In This Article show

Introduction

When you setup Azure Stack in a connected scenario with Azure Active Directory (AAD), you get several applications registered in Azure AD.

If you are an Azure Stack admin that is constantly trying out new things, and especially using Azure Stack Development Kit (ASDK), you will end-up with multiple Azure Stack AD Applications from previous deployments in the Azure Portal similar to the screenshot below:

Each time you deploy Azure Stack, the deployment will create 18 Applications in Azure Active Directory as follows:

Azure Stack
Aure Stack – Administration
Azure Stack – Bridge
Azure Stack – Compute
Azure Stack – Deployment
Azure Stack – Hubs
Azure Stack – Hubs Administration
Azure Stack – KeyVault
AzureStack KeyVault Internal
Azure Stack – Monitoring
Azure Stack – Monitoring Administration
Azure Stack – Policy
Azure Stack – Policy Administration
Azure Stack – Portal
Azure Stack – Portal Administration
Azure Stack – RBAC
Azure Stack – RBAC Administration
Azure Pack Connector

You may want to clean up old and unused Azure AD applications in your development tenant. In my case, I wanted to remove every single one.

In this quick blog post, I will show you how to identify which Azure Stack AD applications belong to the current Azure Stack deployment, and finally remove the old deployments.

WARNING! The details below are not officially supported and provided without warranty of any kind. Please contact Microsoft for official support.

Get the current Azure Stack Deployment

In Step 1, we need to find the latest Azure Stack Deployment ID that is currently in use.

For Azure Stack Development Kit (ASDK), you need to open an elevated PowerShell console and run the following command on the Hyper-V host:

As for Azure Stack Integrated Systems, you need to work with Microsoft support to get access on the Privilege Endpoint (ERC) VM.

#Step 1 - Find the current Azure Stack Deployment ID
$cred = (Get-Credential -Credential AzureStack\AzureStackAdmin)
$ErcsVM = (Get-VM -Name AzS-ERCS* | Get-VMNetworkAdapter).IPAddresses | where { $_ -match "\." }
$Session = New-PSSession -ComputerName $ErcsVM -ConfigurationName PrivilegedEndpoint -Credential $cred

Invoke-Command -Session $Session -ScriptBlock {
Get-AzureStackStampInformation
#Note the DeploymentID output E.g. 15f21183-07e8-4b74-9b6f-09f1ab6aa710
}

Get-PSSession | Remove-PSSession

The output will look something similar to this one, but the DeploymentID will be different.

Identify Azure Stack AD Applications

In step 2, you need to login to Azure AD and identify what AD Applications are being used by Azure Stack.

Open an elevated PowerShell console and run the following command. Make sure to update “https://*/DeploymentID” to match your deployment.

#Step 2 - Use the DeploymentID to identify what Azure Stack AD Applications are being used and which are not
Login-AzureRmAccount -EnvironmentName "AzureCloud"
$AADApp = Get-AzureRmADApplication
$AADApp | Where-Object {$_.IdentifierUris -like "https://*/15f21183-07e8-4b74-9b6f-09f1ab6aa710"} | Format-Table DisplayName, IdentifierUris

The output will look something similar to this one.

If you want to identify the old Azure Stack AD Applications that are NOT currently being used, you can run the following command:

$AADApp | Where-Object {($_.IdentifierUris -notlike "https://*/15f21183-07e8-4b74-9b6f-09f1ab6aa710" -and $_.DisplayName -match "Stack") -or ($_.IdentifierUris -notlike "https://*/15f21183-07e8-4b74-9b6f-09f1ab6aa710" -and $_.DisplayName -match "Pack")} | Format-Table DisplayName, IdentifierUris

Remove Azure Stack AD Applications

In the last step, we need to remove and delete the older Azure Sack AD Applications.

Azure Stack use AD applications that are configured for multi-tenancy support, and they are available for other tenants to be used as shown in the following screenshot.

In order to do so, we need to set AvailableToOtherTenants parameter to False otherwise you will receive an error message similar to this one:

Remove-AzureRmADApplication : Deletion of multi-tenant application is currently not supported.

Open an elevated PowerShell console and run the following command. Make sure to update “https://*/DeploymentID” to match your deployment.

#Step 3 - Remove all Azure Stack AD Applications that are not in use anymore
$AADApp = Get-AzureRmADApplication
$AppsToRemove = $AADApp | Where-Object {($_.IdentifierUris -notlike "https://*/15f21183-07e8-4b74-9b6f-09f1ab6aa710" -and $_.DisplayName -match "Stack") -or ($_.IdentifierUris -notlike "https://*/15f21183-07e8-4b74-9b6f-09f1ab6aa710" -and $_.DisplayName -match "Pack"}

# List the AD Applications to be sure you are removing the desired Apps only 
$AppsToRemove | Format-Table DisplayName, IdentifierUris, ObjectId

# Remove AzureStack AD Applications 
foreach ($App in $AppsToRemove)
{
  Set-AzureRmADApplication -ObjectId $App.ObjectId -AvailableToOtherTenants $false
  Remove-AzureRmADApplication -ObjectId $App.ObjectId -Force -Confirm:$false
}

If you switch back to the Azure Portal now, you will see only 18 Applications.