What Does IT Workflow Automation Mean?

IT workflow automation means recurring IT processes are standardized, automated, and, crucially for the SMB market, made accessible to non-technical teams as well. The goal is not just writing scripts that run automatically. It is ensuring that the right people can initiate the right processes at the right time, securely and with full control.

Typical Workflows in an SMB That Can Be Automated

• User onboarding: New employee triggers automatic creation of AD account, email, groups, and license
• User offboarding: Departing employee triggers account deactivation, group removal, and mailbox archiving
• Password management: Self-service reset without an IT ticket
• VM management: Start or stop VMs via web portal instead of Azure access
• Reporting: Automated reports on licenses, groups, and access rights
• Compliance checks: Regular review of AD groups and permissions

au2mator as a Workflow Platform: How Does It Work?

In au2mator, workflows are defined as “services.” Each service is a configured process that starts a PowerShell script, an Azure Automation Runbook, or a System Center Orchestrator Runbook. IT admins build the service once. From that point, authorized users can start it with a click. Execution is fully automated and logged.

Comparison: au2mator vs. Ansible vs. RunDeck

Criterion	au2mator	Ansible	RunDeck
Target audience	Helpdesk & end users	DevOps / sysadmins	Ops teams
Microsoft stack	Native (AD, Azure, SCO)	⚠️ Via modules	⚠️ Via plugins
No-code for end users	Yes	❌ YAML knowledge required	⚠️ Limited
DACH SMB	Specialized	❌ Enterprise-focused	❌ Enterprise-focused
Managed service	Available	❌ Self-hosted	❌ Self-hosted
Audit trail	Complete	⚠️ Logs	Available

Integration with Existing Tools

au2mator complements existing Microsoft infrastructure instead of replacing it. Active Directory remains the source of truth, Azure Automation handles cloud workloads, and System Center Orchestrator manages On-Premises automation. au2mator is the frontend that ties everything together and makes it usable for non-technical teams.

Getting Started: What Do I Need to Start with au2mator?

For an On-Premises installation: Windows Server, IIS, and SQL Server, with a typical implementation time of one to two days with support from the au2mator team. Alternatively, the managed service option has au2mator hosting and operating the platform while the company only configures the desired processes. This is ideal for teams that want to start quickly without tying up internal IT capacity.

Workflow automation that actually works in SMBs. No DevOps team required. Request a demo →

The post IT Workflow Automation for SMBs: Simple, Secure, No Coding Required appeared first on TechGuy.

Was bedeutet IT Workflow-Automatisierung?

IT Workflow-Automatisierung bedeutet: Wiederkehrende IT-Prozesse werden standardisiert, automatisiert und — entscheidend für den Mittelstand — auch für nicht-technische Teams zugänglich gemacht. Es geht nicht nur darum Skripte zu schreiben die automatisch laufen, sondern darum dass die richtigen Personen zur richtigen Zeit die richtigen Prozesse anstoßen können — sicher und kontrolliert.

Typische Workflows im Mittelstand die sich automatisieren lassen

• User Onboarding: Neuer Mitarbeiter → AD-Account, E-Mail, Gruppen, Lizenz automatisch anlegen
• User Offboarding: Mitarbeiter verlässt Unternehmen → Account deaktivieren, Gruppen entfernen, Mailbox sichern
• Passwort Management: Self-Service Reset ohne IT-Ticket
• VM Management: VMs starten/stoppen über Web-Portal statt Azure-Zugriff
• Reporting: Automatische Berichte zu Lizenzen, Gruppen, Zugriffsrechten
• Compliance Checks: Regelmäßige Überprüfung von AD-Gruppen und Berechtigungen

au2mator als Workflow-Plattform: Wie funktioniert’s?

In au2mator werden Workflows als “Services” definiert. Jeder Service ist ein konfigurierter Prozess der ein PowerShell-Skript, ein Azure Automation Runbook oder einen System Center Orchestrator Runbook startet. IT-Admins bauen den Service einmalig — danach können autorisierte Benutzer ihn per Klick starten. Die Ausführung ist vollständig automatisiert und protokolliert.

