Discussion on "How to easily backup your Azure environment using EntraExporter and Azure DevOps Pipeline"

Ondrej Sebela · 2023-09-29T11:36:13.622Z

💡 27.3.2024 modified to use Workload Federation Identity instead of a separate Azure Service Principal In the previous article, I focused on making an automated backup of the Intune configuration. Today I will show you, how to regularly back up yo...

Thank you for so quickly fixing the authentication problem. I was troubleshooting and thought I'd check your github to see if you had seen the problem and it was already fixed!

Thats the benefit when the author uses his own creations 😁

Hi, unfortunately, I'm running into a new issue after I've migrated both the Intune- and Entra-Backup from Service Principals to Workload Federating Identities. The Intune-backup works fine, but Entra backup always stops at a certain point:

Removing existing backup directory

04:01 (UTC) Creating Azure config backup Organization/Organization.json Organization/Branding/Localizations.json Organization/CertificateBasedAuthConfiguration.json Directory/OnPremisesSynchronization.json Export-Entra: /home/it/myagent/_work/_temp/eeb6d2b1-b111-46fb-a950-1dca2d9b13d4.ps1:36 Line | 36 | Export-Entra "$root\prod-backup" -CloudUsersAndGroupsOnly | ~~~~~~~~~~~~~ | GET | graph.microsoft.com/v1.0/directory/onPremisesSync…redacted HTTP/2.0 403 Forbidden Cache-Control: no-cache Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 request-id: 4e2a5260-a2d9-4e2c-80c4-c6dfe9bc89cd client-request-id: ff9e6948-885b-4121-8fbe-82290ca98e3c x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"Germany West Central","Slice":"E","Ring":"4","ScaleUnit":"004","RoleInstance":"FR2PEPF00000553"}} x-ms-resource-unit: 1 Date: Wed, 23 Oct 2024 02:01:26 GMT Content-Type: application/json Content-Encoding: gzip {"error":{"code":"Authorization_RequestDenied","message":"Insufficient privileges to complete the operation.","innerError":{"date":"2024-10-23T02:01:26","request-id":"4e2a5260-a2d9-4e2c-80c4-c6dfe9bc89cd","client-request-id":"ff9e6948-885b-4121-8fbe-82290ca98e3c"}}}

##[error]PowerShell exited with code '1'.

##[error]PowerShell wrote one or more lines to the standard error stream.

##[error]Export-Entra: /home/it/myagent/_work/_temp/eeb6d2b1-b111-46fb-a950-1dca2d9b13d4.ps1:36 Line | 36 | Export-Entra "$root\prod-backup" -CloudUsersAndGroupsOnly | ~~~~~~~~~~~~~ | GET | graph.microsoft.com/v1.0/directory/onPremisesSync…redacted HTTP/2.0 403 Forbidden Cache-Control: no-cache Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 request-id: 4e2a5260-a2d9-4e2c-80c4-c6dfe9bc89cd client-request-id: ff9e6948-885b-4121-8fbe-82290ca98e3c x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"Germany West Central","Slice":"E","Ring":"4","ScaleUnit":"004","RoleInstance":"FR2PEPF00000553"}} x-ms-resource-unit: 1 Date: Wed, 23 Oct 2024 02:01:26 GMT Content-Type: application/json Content-Encoding: gzip {"error":{"code":"Authorization_RequestDenied","message":"Insufficient privileges to complete the operation.","innerError":{"date":"2024-10-23T02:01:26","request-id":"4e2a5260-a2d9-4e2c-80c4-c6dfe9bc89cd","client-request-id":"ff9e6948-885b-4121-8fbe-82290ca98e3c"}}}

The API permissions are exactly the same as the ones previously used for the service principal, which were working fine :-( Looking at a previously successful pipeline-run, I can see that it probably fails trying to collect the Domain-infos at that point, although the app has the Domain.read.all API-permissions.

EDIT: using Graph-explorer, I found that the request for graph.microsoft.com/v1.0/directory/onPremisesSync… also requires the permission "OnPremDirectorySynchronization.Read.All".

However, after granting that API-permission it still spits out exactly the same error :-/

Can you please help on this error message. If you want I will share the full log details.

github.com/ztrhgf/DevOps_Pipelines/blob/main/azur…

I have replaced the following value mentioned in the above YML file based on our requirement.

SERVICE_CONNECTION_NAME USER_EMAIL USER_NAME

2024-07-22T11:27:30.8857016Z PrivilegedAccess/AzureResources/Resources

2024-07-22T11:27:33.0971646Z ##[error]Export-Entra : GET graph.microsoft.com/beta/privilegedAccess/azureRe… HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 request-id: 1b1bda25-0619-4098-9dd4-77d26bbe46f2 client-request-id: c6876129-2b01-4bb4-9e1a-dd26165addbf x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"North Europe","Slice":"E","Ring":"4","ScaleUnit":"004","RoleInstance":"DB1PEPF0005EB8C"}} Date: Mon, 22 Jul 2024 11:27:32 GMT Content-Encoding: gzip Content-Type: application/json {"error":{"code":"InvalidFilter","message":"The filter is invalid.","innerError":{"date":"2024-07-22T11:27:32","reques t-id":"1b1bda25-0619-4098-9dd4-77d26bbe46f2","client-request-id":"c6876129-2b01-4bb4-9e1a-dd26165addbf"}}} At D:\a_temp\f54b1a51-ab43-4728-afd9-654a06a97a24.ps1:37 char:1

