Cmdlets for Microsoft Planner

Build 25.0.9434

Establishing a Connection

With the CData Cmdlets users can install a data module, set the connection properties, and start scripting. This section provides examples of using our MicrosoftPlanner Cmdlets with native PowerShell cmdlets, like the CSV import and export cmdlets.

Connecting to Microsoft Planner

Entra ID (Azure AD)

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Microsoft Entra ID is a multi-tenant, cloud-based identity and access management platform. It supports OAuth-based authentication flows that enable the driver to access Microsoft Planner endpoints securely.

Authentication to Entra ID via a web application always requires that you first create and register a custom OAuth application. This enables your application to define its own redirect URI, manage credential scope, and comply with organization-specific security policies.

For full instructions on how to create and register a custom OAuth application, see Creating an Entra ID (Azure AD) Application.

After setting AuthScheme to AzureAD, the steps to authenticate vary, depending on the environment. For details on how to connect from desktop applications, web-based workflows, or headless systems, see the following sections.

Desktop Applications

You can authenticate from a desktop application using either the driver's embedded OAuth application or a custom OAuth application registered in Microsoft Entra ID.

Option 1: Use the Embedded OAuth Application

This is a pre-registered application, included with the driver. It simplifies setup and eliminates the need to register your own credentials and is ideal for development environments, single-user tools, or any setup where quick and easy authentication is preferred.

Set the following connection properties:

  • AuthScheme: AzureAD
  • InitiateOAuth:
    • GETANDREFRESH – Use for the initial login. Launches the login page and saves tokens.
    • REFRESH – Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.

When you connect, the driver opens the Microsoft Entra sign-in page in your default browser. After signing in and granting access, the driver retrieves the access and refresh tokens and saves them to the path specified by OAuthSettingsLocation.

Option 2: Use a Custom OAuth Application

If your organization requires more control, such as managing security policies, redirect URIs, or application branding, you can instead register a custom OAuth application in Microsoft Entra ID and provide its values during connection.

During registration, record the following values:

  • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
  • OAuthClientSecret: The client secret that was that was generated when you registered your custom OAuth application.
  • CallbackURL: A redirect URI you defined during application registration.

For full instructions on how to register a custom OAuth application and configure redirect URIs, see Creating an Entra ID (Azure AD) Application.

Set the following connection properties:

  • AuthScheme: AzureAD
  • InitiateOAuth:
    • GETANDREFRESH – Use for the initial login. Launches the login page and saves tokens.
    • REFRESH – Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.
  • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
  • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
  • CallbackURL: A redirect URI you defined during application registration.

After authentication, tokens are saved to OAuthSettingsLocation. These values persist across sessions and are used to automatically refresh the access token when it expires, so you don't need to log in again on future connections.

Headless Machines

Headless environments like CI/CD pipelines, background services, or server-based integrations do not have an interactive browser. To authenticate using AzureAD, you must complete the OAuth flow on a separate device with a browser and transfer the authentication result to the headless system.

Setup options:

  • Obtain and exchange a verifier code
    • Use another device to sign in and retrieve a verifier code, which the headless system uses to request tokens.
  • Transfer an OAuth settings file
    • Authenticate on another device, then copy the stored token file to the headless environment.

Using a Verifier Code

  1. On a device with a browser:
    • If using a custom OAuth app, set the following properties:
      • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
      • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
    • Call the GetOAuthAuthorizationURL stored procedure to generate a sign-in URL.
    • Open the returned URL in a browser. Sign in and grant grant permissions to the driver. You are redirected to the callback URL, which contains the verifier code.
    • After signing in, save the value of the code parameter from the redirect URL. You will use this later to set the OAuthVerifier connection property.
  2. On the headless machine:
    • Set the following properties:
      • AuthScheme: AzureAD
      • OAuthVerifier: The verifier code you saved.
      • OAuthSettingsLocation: The path of the file that holds the OAuth token values.
      • For custom applications:
        • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
        • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
    • After tokens are saved, reuse them by setting:
      • OAuthSettingsLocation: Make sure this location grants read and write permissions to the driver to enable the automatic refreshing of the access token.
      • For custom applications:
        • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
        • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.

Transferring OAuth Settings

  1. On a device with a browser:
    • Connect using the instructions in the Desktop Applications section.
    • After connecting, tokens are saved to the file path in OAuthSettingsLocation. The default filename is OAuthSettings.txt.

  2. On the headless machine:
    • Copy the OAuth settings file to the machine.
    • Set the following properties:
      • AuthScheme: AzureAD
      • OAuthSettingsLocation: Make sure this location grants read and write permissions to the driver to enable the automatic refreshing of the access token.
      • For custom applications:
        • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
        • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.

After setup, the driver uses the stored tokens to refresh the access token automatically, no browser or manual login is required.

Azure Service Principal

The authentication as an Azure Service Principal is handled via the OAuth Client Credentials flow. It does not involve direct user authentication. Instead, credentials are created for just the application itself. All tasks taken by the application are done without a default user context, but based on the assigned roles. The application access to the resources is controlled through the assigned roles' permissions.