Vergleich: au2mator vs. Ansible vs. RunDeck

Kriterium	au2mator	Ansible	RunDeck
Zielgruppe	Helpdesk & Endbenutzer	DevOps / Sysadmins	Ops-Teams
Microsoft-Stack	Native (AD, Azure, SCO)	Via Module	Via Plugins
No-Code für Endbenutzer	Ja	YAML-Kenntnisse nötig	Eingeschränkt
DACH Mittelstand	Spezialisiert	Enterprise-fokussiert	Enterprise-fokussiert
Managed Service	Verfügbar	Self-hosted	Self-hosted
Audit-Trail	Vollständig	Logs	Vorhanden

Integration mit bestehenden Tools

au2mator ergänzt bestehende Microsoft-Infrastruktur statt sie zu ersetzen: Active Directory bleibt die Quelle der Wahrheit, Azure Automation übernimmt die Cloud-Workloads, System Center Orchestrator die On-Premises-Automatisierung. au2mator ist das Frontend das alles zusammenbringt und für nicht-technische Teams nutzbar macht.

Einstieg: Was brauche ich um mit au2mator zu starten?

Für eine On-Premises Installation: Windows Server, IIS, SQL Server — typische Implementierungszeit 1-2 Tage mit Unterstützung des au2mator-Teams. Alternativ: Managed Service — au2mator hostet und betreibt die Plattform, das Unternehmen konfiguriert nur die gewünschten Prozesse. Ideal für Teams die schnell starten wollen ohne interne IT-Kapazität zu binden.

Workflow-Automatisierung die im Mittelstand wirklich funktioniert — kein DevOps-Team nötig. Jetzt Demo anfordern →

The post IT Workflow-Automatisierung im Mittelstand: Einfach, sicher, ohne Code-Kenntnisse appeared first on TechGuy.

What Is an IT Self-Service Portal?

An IT self-service portal gives employees the ability to handle common IT tasks themselves, without an IT ticket, without waiting, and without technical knowledge. The IT team defines once which actions are available, who can use them, and which parameters are allowed. Execution happens automatically in the background using the necessary service account permissions.

Typical Use Cases

How Does au2mator Work as a Self-Service Portal?

1. IT admin creates services in the au2mator portal (e.g., “Password Reset”)
2. Links the service to a PowerShell script or Azure Automation Runbook
3. Defines user groups and allowed parameters
4. Employees see only approved services and start them with a click
5. au2mator executes, logs, and notifies on error

Security and Compliance First

au2mator consistently applies the principle of least privilege. End users execute actions without holding permissions themselves. The service account has exactly the rights needed, nothing more. All actions are logged with user, timestamp, parameters, and result, providing a complete audit trail for ISO 27001, SOC 2, and GDPR.

Integration with Existing IT Infrastructure

au2mator integrates with the common Microsoft backends without additional middleware:

• Active Directory (On-Premises): Users, groups, attributes, passwords
• Azure AD / Entra ID: Cloud identities, licenses, B2B guests
• Azure Automation: Runbooks for complex multi-step processes
• System Center Orchestrator (SCO): On-Premises automation
• PowerShell: Local scripts via a secure agent

Comparison: au2mator vs. Other Self-Service Portals

Unlike ScriptRunner, which is primarily for IT admins, or Ansible, which is Infrastructure as Code for DevOps teams, au2mator is built specifically for the DACH SMB market. It offers simple operation without technical prerequisites, native Microsoft stack integration, and a managed service option for teams without internal IT capacity.

Implementation: What Is Required?

au2mator is available as an On-Premises installation or as a managed service. On-Premises requires Windows Server, IIS, and SQL Server, with a typical implementation time of one to two days. With the managed service, au2mator hosts and operates the platform while the company only configures the desired services. This is ideal for teams without internal capacity for operation and maintenance.

IT self-service that actually works: simple, secure, built for DACH SMBs. Discover au2mator →

The post IT Self-Service Portal for SMBs: Automation Without Admin Rights appeared first on TechGuy.

Was ist ein IT Self-Service Portal?

Ein IT Self-Service Portal gibt Mitarbeitern die Möglichkeit, häufige IT-Aufgaben selbst zu erledigen — ohne IT-Ticket, ohne Wartezeit, ohne technisches Wissen. Das IT-Team definiert einmalig welche Aktionen verfügbar sind, wer sie nutzen darf und welche Parameter erlaubt sind. Die Ausführung passiert automatisiert im Hintergrund mit den nötigen Service-Account-Berechtigungen.

Typische Anwendungsfälle

Wie funktioniert au2mator als Self-Service Portal?

