PowerShell Helpers to convert Azure AD Object IDs and SIDs

If you work with Azure AD and especially in my case with Intune and Azure AD you have probably seen Object IDs in the Azure AD portal on the user objects, group objects, or in the Intune log files.

Here a portal screenshot of a demo user:

Azure AD user properties

Here a screenshot of the Intune Management Extension log file:

Intune Management Extension log file

Another ID is the Security Identifier (SID) which you might have seen here and there. A famous command to show the SID of the user is whoami

whoami /all and Azure AD SID

On an Azure AD joined device in the local Administrators group you will find Azure AD SIDs:

Local Administrators groups with Azure AD SIDs

These IDs have a relationship and they can be converted to each other. For example wouldn’t it be nice to take the SID from the local administrators group and convert it to the Object ID to know which AAD group it represents or vice versa?

PowerShell Convert AzureAD SID to Object ID

If we lookup the Azure AD roles we get the Object ID of the Device Administrators group for the converted SID:

Get-AzureADDirectoryRole

And as I said they can be converted vice versa so here we convert the Object ID back to the SID:

PowerShell Convert AzureAD Object ID to SID

This can be helpful in scripts here you see SIDs or ObjectIDs. You are now able to convert

  • Azure AD Group Object ID to SIDs
  • Azure AD User Object IDs to SIDs

and vice versa (that’s what I tested…).

You can get both code samples from my GitHub (Convert-AzureAdSidToObjectId.ps1 and Convert-AzureAdObjectIdToSid.ps1) or here:

https://github.com/okieselbach/Intune

I think Michael will like it as well for its Get-AutopilotESPStatus script here πŸ™‚

Another new Get-AutopilotESPStatus script posted
https://oofhours.com/2020/04/08/another-new-get-autopilotespstatus-script-posted

I hope this small helper will not just help Michael and me from time to time πŸ‘

Let’s have some PowerShell converting fun.