Export-Entra "$root\prod-backup" -All -CloudUsersAndGroupsOnly
~~~~~~~~~~~~~~
- CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
- FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Export-Entra 2024-07-22T11:27:33.1407404Z ##[error]PowerShell exited with code '1'. 2024-07-22T11:27:33.1977581Z ##[section]Finishing: Export backup & commit

I am trying to export users using pipeline. Pipeline is running fine but I cant see any files to output folder. And if I export users locally it is running fine.

Mauli then once again, hard to say without seeing your pipeline invocation output :)

Output is saying Users as I am exporting only users but nothing to my exported path

I am not able to attached screenshot so pasting text

Create the backup

NOTE: You can use the -No₩elcome parameter to suppress this message.

Creating backup

Users

Export command is not throwing any error. But have no idea where exported files are going om as it is not visible to anywhere

Running this I get the an error. Could you please advise on how to best solve this? It works if I run the Export-command locally on a server towards the same Entra ID, but not through Azure Devops using your code. Thanks.

PrivilegedAccess/AzureResources/Resources

##[error]Export-Entra : GET XXXXgraph.microsoft.com/beta/privilegedAccess/azureResources/resources?$skiptoken=XXXXX HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 request-id: XXXX client-request-id: XXXX x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"North Europe","Slice":"E","Ring":"4","ScaleUnit":"008","RoleInstance":"XXXX"}} Date: Fri, 05 Apr 2024 07:55:28 GMT Content-Encoding: gzip Content-Type: application/json {"error":{"code":"InvalidFilter","message":"The filter is invalid.","innerError":{"date":"2024-04-05T07:55:29","reques t-id":"XXX","client-request-id":"XXX"}}} At D:\a_temp\32f8a8a7-ae2d-4a87-859d-eafcc7051148.ps1:37 char:1

Export-Entra "$root\prod-backup" -All -CloudUsersAndGroupsOnly
~~~~~~~~~~~~~~
- CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
- FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Export-Entra ##[error]PowerShell exited with code '1'.

Are you sure you are using the same EntraExporter version as used in the pipeline? And account with exactly the same permissions? Anyway this seems to be related to the EntraExporter module more of the pipeline code. The problem seems to be in the called uri (filter part). But it's truncated in what you have sent. So hard to say

Ondrej Sebela The code I use in Azure Devops is copied this morning directly from your github, only alteration I have done to it is change the name of the service connection. Rest is identical. I thought first it might be the module, but I got it (the Export-module) working locally on my server towards the same Entra ID so not sure. Do you know how I can un-truncate the error message? The error is equally copied directly, only alteration I made was a few Xs.

Thank you for the great article and also for providing the solution to the community - very much appreciated! :-) Unfortunately, I ran into a problem where the process always keeps timing out on the same commit message: "Creating commit '2024.03.08_12.19 ...." (content redacted ;D) The first few pipeline-runs completed without any problems, but it suddenly stopped working one day and will not continue with a certain commit and just seems to time out at a certain point. The commit message subject is always the same, so it's probably something. related to the processed data, but I'm currently out of ideas what the underlying issue might be, and I'd be very glad to get some tips on how I might debug that!

Ondrej Sebela Thank you for pointing this out! I'm definitely using an older version, indeed. Will give it a try immediately! Thx a bunch! :-)

Thank your for the great article. Just a small advise, to keep with current terms, please refrain from using the word "Azure" when you you actually mean Entra (which includes Entra ID). Azure = IaaS/PaaS cloud computing platform and even has its own RBAC outside of Entra ID so using the word Azure instead of Entra is quite confusing.

Hello. Whole pipeline and jobs goes well without errors but I don't see files in Azure Repos like you. In my repos are only YAML file and readme. What I'm doing wrong?

Few days later just started to saving files to repos without any changes in configuration. Thank for great article.

Ok, found the culprit in MS Graph PS SDK 2.11.0: Invoke-MgGraphRequest Broken

Unfortunately this SDK is quite often buggy. I myself came across of several issues in the last too

Thank you for the write up! Do you have a clue why the pipeline keeps skipping users (and groups) while it has all necessary permissions and the correct parameter. Running it manually using an admin account does retrieve groups and accounts.

And if you run it using the application credentials? Seems weird though. If permissions are correct same as Export-Entra parameters...

Ondrej Sebela works like a charm - thank you very much! <3

Patrick Tippner thank you for the feedback. I am really glad this solution is useful too 👍

Discussion

How to easily backup your Azure environment using EntraExporter and Azure DevOps Pipeline

Responses(7)

Recent in Forum

Search Hashnode

How to easily backup your Azure environment using EntraExporter and Azure DevOps Pipeline

Responses(7)

Recent in Forum