CODEWITHSUNDEEP
powershellazure-devopsazure-active-directoryazure-ad-graph-api
Vready
Vready

Reputation: 25

Automate Connect-AzureAD using powershell in Azure Devops Pipeline for SPN

I am doing the following for connecting to the AAD usingazure devops Pipeline for Powershell task

  1. created a SPN and granted the Permissions for the Graph
  2. While using the code below to connect using the access token it says Error Pipleline

My code is simple As below

    Install-Module -Name "AzureAD" -Force
   $context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
   $graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.microsoft.com").AccessToken
   $aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.windows.net").AccessToken      
  
   Write-Output "Hi I'm $($context.Account.Id)"
   Write-Output "AAD Token is  $($aadToken)"
   Connect-AzureAD -TenantId $context.tenant.id -AadAccessToken $aadToken -MsAccessToken $graphToken -AccountId $context.Account.Id 
   $outputusers= get-azureaduser -Top 5
   Write-Output "The users are listed $($outputusers)"

Could you please let me know if i missed any detail. The SPN is just a devops pipeline one and its not a AAD user. So the token may be invalid for authentication.

What do i need to do for the SPN to be a user in AAD. Please advice

Upvotes: 1

Views: 1272

Answers (1)

Carl Zhao
Carl Zhao

Reputation: 9519

From your code, you use Get-AzureADUser to call Azure AD Graph, so try to add Azure Active Directory Graph Directory.Read.All permissions, can solve your problem.

enter image description here enter image description here

By the way, the -MsAccessToken $graphToken command can be omitted.

Upvotes: 1

Related Questions