How to use azure logic app to update AAD user’s password automatically

Scenario

Azure logic app is an extraordinary cloud automation application. For updating Azure Active Directory user’s password in batches and automatically, azure logic app consumption or a logic app standard can invoke Azure Active Directory Graph API but it requires specific permissions.

 

References

passwordAuthenticationMethod: resetPassword - Microsoft Graph beta | Microsoft Learn

Sign in with resource owner password credentials grant - Microsoft Entra | Microsoft Learn

List passwordMethods - Microsoft Graph beta | Microsoft Learn

Update user - Microsoft Graph v1.0 | Microsoft Learn

 

Services Used

Azure Logic App (Consumption or Standard)

Azure Active Directory (AAD)

 

Solution 1

1.Create an AAD application registration

2.Add permission: UserAuthenticationMethod.ReadWrite.All

More details: 

https://learn.microsoft.com/en-us/graph/api/authenticationmethod-resetpassword?view=graph-rest-beta&tabs=http#permissions

 

3.Grant admin consent

 

 

 

4.Set up a logic app designer

Here we selected 'When a http request is received' as a trigger.

Action 1: HTTP – Get token

This action is used to get token. This token will be used in the following actions.

Method: POST

 

URL: https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/token

 

Content-Type: application/x-www-form-urlencoded

 

Body:

client_id={MyClientID}

&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default

&client_secret={MyClientSecret}

&grant_type=password

&username={MyUsername}%40{myTenant}.com

&password={MyPassword}

 

Reference:

https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc

 

Action 2: HTTP – Get Pwd ID

This action is used to get Password Method ID.

 

Method: GET

 

URL: https://graph.microsoft.com/beta/me/authentication/passwordMethods

 

Content-type: application/json

 

Reference:

https://learn.microsoft.com/en-us/graph/api/authentication-list-passwordmethods?view=graph-rest-beta&tabs=http

 

 

Action 3: HTTP – Update Pwd

This action is used to update the password of a user.

Method: POST

 

URL: https://graph.microsoft.com/beta/users/{userObjectId | userPrincipalName}/authentication/passwordMethods/{passwordMethodId}/resetPassword

 

Content-type: application/json

 

Body:
{
"newPassword": "{myNewPassword}"
}

Reference:

https://learn.microsoft.com/en-us/graph/api/authenticationmethod-resetpassword?view=graph-rest-beta&tabs=http#http-request

In URI, we can use this Expression to get the value of passwordMethodId:

body('HTTP_2_-_Get_Pwd_ID')['value'][0]['id']

 

 

Solution 2

1.Grant 4 permissions to application registration and grant admin consent

 

User.ManageIdentities.All

User.EnableDisableAccount.All

User.ReadWrite.All

Directory.ReadWrite.All

 

Reference:

https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#permissions 

 

 

2.Add role assignment ‘User Administrator’ to application registration

 

 

In delegated access, the calling app must be assigned the Directory.AccessAsUser.All delegated permission on behalf of the signed-in user. In application-only access, the calling app must be assigned the User.ReadWrite.All application permission and at least the User Administrator Azure AD role.

 

Reference: https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http

 

 

3.Set up a logic app designer

Here we also selected 'When a http request is received' as a trigger.

 

Action 1: HTTP – Get token

This action is used to get token. This token will be used in the following actions.

 

Method: POST

URL: https://login.microsoftonline.com/{tenantID}/oauth2/v2.0/token 

Content-type: application/x-www-form-urlencoded

 

Body:
client_id={MyClientID}
&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default
&client_secret={MyClientSecret}
&grant_type=client_credentials

 

Action 2: HTTP – Update Pwd

This action is used to update the password of a user.

 

Method: PATCH

URL: https://graph.microsoft.com/v1.0/users/{userObjectId}

Content-type: application/json

Body:

{

  "passwordProfile": {

    "forceChangePasswordNextSignIn": false,

    "password": "{myNewPassword}"

  }

}

Reference:

https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#example-3-update-the-passwordprofile-of-a-user-to-reset-their-password

 

 

Result

We can check user password update records on AAD audit logs on azure portal:

 

AAD page -> Users -> AAD audit logs