Search for a command to run...
I work as System Administrator for more than 15 years now and I love to make my life easier by automating work & personal stuff via PowerShell (even silly things like food recipes list generation).
No comments yet. Be the first to comment.
Updated 6.6.2024 Managed Identity is definitely a better option for authentication in Azure Automation Runbooks than the RunAs account because it doesn't require certificate/secret renewal. Therefore it is maintenance-free. However, it took me a whi...
Or any other Azure service requiring special authentication strength
If you are using Azure Local (HCI), you might find the following PowerShell script AzureLocalVMImageUpdater.ps1 useful. What is it good for? The code replaces the Windows VM images in the specified Azure Local cluster(s) with the latest compatible ve...
Problem It happens that the hardware hash of your Autopilot device gets changed. Thanks to the replacement of the motherboard or some other issue. This can lead to future problems when your users need to reinstall the operating system, but the Autopi...
Learn how to use undocumented Azure APIs for massive performance gains
Keeping a secure, version-controlled backup of your Intune-managed device data, including BitLocker, LAPS, and FileVault keys, is a best practice for any modern IT team. In this post, I’ll guide you through an Azure DevOps pipeline that automates the...
We have a repository where Azure Automation Runbooks are stored and we wanted to automatically publish every new version automatically into the Azure Automation Resource account.
Azure Pipeline was an obvious solution. Still, it took me some time to figure out, how to authenticate to an Azure Resource from Pipeline PowerShell task (not the same thing as Azure PowerShell task!). The solution to this problem was mentioned at https://bzzzt.io/post/2021-02/2021-02-28-powershell-login-az so kudos to that author!
Btw I couldn't use
Azure Automationbuilt-in Source Code feature because all our accounts use MFA, so PAT cannot be used for authentication. Also, I couldn't use theAzure PowerShellpipeline task (which is authenticated to Azure by default), because I needed access to committed repository files so I could upload them to our Runbook.
The solution to the problem "how to authenticate to Azure from Pipeline PowerShell task" is to leverage the possibility to export credentials used in the Azure PowerShell task, so they can be used later in the following tasks.
Working solution can then look like a DevOps Pipeline with 3 tasks:
Azure CLI task for Connecting to Azure and exporting credentials for later usePowershell task for Connecting to Azure using exported credentials and getting an authentication token for GraphAzure CLI task for Disconnecting from AzureBefore we begin we have to create a Service Connection (the account that will be used to make a connection to Azure Resources)
For my use case, I use Azure Resource Manager
In the picture below you can see that we are creating Azure CLI task that will run shell code for exporting credentials and tenantID variables that we will use later in following PowerShell task for connecting to Azure.
For this, to work you have to enable Access service principal details in script
Now when we have credentials for making connection to Azure we will use them.
This is where the magic happens. We use variables defined in the first task for making a connection to Azure.
"Installing Az.Accounts module"
Install-Module Az.Accounts -Force
"Connecting to Azure"
$credential = New-Object System.Management.Automation.PSCredential ("${env:SPID}", (ConvertTo-SecureString ${env:SPKEY} -AsPlainText -Force))
Connect-AzAccount -Credential $Credential -Tenant ${env:TID} -ServicePrincipal
In last task we just disconnect our Azure connection.