1. IT-Admin erstellt Services im au2mator-Portal (z.B. “Passwort Reset”)
2. Verknüpft den Service mit einem PowerShell-Skript oder Azure Automation Runbook
3. Definiert Benutzergruppen und erlaubte Parameter
4. Mitarbeiter sieht nur freigegebene Services — startet per Klick
5. au2mator führt aus, protokolliert, benachrichtigt bei Fehler

Sicherheit und Compliance im Fokus

au2mator setzt konsequent auf das Prinzip der minimalen Berechtigungen: Endbenutzer führen Aktionen aus ohne selbst Berechtigungen zu haben. Der Service-Account hat genau die nötigen Rechte, nicht mehr. Alle Aktionen werden mit Benutzer, Zeitstempel, Parametern und Ergebnis protokolliert — vollständiger Audit-Trail für ISO 27001, SOC 2 und DSGVO.

Integration mit bestehender IT-Infrastruktur

au2mator integriert mit den gängigen Microsoft-Backends ohne zusätzliche Middleware:

• Active Directory (On-Premises): User, Gruppen, Attribute, Passwörter
• Azure AD / Entra ID: Cloud-Identitäten, Lizenzen, B2B-Gäste
• Azure Automation: Runbooks für komplexe Multi-Step-Prozesse
• System Center Orchestrator (SCO): On-Premises Automatisierung
• PowerShell: Lokale Skripte über sicheren Agent

Vergleich: au2mator vs. andere Self-Service-Portale

Im Gegensatz zu ScriptRunner (primär für IT-Admins) oder Ansible (Infrastructure as Code für DevOps) ist au2mator speziell für den DACH-Mittelstand gebaut: Einfache Bedienung ohne technische Vorkenntnisse, native Microsoft-Stack-Integration und Managed Service Option für Teams ohne interne IT-Kapazität.

Implementierung: Was ist nötig?

au2mator ist als On-Premises Installation oder als Managed Service verfügbar. On-Premises: Windows Server, IIS, SQL Server — typische Implementierungszeit 1-2 Tage. Managed Service: au2mator betreibt die Plattform, das Unternehmen konfiguriert nur die Services. Ideal für Teams ohne interne Kapazität für Betrieb und Wartung.

IT Self-Service der wirklich funktioniert — einfach, sicher, DACH-Mittelstand. au2mator kennenlernen →

The post IT Self-Service Portal für den Mittelstand: Automatisierung ohne Admin-Rechte appeared first on TechGuy.

What Is Azure Automation, and Why Does It Need a Frontend?

Azure Automation enables the automation of IT processes through PowerShell or Python Runbooks in the cloud. Runbooks can start and stop VMs, manage users, generate reports, or execute complex multi-step processes. The problem: without direct Azure access, only IT admins can start these Runbooks. For helpdesk teams or business units, Azure Automation is practically invisible.

au2mator as an Azure Automation Self-Service Portal

au2mator connects directly to Azure Automation and exposes Runbooks as simple web services. The workflow: an admin links an Azure Automation Runbook to an au2mator service, defines allowed parameters and user groups, and that is it. From that point on, authorized employees can start the Runbook through a simple web form, without any Azure knowledge.

Which Tasks Can Be Delegated?

• Start, stop, or restart Azure VMs
• Manage Azure AD users (license, group, password)
• Generate automated reports and send them by email
• Azure Storage tasks (blob upload, cleanup)
• App Registrations and secret rotation
• Start on- and offboarding workflows
• Trigger backup jobs

Technical Integration: How Does au2mator Connect to Azure Automation?

au2mator uses an Azure Service Principal with the minimal required permissions to start Runbooks and query their status. The connection is encrypted and credentials are stored securely in au2mator. End users have no direct Azure access at any point. They interact only with the au2mator portal.

Security: Who Can Execute What?

Role-based access control (RBAC) ensures that every user sees and can start only the services approved for them. Parameters are strictly controlled. Admins define whether a field is a free-text input, a dropdown with predefined values, or a stored value. No user can enter parameters outside the allowed boundaries.

au2mator vs. Direct Azure Portal Access

Aspect	au2mator Self-Service	Direct Azure Portal Access
Technical knowledge required	❌ None	Azure knowledge required
Permission risk	Minimal (Runbook start only)	⚠️ Broad (Azure RBAC)
Audit trail	Complete in au2mator	⚠️ Azure Activity Log only
User-friendliness	Simple web form	❌ Complex Azure Portal
Delegation to helpdesk	Straightforward	❌ Security risk

Real-World Example: Azure Automation in an SMB

A mid-sized company uses Azure Automation Runbooks for VM management and user onboarding. Previously, the IT admin had to start every Runbook manually. With au2mator, the helpdesk starts VMs through the portal when a user reports an issue, and the onboarding Runbook starts automatically when HR creates a new employee. IT effort: nearly zero.

