CODEWITHSUNDEEP
azurepowershellazure-active-directorymulti-factor-authentication
C. Fabiani
C. Fabiani

Reputation: 169

Programmatically authenticate into AAD with MFA via powershell

I have a PowerShell script that logs into Azure subscription with the command Connect-AzAccount using user's credentials.

The code is the following: 

$userPassword='password'
$userName="username"
$tenantId="########-####-####-####-############"
$subscriptionId="########-####-####-####-############"
$azureSecpassword = $userPassword | ConvertTo-SecureString -asPlainText -Force
$azureCredential = New-Object System.Management.Automation.PSCredential($userName, $azureSecpassword)
Connect-AzAccount -Credential $azureCredential -Tenant $tenantId -SubscriptionId $subscriptionId

The code above works without any user interaction.

Few days ago the customer enabled the multi-factor authentication for the users. How can I keep a fully automated login process (without user interactions) with the multi-factor authentication?

Best Regards.

Upvotes: 1

Views: 7601

Answers (3)

Philippe Signoret
Philippe Signoret

Reputation: 14336

How can I keep a fully automated login process (without user interactions) with the multi-factor authentication?

You can't do this with a user account--that's the whole point of multi-factor authentication.

Instead, Azure AD supports authenticating with a service principal (instead of a user principal, like you're doing currently), and Azure supports granting access to Azure resources to service principals.

MFA requirements (and other conditional access policies) do not apply to service principals (often referred to as an Azure AD "app"), and service principals support more secure methods of authentication for automation scenarios (e.g. public/private key pairs).

So, what you should do:

  1. Ensure the machine running this script is secure. Anyone with access to the machine has the same amount of access as the script.

  2. Create an application identity and associate credentials with it.

    Note: It is strongly recommend you use certificate-based authentication for your service principal, instead of password-based. It is a very insecure practice to have any kind of secret stored in a PowerShell script!

  3. Grant the service principal the minimum level of access to Azure resources, to allow it to complete the required task.

  4. Update your script to use the app's identity (service principal) instead of the user's identity. It's even simpler than using a user account:

    $tenantId = "########-####-####-####-############"

$subscriptionId = "########-####-####-####-############"
$appId = "########-####-####-####-############"
$thumbprint= "##############"
Connect-AzAccount -ServicePrincipal -TenantId $tenantId -ApplicationId $appId -CertificateThumbprint $thumbprint

Note: If this script is running on a VM in Azure, you should forget step 2, and simply enable a managed identity and use that.

Upvotes: 1

Jack Jia
Jack Jia

Reputation: 5549

If you must log in as a user， there might be 2 optional approaches.

1. If you will run the script locally or in a specific PC

You can Persist Azure user credentials. You can enable auto save, or manually save the context to a file, and then use it in another PS session.

If you enabled auto save, then you can directly get the context as following:

Get-AzContext

# If you have more than one contexts, you can choose one by specifing the name
Get-AzContext -Name 'CSP Azure (e5b0****-****-****-****-5e5f****4c68) - jack@h****a.onmicrosoft.com'

If you want to manually do it, here is the sample:

# Interactively log for one time
Connect-AzAccount

# Save the context
Save-AzContext -Path D:\ctx.dat

And in another PS session, you can:

Import-AzContext -Path D:\ctx.dat

2. Use refresh token to acquire token, and connect to Azure

You can get the refresh token from the auto saved Azure context (usually at C:\Users\<UserName>\.Azure\TokenCache.dat).

Open the dat file with notepad, and you will get the refresh token: enter image description here

Then you can get a new token in PowerShell with that refresh token, and connect to Azure:

Clear-AzContext
$tenantId = "e4c9ab4e-****-****-****-230b****57fb"
$subscriptionId = "e5b0fcfa-****-****-****-5e5f****4c68"
$refreshToken = 'AQABAAAAAAAP0****a lot of characters here*****0A9FWoB8mvDtoWRJHBVO7GJzodLKYmNIAA'
$url = "https://login.microsoftonline.com/" + $tenantId + "/oauth2/token"
$body = "grant_type=refresh_token&refresh_token=" + $refreshToken
$response = Invoke-RestMethod $url -Method POST -Body $body
$AccessToken = $response.access_token

Connect-AzAccount -AccountId "the user id, jack@h****a.onmicrosoft.com" -AccessToken $AccessToken -Tenant $tenantId -SubscriptionId $subscriptionId

Upvotes: 1

Joy Wang
Joy Wang

Reputation: 42063

This is a common question. Unfortunately, the answer is No. If the account is MFA-enabled, you could just login with an interactive way.

In such a case, we choose to use the service principal to login with non-interactive in general.

$azureAplicationId ="Azure AD Application Id"
$azureTenantId= "Your Tenant Id"
$azurePassword = ConvertTo-SecureString "client secret" -AsPlainText -Force
$psCred = New-Object System.Management.Automation.PSCredential($azureAplicationId , $azurePassword)
Connect-AzAccount -Credential $psCred -TenantId $azureTenantId  -ServicePrincipal

Reference - Sign in with a service principal.

Upvotes: 1

Related Questions