Building an Azure Entra ID Password Reset Form with Microsoft Graph and PowerShell Universal

# Connect as the application. Use the content scope of process to avoid affecting other apps 
# We are passing in the tenant ID and client secret.
# We are connecting when the app is starting to avoid connecting every time the page is loaded. 
Connect-MgGraph -TenantId $PSUMgTenantId -ClientSecretCredential $Secret:PSUMgClientSecret -ContextScope Process -NoWelcome

New-UDApp -Content {

    # Create a new form with a user autocomplete and password fields. 
    New-UDForm -Children {
        New-UDAutocomplete -OnLoadOptions {
            # Use Get-MgUser to retrieve a list of available users that are filtered based on their user name. 
            # This typically takes a few seconds on the first attempt but will be faster on subsequent. 
            Get-MgUser -ConsistencyLevel eventual -Count userCount -Search "`"DisplayName:$Body`"" | ForEach-Object {
                New-UDAutocompleteOption -Name $_.DisplayName -Value $_.Id
            }
        } -Label "User" -Id 'UserId'
        New-UDTextbox -Label 'Password' -Type password -Id 'Password'
        New-UDTextbox -Label 'Confirm Password' -Type password -Id 'ConfirmPassword'
    } -OnValidate { 
        # Implement validation to ensure that the proper values are present and and passwords match
        if ([string]::IsNullOrEmpty($EventData.UserId))
        {
            New-UDValidationResult -ValidationError "User is required"
            return
        }

        if ([string]::IsNullOrEmpty($EventData.Password) -or [string]::IsNullOrEmpty($EventData.ConfirmPassword) )
        {
            New-UDValidationResult -ValidationError "Password is required"
            return
        }

        if ($EventData.Password -cne $EventData.ConfirmPassword)
        {
            New-UDValidationResult -ValidationError "Passwords do not match"
            return
        }

        # This likely isn't necessary because of the autocomplete code above. That said, it
        # provides an example of validating using the Graph cmdlets.
        $MgUser = Get-MgUser -UserId $EventData.UserId
        if ($MgUser -eq $null)
        {
            New-UDValidationResult -ValidationError "Unable to locate user."
            return
        }

        # Return a valid result if everything works well.
        New-UDValidationResult -Valid
    } -OnSubmit {

        # Ensure that we have an access token provided by Entra ID. If we don't, we can't perform this operation.
        if ($AccessToken -eq $null)
        {
            throw "Access Token is required. Ensure you have Save Tokens enabled in your OpenID Connect authentication method."
        }

        # Store the access token in the case based on the current user.
        # We do this to avoid storing the access token as plain text in the job history
        # We can also control expiration to avoid retaining it long term. We are also using the 
        # temporary cache so it will not persist restarts.
        Set-PSUCache -Key "MgAccessToken_$User" -Value $AccessToken

        # Create a random key for the password. We will clear this after resetting
        # the user's password
        $PasswordKey = (New-Guid).ToString()
        Set-PSUCache -Key $PasswordKey -Value $EventData.Password

        # We will be invoke a script with the provided information. We do it here for two reasons:
        # 1. We need to isolate the Microsoft.Graph module so the connection scope is tied only to this user
        #    The problem is that multiple user's could be accessing the PSU app at the same time. 
        # 2. By using a script, we will have an auto-history of which user reset which user's password. 
        Invoke-PSUScript -Name 'MgResetPassword.ps1' -Parameters @{
            ResetUser = $EventData.UserId
            PasswordKey = $PasswordKey
        } -Wait -Integrated | Out-Null

        # Show some feedback after the reset
        Show-UDSnackbar -Message "Password reset!" -Variant success
    }
}

# $ResetUser is the ID of the account to reset. 
# $PasswordKey is the ID of the cached password
param($ResetUser, $PasswordKey)

# Get the password from the cache
$Password = Get-PSUCache -Key $PasswordKey
if (-not $PasswordKey)
{
    throw "Target password not found."
}

# Get the current executing user's access token from the cache. 
# We currently aren't removing this, but you could do so after the operation is complete.
# You could also set timeout values when calling Set-PSUCache in the app
$AccessToken = Get-PSUCache -Key "MgAccessToken_$($UAJob.Identity.Name)"
if (-not $AccessToken)
{
    throw "Access token not found for $AdminUser"
}

# Connect to Graph using the $AccessToken
Connect-MgGraph -AccessToken ($AccessToken | ConvertTo-SecureString -AsPlainText -Force) -NoWelcome

# Ensure that the User ID exists. 
$User = Get-MgUser -UserId $ResetUser

if ($User -eq $null)
{
    throw "Failed to look up user: $ResetUser"
}

# Create a password profile with the new password and update the user
$password = @{
    Password = $Password
    ForceChangePasswordNextSignIn = $false
}
Update-MgUser -UserId $User.Id -PasswordProfile $password

# Remove the password from the cache
Remove-PSUCache -Key $PasswordKey