Make Azure Automation available to everyone, without Azure knowledge and without security risk. Request an au2mator demo →

The post Azure Automation Self-Service Portal: Control IT Processes Without PowerShell Knowledge appeared first on TechGuy.

Was ist Azure Automation — und warum braucht es ein Frontend?

Azure Automation erlaubt die Automatisierung von IT-Prozessen über PowerShell- oder Python-Runbooks in der Cloud. Runbooks können VMs starten und stoppen, Benutzer verwalten, Berichte generieren oder komplexe Multi-Step-Prozesse ausführen. Das Problem: Ohne direkten Azure-Zugriff können nur IT-Admins diese Runbooks starten. Für Helpdesk-Teams oder Fachabteilungen ist Azure Automation damit praktisch unsichtbar.

au2mator als Azure Automation Self-Service-Portal

au2mator verbindet sich direkt mit Azure Automation und stellt Runbooks als einfache Web-Services bereit. Der Workflow: Admin verknüpft ein Azure Automation Runbook mit einem au2mator-Service, definiert erlaubte Parameter und Benutzergruppen — fertig. Ab sofort können autorisierte Mitarbeiter das Runbook über ein simples Web-Formular starten, ohne Azure-Kenntnisse.

Welche Aufgaben lassen sich delegieren?

• Azure VMs starten, stoppen, neu starten
• Azure AD Benutzer verwalten (Lizenz, Gruppe, Passwort)
• Automatisierte Berichte generieren und per E-Mail versenden
• Azure Storage Aufgaben (Blob upload, Cleanup)
• App Registrierungen und Secret-Rotation
• On-/Offboarding-Workflows starten
• Backup-Jobs triggern

Technische Integration: Wie verbindet sich au2mator mit Azure Automation?

au2mator nutzt einen Azure Service Principal mit den minimal notwendigen Berechtigungen um Runbooks zu starten und deren Status abzufragen. Die Verbindung ist verschlüsselt, die Credentials werden sicher in au2mator gespeichert. Endbenutzer haben zu keinem Zeitpunkt direkten Azure-Zugriff — sie interagieren nur mit dem au2mator-Portal.

Sicherheit: Wer darf was ausführen?

Rollenbasierte Zugriffskontrolle (RBAC) stellt sicher dass jeder Benutzer nur die für ihn freigegebenen Services sieht und starten kann. Parameter werden streng kontrolliert: Admins definieren ob ein Feld ein Freitext, ein Dropdown mit vordefinierten Werten oder ein gespeicherter Wert ist. Kein Benutzer kann Parameter außerhalb des erlaubten Rahmens eingeben.

au2mator vs. direkter Azure-Portal-Zugriff

Aspekt	au2mator Self-Service	Direkter Azure Portal Zugriff
Technisches Wissen nötig	Keins	Azure-Kenntnisse nötig
Berechtigungsrisiko	Minimal (nur Runbook-Start)	Breit (Azure RBAC)
Audit-Trail	Vollständig in au2mator	Nur Azure Activity Log
Benutzerfreundlichkeit	Einfaches Web-Formular	Komplexes Azure Portal
Delegation an Helpdesk	Problemlos	Sicherheitsrisiko

Praxisbeispiel: Azure Automation im Mittelstand

Ein mittelständisches Unternehmen nutzt Azure Automation Runbooks für VM-Management und User-Onboarding. Früher musste der IT-Admin jedes Runbook manuell starten. Mit au2mator startet der Helpdesk VMs selbst über das Portal wenn ein Benutzer das meldet — und das Onboarding-Runbook startet automatisch wenn HR einen neuen Mitarbeiter anlegt. IT-Aufwand: nahezu null.

Azure Automation für alle nutzbar machen — ohne Azure-Kenntnisse, ohne Sicherheitsrisiko. au2mator Demo anfordern →

The post Azure Automation Self-Service Portal: IT-Prozesse ohne PowerShell-Kenntnisse steuern appeared first on TechGuy.

What Does IT Process Delegation Mean?

IT process delegation means: tasks that previously only IT admins could perform are controlled passed on to other teams, whether helpdesk, business units, or even end users themselves. The key point is that delegation happens securely, with clearly defined boundaries and a complete audit trail. The goal is not “grant admin rights” but “enable controlled execution without admin rights.”

