Using a system assigned managed identity to connect to Azure AD

Question

question

ChristophDambacher-4896 asked Jun 3, '20 30529263 commented Dec 7, '21

Using a system assigned managed identity to connect to Azure AD

Hi,

I have a PowerShell script that runs on an AzureVM and uses the system assigned managed identity of the VM to connect to Azure using the cmdlet Add-AzAccount -identity to provision resources.
Is it also possible to call the Connect-AzureAD cmdlet using the system assigned managed identity?
Currently we have the following code but this brings up the AAD authentication form and prompts to select an account for sign-in.

 Add-AzAccount -identity # | Out-Null
 $currentAzureContext = Get-AzContext
 $tenantId = $currentAzureContext.Tenant.Id
 $accountId = $currentAzureContext.Account.Id
 Connect-AzureAD -TenantId $tenantId -AccountId $accountId

Best regards and thanks

Christoph

azure-active-directory azure-virtual-machines

· 5

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

WilliamOverweg-1447 · May 11, 2021 at 11:13 AM

Try:

Connect-azaccount -identity
$context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
$graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.microsoft.com").AccessToken
$aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.windows.net").AccessToken

Write-Output "Hi I'm $($context.Account.Id)"

Connect-AzureAD -AadAccessToken $aadToken -AccountId $context.Account.Id -TenantId $context.tenant.id

2 ·

30529263 WilliamOverweg-1447 · Nov 23, 2021 at 02:09 PM

Thanks, this works fine with user MI as well.
To use it:
Connect-AzAccount -Identity -AccountId <ClientID>

Great stuff!

0 ·

SteinSidnei-1156 WilliamOverweg-1447 · Dec 04, 2021 at 03:16 PM

Hello!
I`m trying to clean stale devices on Azure AD with Automation account.
I get the error Code? Authorization_RequestDenied when try to Get-AzureADDevice.
Does the Automation Account need an specific role?

0 ·

WilliamOverweg-1447 SteinSidnei-1156 · Dec 06, 2021 at 08:57 PM

@SteinSidnei-1156
You can use e.g. Global Reader or any other role that has the following permission on AAD:
microsoft.directory/devices/allProperties/read

Note that you are using the AAD powershell module, so using Graph App Permissions will not work in most cases. AAD Roles will work though.

0 ·

30529263 SteinSidnei-1156 · Dec 07, 2021 at 05:02 PM

Depending on with with permissions you are running Automation ps code - it needs API permissions for managed identity or user AzureAD role if you sign in with user account.

0 ·

Answer 1 · 2020-06-03T12:11:00.98Z

soumi-MSFT answered Jun 3, '20 30529263 commented Nov 23, '21

@ChristophDambacher-4896, You wont be able to connect to AzureAD using the connect-AzureAD and System Managed Identity. The reason behind that being when you enable MSI be it System Managed Identity or User Managed Identity, in both cases, there is a Service Principal object that gets created, but the password for that Service Principal is never exposed as we find in a normal Service Principal. But to login to Azure AD, using Service Prinicipal we have to use the following cmdlet:
Connect-AzAccount -ServicePrincipal -Credential $psCredentials -Tenant $tenantId, which requires the credentials for that service principal which we dont have in case of MSI. Hence we cannot login to AzureAD PS module as using MSI.

Hope this helps.

Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as Answer; if the above response helped in answering your query.

· 3

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ChristophDambacher-4896 · Jun 04, 2020 at 05:56 AM

Thanks very much.

So just to ensure, is this planned in the future that the logon with a MSI to Azure AD via PowerShell is possible?

0 ·

soumi-MSFT ChristophDambacher-4896 · Jun 04, 2020 at 07:59 AM

@ChristophDambacher-4896, Not sure on this yet, if something is planned. But I would suggest you to drop a post here.

The product feedbacks or a feature requests are usually posted here and the Product Team closely monitors this space and acts upon accordingly.

1 ·

30529263 · Nov 23, 2021 at 02:08 PM

I believe this is the wrong answer since you try to login with SP not MI

0 ·

question