId -CertificateName $cert | Out-Null
Get-MgContext

Get-MgApplication

Find-MgGraphCommand -command Get-MgApplication | Select-Object -First 1 -ExpandProperty Permissions

Name                          IsAdmin Description                               
----                          ------- -----------                               
Application.Read.All          True    Read applications                         
Application.ReadWrite.All     True    Read and write applications               
Application.ReadWrite.OwnedBy False   Manage apps that this app creates or owns 
Directory.Read.All            True    Read directory data                       
Directory.ReadWrite.All       True    Read and write directory data

$appId = $env:AZURE_APPLICATION_ID
$params = @{
    passwordCredential = @{
        displayName = "Cretaed by PowerShell"
        endDateTime = (Get-Date).AddDays(1).ToString("yyyy-MM-ddThh:mm:ss")
    }
}
Add-MgApplicationPassword -ApplicationId $appId -BodyParameter $params

// Application(client) ID
$clientId = $env:AZURE_CLIENT_ID
$appInfo = Get-MgApplicationByAppId -AppId $clientId

$checkDate = (Get-Date).AddDays(7).ToString("yyyy-MM-ddThh:mm:ss")
$secretInfo = $appInfo.PasswordCredentials | Where-Object { $_.EndDateTime -lt $checkDate }

$delParams = @{
    keyId = $secretInfo.KeyId
}
Remove-MgApplicationPassword -ApplicationId $appId -BodyParameter $delParams