Typical Delegatable Processes in an SMB

• Password reset for Active Directory users
• Create new users based on a standard template
• Manage AD groups (add or remove members)
• Enable, disable, or unlock user accounts
• Azure AD license assignment
• Set shared mailbox permissions
• Start or stop VMs via Azure Automation
• Create external guest accounts with an expiry date

The Risk Without Delegation: Admin Rights vs. Helpdesk

Many IT teams solve the delegation problem the wrong way: they grant admin rights to helpdesk staff so they can act faster. The result is a massively expanded attack surface. A compromised helpdesk account suddenly has Domain Admin access. The alternative of routing everything through the IT team wastes time, money, and patience. IT process delegation via a self-service portal resolves this dilemma.

How au2mator Delegates IT Processes

1. Admin defines services: Which actions should be delegatable? (e.g., “Password Reset,” “Create User”)
2. Set permissions: Who can use which service? (Helpdesk Tier 1, Tier 2, manager, etc.)
3. Restrict parameters: What can the user enter? (free text, dropdown, predefined values)
4. Execution: End user starts the service via the web portal; au2mator executes using the service account
5. Logging: Everything is logged: user, timestamp, parameters, result

au2mator vs. ScriptRunner: Which Tool Fits When?

Real-World Example: SMB with 500 Users

A manufacturing company with 500 employees and a two-person IT team: 20 to 30 IT tickets for AD tasks arrived daily, covering forgotten passwords, new employees, and wrong group assignments. After introducing au2mator, the helpdesk handles 85 percent of these tickets independently through the portal. The two IT staff members now have time for infrastructure projects instead of routine tickets.

Requirements and Integration

au2mator integrates with the common Microsoft backends: Active Directory (On-Premises), Azure Active Directory / Entra ID, Azure Automation (Runbooks), and System Center Orchestrator. A local agent establishes the secure connection to On-Premises AD. Deployment is available On-Premises or as a managed service.

Delegate IT processes securely without granting admin rights. au2mator makes it possible. Request a demo →

The post Delegating IT Processes Securely: How It Works Without Admin Rights appeared first on TechGuy.

Cause those Cloud Services might fail.
When we are honest, the Cloud is only someone else’s computer, so there can be an attack, an outage, or Data loss.
We can also experience some breaches, so the Cloud file gets encrypted. Now?

That is why I recently bought a UNIFI Storage for our offline Backup, and our first step was to save OneDrive to that Storage.

So, the easiest way would be to have a copy job on my computer, where OneDrive is located, and copy all the files to the Storage. But for this, I wouldn’t write a Blog Post; instead, I would download all the files to your computer first, then to the Storage. That is not a very smart solution.

So, I was trying to write a PowerShell Script that downloads Files directly via API to the offline Storage.

So here we are, Thanks to my colleague Ahmed, who already had a Function to renew Graph API Access token: uzejnovicahmed (Uzejnovic Ahmed)

Preperations

So first we need Access to our OneDrive via the GRAPH API, and for this we need an App Registration with the following Permissions.

• Files.ReadWrite.All ( for automation, I would recommend using Application Permission)

#OneDrive GRAPH API Details
$clientID_OneDrive = "your Client ID"
$Clientsecret_OneDrive = "your Secret"
$tenantID = "Tenant ID"

Next, depending on your OneDrive Size and your bandwidth, the Backup will take some time, so we have to make sure our Access Token is renewed when it expires. I have to thank Ahmed for this part.

#region functions
function Request-AccessToken {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)] [string]$TenantName,
        [Parameter(Mandatory = $true)] [string]$ClientId,
        [Parameter(Mandatory = $true)] [string]$ClientSecret
    )

    $tokenBody = @{
        Grant_Type    = 'client_credentials'
        Scope         = 'https://graph.microsoft.com/.default'
        Client_Id     = $ClientId
        Client_Secret = $ClientSecret
    }

    Write-Debug "Requesting a new access token from Microsoft Identity Platform..."

    try {
        $tokenResponse = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$TenantName/oauth2/v2.0/token" -Method POST -Body $tokenBody -ErrorAction Stop
        $global:accessToken = $tokenResponse.access_token
        $global:tokenExpiresAt = (Get-Date).AddSeconds($tokenResponse.expires_in)
        $global:headers = @{
            "Authorization" = "Bearer $($global:accessToken)"
            "Content-type"  = "application/json"
        }
    }
    catch {
        Write-Output "Error generating access token: $($_.Exception.Message)"
        Write-Output "Exception Details: $($_.Exception)"
        return $null
    }
    Write-Output "Successfully generated authentication token"
    return $tokenResponse
}
# Function to renew the access token when close to expiration
function Renew-AccessToken {
    param (
        [string]$TenantName,
        [string]$ClientId,
        [string]$ClientSecret
    )

