|
| Sign Up/Sign In |
Apparently Microsoft Entra admin center doesn't seem to have a functionality to remove this within the portal.
It however can be done using
Graph Beta API.
# Install the Microsoft Graph Beta module (required for authentication events flow management)
Install-Module Microsoft.Graph.Beta -Scope CurrentUser -Force
# Print version of Microsoft Graph Beta module
$mgBetaModule = Get-Module Microsoft.Graph.Beta -ListAvailable `
| Sort-Object Version -Descending `
| Select-Object -First 1
Write-Output "Using Microsoft.Graph.Beta: $($mgBetaModule.Version)" # As of today: 2.32.0
# Connect to Azure Account
Write-Output "Connecting to Azure Account..."
Connect-AzAccount
$tenantId = "<tenant-id>"
$targetFlowName = "<user-flow-name>"
# Connect to Microsoft Graph with required permissions
# Required scopes:
# - Policy.ReadWrite.AuthenticationFlows: To read and modify authentication flows
# - EventListener.Read.All/ReadWrite.All: To read and modify event listeners
# - Application.Read.All/ReadWrite.All: To read and modify applications
Connect-MgGraph `
-TenantId $tenantId `
-Scopes "Policy.ReadWrite.AuthenticationFlows", `
"EventListener.Read.All", `
"EventListener.ReadWrite.All", `
"Application.Read.All", `
"Application.ReadWrite.All"
# Verify the connected tenant
$tenantId = (Get-MgContext).TenantId
Write-Output "Successfully connected to tenant: $tenantId"
# Retrieve all authentication events flows
$authenticationEventsFlows = Invoke-MgGraphRequest -Method GET `
-Uri "https://graph.microsoft.com/beta/identity/authenticationEventsFlows"
# Find the ID of the target flow
$targetFlowId = ($authenticationEventsFlows.value `
| Where-Object { $_.displayName -eq $targetFlowName }).id
if (-not $targetFlowId) {
Write-Output "ERROR: Flow '$targetFlowName' not found."
exit 1
}
# Get the target flow
$targetFlow = Invoke-MgGraphRequest -Method GET `
-Uri "https://graph.microsoft.com/beta/identity/authenticationEventsFlows/$targetFlowId"
if ($targetFlow.onInteractiveAuthFlowStart.isSignUpAllowed -eq $false) {
Write-Output "Sign-up is already disabled for this flow $targetFlowName."
exit 0
}
Write-Output "Disabling sign-up for flow $targetFlowName..."
# Request body to disable sign-up
$body = @{
"@odata.type" = "#microsoft.graph.externalUsersSelfServiceSignUpEventsFlow"
"onInteractiveAuthFlowStart" = @{
"@odata.type" = "#microsoft.graph.onInteractiveAuthFlowStartExternalUsersSelfServiceSignUp"
"isSignUpAllowed" = $false
}
} | ConvertTo-Json -Depth 5
# PATCH
Invoke-MgGraphRequest -Method PATCH `
-Uri "https://graph.microsoft.com/beta/identity/authenticationEventsFlows/$targetFlowId" `
-Body $body `
-ContentType "application/json"
# Verify the update by retrieving the flow again
$updatedFlow = Invoke-MgGraphRequest -Method GET `
-Uri "https://graph.microsoft.com/beta/identity/authenticationEventsFlows/$targetFlowId"
Write-Output "Updated: $($updatedFlow.onInteractiveAuthFlowStart.isSignUpAllowed)"
|
| Sign In |
Happy Coding.
Regards,
Jaliya
