CODEWITHSUNDEEP
azurepowershellazure-active-directory
Haris Osmanagić
Haris Osmanagić

Reputation: 1285

Method to get list of AD users using application password

In an application, I'm currently using PowerShell and MSOnline module (Connect-MsolService and Get-MsolUser) to get a list of AD users. A global admin provides his username and password and the application is able to get a list of all users under that tenant.

That works fine... As long as the password is not an app password. When an app password is used then the following is what the global admin gets to see:

Authentication Error: Bad username or password

My question is: Is there any other method, which uses PowerShell, but doesn't have to, to get the list of users in AD, but which works with app password? I know of Graph API, but that's not a fit for the project right now.

Upvotes: 0

Views: 2999

Answers (1)

Joy Wang
Joy Wang

Reputation: 42043

If I understand you correctly, you want to use the AD App and its password(secret) to list the users.

You could use the Az powershell module to do that, login with the service principal and list users via Get-AzADUser. Also, make sure your AD App(service principal) has the admin role like User administrator or Global administrator.

$azureAplicationId ="<AD App Application id>"
$azureTenantId= "<tenant id>"
$azurePassword = ConvertTo-SecureString "<password>" -AsPlainText -Force
$psCred = New-Object System.Management.Automation.PSCredential($azureAplicationId , $azurePassword)
Connect-AzAccount -Credential $psCred -TenantId $azureTenantId  -ServicePrincipal

Get-AzADUser

enter image description here

Update:

Currently, use app password of MFA enabled user to connect MSOL powershell is not supported, for more details see this link.

App passwords are NOT supported, simply use Connect-MsolService without any parameter to trigger the ADAL dialog and complete the 2FA challenge as normal.

Upvotes: 2

Related Questions