    Write-Debug "Attempting to renew the access token..."
    try {
        $tokenResponse = Request-AccessToken -TenantName $TenantName -ClientId $ClientId -ClientSecret $ClientSecret

        if ($null -ne $tokenResponse) {
            # Update the global access token and expiration time
            $global:accessToken = $tokenResponse.access_token
            $global:tokenExpiresAt = (Get-Date).AddSeconds($tokenResponse.expires_in)
            Write-Output "Token renewed successfully. New expiration time: $global:tokenExpiresAt"
        }
        else {
            Write-Output "Failed to renew the access token. Response was null."
        }
    }
    catch {
        Write-Output "Error renewing the access token: $($_.Exception.Message)"
    }
}
function Check-TokenExpiration {
    try {
        Write-Host "Checking token expiration at: $(Get-Date)..." 
        # Check if the token is about to expire (1 minute before expiration)
        if ((Get-Date) -ge $global:tokenExpiresAt.AddMinutes(-$minutesbeforetokenexpires)) {
            Write-Host "Access token is expired or close to expiration. Renewing the token..." -ForegroundColor Orange
            Renew-AccessToken -TenantName $tenantID -ClientId $clientID_OneDrive -ClientSecret $Clientsecret_OneDrive
        }
        else {
            Write-Host "Access token is still valid. Expires at: $global:tokenExpiresAt" -ForegroundColor Green
        }
    }
    catch {
        Write-Host "Error in Check-TokenExpiration function: $($_.Exception.Message)" -ForegroundColor Red
    }
}

#endregion functions


# Define global variables for the access token and expiration time
$global:accessToken = $null
$global:tokenExpiresAt = [datetime]::MinValue
$global:headers = $null
$tokencheckinterval = 300000  # 300 seconds (300000 milliseconds) -> Can be bigger in production.
$minutesbeforetokenexpires = 6 # Set how many minutes before token expiration the token should be renewed

# Request the initial token
$tokenResponse = Request-AccessToken -TenantName $tenantID -ClientId $clientID_OneDrive -ClientSecret $Clientsecret_OneDrive

#This is the Interval the  Token Check Takes place ! 
$timer = New-Object Timers.Timer
$timer.Interval = $tokencheckinterval
$Aktion = { Check-TokenExpiration }            
            
# Register the event handler to check token expiration
try {
    $timerEvent = Register-ObjectEvent -InputObject $timer -EventName Elapsed -SourceIdentifier "TokenCheck" -Action $Aktion
    Write-Output "Event registered successfully."
}
catch {
    Write-Output "Failed to register the timer event: $($_.Exception.Message)"
}

# Start the timer and verify that it is running
$timer.Start()
if ($timer.Enabled) {
    Write-Output "Timer started successfully. Access token will be checked for renewal every $($timer.Interval/1000) seconds."
}
else {
    Write-Output "Failed to start the timer."
}

Now we can learn about the Basic Settings and our OneDrive Details. This Example Script is limited to my personal OneDrive, but of course, it can be adapted to save others and shared OneDrives, too.

So we are configuring the Destination and the OneDrive we want to back up. replace the “*yourUPN*”

#Destionation Folder
$Dest = "Y:\OneDrive - Michael Seidl"

#OneDrive Details
$Drive = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/*yourUPN*/drive" -Method GET -Headers $global:headers
$Child = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/*yourUPN*/drives/$($Drive.id)/root/children" -Method GET -Headers $global:headers

Now we are coming to the tricky part, which took me some time. We got the first root content, like Files and Folders.

Doing a foreach and checking if it is a File or Folder.

If Folder, let’s check if it exists and create it.

If a File, check if it does not exist, or when it was last changed. In some cases, download the file.

Everything should be in a single loop because I do not know how many subfolders I have. So this was the first one I worked with: calling a Function within the Function itself.

Luckily, it works. On Top, we are creating a Job for each download, so we can go ahead and check the following files without waiting for the download to be finished.

