Using Azure keys in PowerShell securly

Joe H 96 Reputation points
2021-06-04T13:10:36.14+00:00

I have a proactive remediation PowerShell script in Intune that includes the primary key for an Azure Log Analytics workspace. Since that script will persist on each user's computer, I really don't want to have the key stored in the script for obvious reasons.

Here are the limitations I have to work with:
The script will reside on each computer in a subfolder of Program Files. It is not possible to have the script removed after it runs, so it is always going to be there.
Due to limitations in Intune I cannot pass anything to the script at run time, so I cannot pass the key.

Any ideas on how I could accomplish this without have the key embedded in the script?

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,383 questions
Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
4,376 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rahul Jindal [MVP] 9,151 Reputation points MVP
    2021-06-06T22:59:07.577+00:00

    Have you considered using convert to secure string cmdlet to encrypt the key and then allow decryption locally on the devices?

    0 comments
  2. Joe H 96 Reputation points
    2021-06-07T12:37:24.697+00:00

    Thanks. Unless I'm missing something, if I convert the Log Analytics key to a secure string I would still have to put the secure string and the decryption key for it in the script. That would make it just slightly more difficult for someone to get the LA key. I can't pass the key to the script because of a limitation in Intune.

  3. Joe H 96 Reputation points
    2021-06-07T15:55:22.553+00:00

    I tried that, but the issue is that when the encryption is done on one PC it can't be decrypted on another, unless you specify a key during encryption. I would have to put the encryption key in the PowerShell script, so it kind of defeats the purpose. Thanks though.