Search for a command to run...
Managed identity for Azure DevOps Pipeline? Yes please 😍
I work as System Administrator for more than 15 years now and I love to make my life easier by automating work & personal stuff via PowerShell (even silly things like food recipes list generation).
No comments yet. Be the first to comment.
In my previous article, I've shown you, how to get the permissions required to run selected PowerShell code. Today I will focus on getting Microsoft Graph PowerShell SDK modules. The official Find-MgGraphCommand function, which retrieves the parent m...
Or any other Azure service requiring special authentication strength
If you are using Azure Local (HCI), you might find the following PowerShell script AzureLocalVMImageUpdater.ps1 useful. What is it good for? The code replaces the Windows VM images in the specified Azure Local cluster(s) with the latest compatible ve...
Problem It happens that the hardware hash of your Autopilot device gets changed. Thanks to the replacement of the motherboard or some other issue. This can lead to future problems when your users need to reinstall the operating system, but the Autopi...
Learn how to use undocumented Azure APIs for massive performance gains
Keeping a secure, version-controlled backup of your Intune-managed device data, including BitLocker, LAPS, and FileVault keys, is a best practice for any modern IT team. In this post, I’ll guide you through an Azure DevOps pipeline that automates the...
With the introduction of the Workload Identity Federation feature (currently in preview but functioning well), we can leverage the identity associated with our Pipeline for authentication with Microsoft Graph and other Azure services, eliminating the need for additional Service Principals.
This means we no longer have to deal with the inconvenience of renewing saved secrets 💗.
To get more details about the Workload Identity Federation check the official documentation.
In your Azure DevOps project: Project settings >> Service connections >> Create service connection >> Azure Resource Manager >> Workload Identity federation (automatic)
Now you need to specify to what resource you will grant this newly created identity permissions to.
For this particular use case, I tend to use Subscription (Resource Group), which means that identity will be granted a Contributor role over the selected Resource Group.
It is a good idea to have a separate subscription with some dummy Resource Group just for this!
Contributor role can be substituted with a less privileged role, such as Reader. However, it’s important to remember that workload identity must be assigned some role, otherwise all authentication attempts will fail!Service connection name will be used in the pipeline as an identity identifier later.
Now when the identity is created
We can assign it the required API permissions
As you can see, a new App registration was created in our Azure tenant named as <DevOps Organization>-<DevOps Project>-<GUID>
Grant-AzureServicePrincipalPermission (part of the AzureApplicationStuff module)Now the last part where we use created workload identity to authenticate against Graph API.
To get the access token, add following AzurePowerShell@5 step to your pipeline.
- task: AzurePowerShell@5
displayName: "Get Graph Token for Workload Federated Credential"
inputs:
azureSubscription: "workload_identity_for_graph_api"
azurePowerShellVersion: "LatestVersion"
ScriptType: "inlineScript"
Inline: |
$accessToken = (Get-AzAccessToken -ResourceTypeName MSGraph -ErrorAction Stop).Token
Write-Host "##vso[task.setvariable variable=accessToken;issecret=true]$accessToken"
Don't forget to change the value of azureSubscription to match your Service connection name created in the previous step!
This task will get the Graph access token and save it to the pipeline variable accessToken for later use.
Now that we have the access token, add the following step to your Pipeline
- task: PowerShell@2
displayName: "Authenticate"
inputs:
targetType: "inline"
script: |
Write-Host "Authenticating to Graph API"
$secureToken = ConvertTo-SecureString -String $(accessToken) -AsPlainText -Force
Connect-MgGraph -AccessToken $secureToken -NoWelcome
This step converts the string from the accessToken pipeline variable to the secure string required by the Connect-MgGraph command and use it to authenticate.
Happy scripting 😉