Function Download-Item {
    param (
        [object]$ItemObject,
        [hashtable]$Headers
    )
    $ItemID = $ItemObject.id

    if ($ItemObject.folder -ne $null) {
        #Folder
        $ParentFolder = "$Dest\$($ItemObject.parentReference.path.Split("root:/")[1])"
        if (-not (Test-Path -Path $ParentFolder)) {
            New-Item -ItemType Directory -Path $ParentFolder -Force | Out-Null
        }
        $SubItemObject = Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/michael.seidl@au2mator.com/drives/$($Drive.id)/items/$($ItemID)/children" -Method GET -Headers $global:headers
        foreach ($item in $SubItemObject.value | Sort-Object -Property size -Descending) {
            Download-Item -ItemObject $item -Headers $global:headers
        }           
    }
    elseif ($ItemObject.file -ne $null) {
        #File
        $ParentFolder = "$Dest\$($ItemObject.parentReference.path.Split("root:/")[1])"
        $ParentFolder = $ParentFolder.Replace("/$($ItemObject.name)", '')
        if (-not (Test-Path -Path $ParentFolder)) {
            New-Item -ItemType Directory -Path $ParentFolder -Force | Out-Null
        }

        $ParentFolder = "$ParentFolder\$($ItemObject.name)"
        $Download = $false
        try {
            $LocalFile = Get-Item -Path $ParentFolder -ErrorAction Stop
            if ($LocalFile -and ($LocalFile.LastWriteTime -lt $ItemObject.lastModifiedDateTime)) {
                $Download = $true
            }
        }
        catch {
            $Download = $true
        }

        if ($Download) {
            write-Output "Downloading File: $($ItemObject.name) to $ParentFolder"
            Start-Job  -ScriptBlock {
                param($ItemID, $Headers, $ParentFolder, $Drive)
                Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/michael.seidl@au2mator.com/drives/$($Drive.id)/items/$($ItemID)/content" -Method GET -Headers $Headers -OutFile $ParentFolder
            } -ArgumentList $ItemID, $Headers, $ParentFolder, $Drive | Out-Null
        }
    }
    else {  
    }    
}


#Main part
foreach ($item in $Child.value | Sort-Object -Property size -Descending) {
    Download-Item -ItemObject $item  -Headers $headers 
}

At the end, we are stopping the Timer Job.

# Stop the timer and unregister the event when done
Write-Output "Stopping the timer and unregistering the event..."
$timer.Stop()
Unregister-Event -SourceIdentifier "TokenCheck"
$timer.Dispose()
Write-Output "Timer stopped. Final Access Token Expiration: $global:tokenExpiresAt"

So, this might not yet be perfect, but it helps me to do my Backups so that it might help you as well.

This script took me some time; if this were a paid customer project, it would cost around 2.000 euros, and you get this for free. You can show your support by being a GitHub Sponsor: Sponsor @Seidlm on GitHub Sponsors

The complete and updated script is here in my GitHub Repo: Seidlm/Microsoft-Graph-API-Examples

Michael Seidl, aka Techguy
au2mate everything

The post OneDrive offline Backup with PowerShell and GRAPH API appeared first on TechGuy.

Was bedeutet IT-Prozess Delegation?

IT-Prozess Delegation bedeutet: Aufgaben die bisher nur IT-Admins erledigen konnten, werden kontrolliert an andere Teams weitergegeben — Helpdesk, Fachabteilungen oder sogar Endbenutzer selbst. Der entscheidende Punkt: Die Delegation passiert sicher, mit klar definierten Grenzen und vollständigem Audit-Trail. Nicht “Admin-Rechte vergeben” sondern “kontrollierte Ausführung ohne Admin-Rechte ermöglichen”.

Typische delegierbare Prozesse im Mittelstand

• Passwort-Reset für Active Directory Benutzer
• Neue Benutzer anlegen nach Standard-Template
• AD-Gruppen verwalten (Mitglieder hinzufügen / entfernen)
• Benutzerkonten aktivieren, deaktivieren, entsperren
• Azure AD Lizenz-Zuweisung
• Shared Mailbox Berechtigungen setzen
• VM starten / stoppen via Azure Automation
• Externe Gastkonten anlegen mit Ablaufdatum

Das Risiko ohne Delegation: Adminrechte vs. Helpdesk

Viele IT-Teams lösen das Delegations-Problem falsch: Sie vergeben Admin-Rechte an Helpdesk-Mitarbeiter damit diese schneller agieren können. Das Ergebnis ist ein massiv erweiterter Angriffsvektor — ein kompromittierter Helpdesk-Account hat plötzlich Domain-Admin-Zugriff. Die Alternative — alles über das IT-Team abzuwickeln — kostet Zeit, Geld und Nerven. IT-Prozess Delegation über ein Self-Service-Portal löst dieses Dilemma.

