Automate Connect-AzureAD using powershell in Azure Devops Pipeline for SPN

Question

I am doing the following for connecting to the AAD usingazure devops Pipeline for Powershell task

created a SPN and granted the Permissions for the Graph
While using the code below to connect using the access token it says Error Pipleline

My code is simple As below

    Install-Module -Name "AzureAD" -Force
   $context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
   $graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.microsoft.com").AccessToken
   $aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.windows.net").AccessToken      
  
   Write-Output "Hi I'm $($context.Account.Id)"
   Write-Output "AAD Token is  $($aadToken)"
   Connect-AzureAD -TenantId $context.tenant.id -AadAccessToken $aadToken -MsAccessToken $graphToken -AccountId $context.Account.Id 
   $outputusers= get-azureaduser -Top 5
   Write-Output "The users are listed $($outputusers)"

Could you please let me know if i missed any detail. The SPN is just a devops pipeline one and its not a AAD user. So the token may be invalid for authentication.

What do i need to do for the SPN to be a user in AAD. Please advice

Carl Zhao · Accepted Answer · 2020-07-17 07:12:16Z

1

From your code, you use Get-AzureADUser to call Azure AD Graph, so try to add Azure Active Directory Graph Directory.Read.All permissions, can solve your problem.

By the way, the -MsAccessToken $graphToken command can be omitted.

answered Jul 17, 2020 at 7:12

Carl Zhao

9,6752 gold badges15 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Vready Over a year ago

Carl Zhao it is pretty awesome answer for the authentication problems. Thanks

Vincent Verweij Over a year ago

@CarlZhao is the Directory.Read.All permission the same for both the Microsoft Graph API as the Azure Active Directory Graph? In other words, it doesn't matter which of the two APIs you choose as long as it is permission Directory.Read.All?

Carl Zhao Over a year ago

No, the functions of these two endpoints are different, so you need to select the Directory.Read.All permission under Azure Active Directory Graph api.

Collectives™ on Stack Overflow

Automate Connect-AzureAD using powershell in Azure Devops Pipeline for SPN

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related