Create an AzureAD App and an Azure Service Principal

When authenticating using an Azure Service Principal, you must create and register an Azure AD application with an Azure AD tenant. See Creating an Entra ID (Azure AD) Application for more details.

In your App Registration in portal.azure.com, navigate to API Permissions and select the Microsoft Graph permissions. There are two distinct sets of permissions: Delegated permissions and Application permissions. The permissions used during client credential authentication are under Application Permissions.

Assign a role to the application

To access resources in your subscription, you must assign a role to the application.

  1. Open the Subscriptions page by searching and selecting the Subscriptions service from the search bar.
  2. Select the subscription to assign the application to.
  3. Open the Access control (IAM) and select Add > Add role assignment to open the Add role assignment page.
  4. Select Owner as the role to assign to your created Azure AD app.
Complete the Authentication Choose whether to use a client secret or a certificate and follow the relevant steps below.

Client Secret

Set these connection properties:

Certificate

Set these connection properties:

You are now ready to connect. Authentication with client credentials takes place automatically like any other connection, except there is no window opened prompting the user. Because there is no user context, there is no need for a browser popup. Connections take place and are handled internally.

Managed Service Identity (MSI)

If you are running Microsoft Planner on an Azure VM and want to automatically obtain Managed Service Identity (MSI) credentials to connect, set AuthScheme to AzureMSI.

User-Managed Identities

To obtain a token for a managed identity, use the OAuthClientId property to specify the managed identity's client_id.

If your VM has multiple user-assigned managed identities, you must also specify OAuthClientId.

Creating a Connection Object

You can then use the Connect-MicrosoftPlanner cmdlet to create a connection object that can be passed to other cmdlets: 

$conn = Connect-MicrosoftPlanner -OrganizationUrl "https://myaccount.crm.dynamics.com/" -OAuthClientId "clientid" -OAuthClientSecret "secret"

Retrieving Data

The Select-MicrosoftPlanner cmdlet provides a native PowerShell interface for retrieving data: 

$results = Select-MicrosoftPlanner -Connection $conn -Table "Tasks" -Columns @("TaskId, startDateTime") -Where "TaskId ='BCrvyMoiLEafem-3RxIESmUAHbLK'"
The Invoke-MicrosoftPlanner cmdlet provides an SQL interface. This cmdlet can be used to execute an SQL query via the Query parameter.

Piping Cmdlet Output

The cmdlets return row objects to the pipeline one row at a time. The following line exports results to a CSV file: 

Select-MicrosoftPlanner -Connection $conn -Table Tasks -Where "TaskId  = 'BCrvyMoiLEafem-3RxIESmUAHbLK'" | Select -Property * -ExcludeProperty Connection,Table,Columns | Export-Csv -Path c:\myTasksData.csv -NoTypeInformation

You will notice that we piped the results from Select-MicrosoftPlanner into a Select-Object cmdlet and excluded some properties before piping them into an Export-CSV cmdlet. We do this because the CData Cmdlets append Connection, Table, and Columns information onto each row object in the result set, and we do not necessarily want that information in our CSV file.

However, this makes it easy to pipe the output of one cmdlet to another. The following is an example of converting a result set to JSON: 

 
PS C:\> $conn  = Connect-MicrosoftPlanner -OrganizationUrl "https://myaccount.crm.dynamics.com/" -OAuthClientId "clientid" -OAuthClientSecret "secret"
PS C:\> $row = Select-MicrosoftPlanner -Connection $conn -Table "Tasks" -Columns (TaskId, startDateTime) -Where "TaskId  = 'BCrvyMoiLEafem-3RxIESmUAHbLK'" | select -first 1
PS C:\> $row | ConvertTo-Json
{
  "Connection":  {

  },
  "Table":  "Tasks",
  "Columns":  [

  ],
  "TaskId":  "MyTaskId",
  "startDateTime":  "MystartDateTime"
}

Deleting Data

The following line deletes any records that match the criteria: 

Select-MicrosoftPlanner -Connection $conn -Table Tasks -Where "TaskId  = 'BCrvyMoiLEafem-3RxIESmUAHbLK'" | Remove-MicrosoftPlanner

Modifying Data

The cmdlets make data transformation easy as well as data cleansing. The following example loads data from a CSV file into Microsoft Planner, checking first whether a record already exists and needs to be updated instead of inserted. 

Import-Csv -Path C:\MyTasksUpdates.csv | %{
  $record = Select-MicrosoftPlanner -Connection $conn -Table Tasks -Where ("Id = `'"+$_.Id+"`'")
  if($record){
    Update-MicrosoftPlanner -Connection $conn -Table Tasks -Columns @("TaskId","startDateTime") -Values @($_.TaskId, $_.startDateTime) -Where "Id  = `'$_.Id`'"
  }else{
    Add-MicrosoftPlanner -Connection $conn -Table Tasks -Columns @("TaskId","startDateTime") -Values @($_.TaskId, $_.startDateTime)
  }
}

Copyright (c) 2025 CData Software, Inc. - All rights reserved.
Build 25.0.9434