Wie au2mator IT-Prozesse delegiert

1. Admin definiert Services: Welche Aktionen sollen delegierbar sein? (z.B. “Passwort Reset”, “User anlegen”)
2. Berechtigungen setzen: Wer darf welchen Service nutzen? (Helpdesk Tier 1, Tier 2, Manager…)
3. Parameter einschränken: Was darf der Benutzer eingeben? (Freitext, Dropdown, vordefinierte Werte)
4. Ausführung: Endbenutzer startet Service über Web-Portal — au2mator führt mit Service-Account aus
5. Protokollierung: Alles wird geloggt — Benutzer, Zeitstempel, Parameter, Ergebnis

au2mator vs. ScriptRunner — Welches Tool passt wann?

Einsatzbeispiel: Mittelständisches Unternehmen, 500 User

Ein produzierendes Unternehmen mit 500 Mitarbeitern und einem 2-köpfigen IT-Team: Täglich kamen 20-30 IT-Tickets für AD-Aufgaben — Passwort vergessen, neuer Mitarbeiter, Gruppe falsch. Nach Einführung von au2mator erledigt der Helpdesk 85% dieser Tickets selbständig über das Portal. Die beiden IT-Mitarbeiter haben wieder Zeit für Infrastruktur-Projekte statt Routine-Tickets.

Voraussetzungen & Integration

au2mator integriert mit den gängigen Microsoft-Backends: Active Directory (On-Premises), Azure Active Directory / Entra ID, Azure Automation (Runbooks) und System Center Orchestrator. Ein lokaler Agent stellt die sichere Verbindung zum On-Premises AD her. Deployment: On-Premises oder als Managed Service.

IT-Prozesse sicher delegieren ohne Admin-Rechte zu vergeben — au2mator macht es möglich. Jetzt Demo anfordern →

The post IT-Prozesse sicher delegieren: So funktioniert’s ohne Admin-Rechte appeared first on TechGuy.

What Is External User Lifecycle Management?

External User Lifecycle Management describes the structured process for managing user accounts for non-employees: external consultants, temporary workers, suppliers, and partners. These users need temporary access to systems, but unlike internal employees they do not have a fixed start and end date in the HR system. Without an automated process, “ghost accounts” that remain active after a project ends are created quickly.

The Typical Problems Without Automation

• External accounts remain active after a project ends, creating a security risk
• No central overview of all external users and their expiry dates
• Manual deactivation is forgotten or delayed
• IT team must act individually for every external account
• Compliance audit reveals orphaned accounts, resulting in findings and rework

au2mator for External User Management

au2mator automates the complete lifecycle of external users in Active Directory and Azure AD:

• Onboarding: Create the external account with an automatic expiry date, initiated by the responsible manager through self-service
• Permissions: Only approved resources are accessible, defined through templates
• Expiry monitoring: Automatic reminder before expiry, with the option to extend or deactivate
• Offboarding: Automatic deactivation on the expiry date, optionally with an immediate audit report

Automatic Deactivation: Guest Accounts That Actually Expire

The most common mistake in External User Management: an expiry date is set but nobody checks whether it is actually enforced. au2mator handles this check automatically. Seven days before expiry, the responsible manager receives a reminder. On the expiry date itself, the account is automatically deactivated in On-Premises AD and Azure AD simultaneously. No manual steps, no forgetting.

Self-Service Onboarding for External Partners

Without au2mator, the IT team must process a ticket for every external account. With au2mator, the responsible project lead or manager can initiate onboarding directly through the portal. They select a template such as “External Consultant” or “Supplier,” enter first and last name along with an expiry date, and au2mator handles the rest. The IT team only needs to approve critical exceptions.

Compliance and Audit

Regulatory requirements such as GDPR, ISO 27001, and TISAX demand evidence of external access: who had access to which systems and when? au2mator delivers this evidence automatically with a complete audit trail that can be exported as a report. During compliance audits, this is the difference between one hour of research and an entire day of effort.

Integration with Azure B2B and On-Premises AD

au2mator supports both scenarios: external users in On-Premises Active Directory as classic guest accounts, and Azure B2B Guest Accounts in Azure AD. For hybrid environments, which are the norm in the DACH SMB space, both are managed simultaneously. Unlike pure Azure B2B solutions, au2mator does not neglect the On-Premises side.

au2mator automates the complete lifecycle of external users, from account creation to automatic deactivation. No manual effort, no forgetting, no compliance risk. Learn more →

The post External User Lifecycle Management: Automate External Accounts in AD and Azure AD appeared first on TechGuy.