在没有用户凭据的情况下登录 Azure 自动化帐户到 Azure AD

Question

is possible to connect with an azure automation account to azuread with cmdlet:

• MsOnline Module
• AzureAD Module

without use credential stored in automation account?

I'm using following code with credential and works fine:

$azureadcred = Get-AutomationPSCredential -Name 'AzureAD'
Connect-AzureAD -credential $azureadcred

$o365cred = Get-AutomationPSCredential -Name 'O365'
Connect-Msolservice -credential $o365cred

Any help is appreciated

Thanks

Answer 1

How to connect AzureAD module without user

We can use the service principal to connect module AzureAD. Meanwhile, you use the Azure Automation Account, we can directly use Azure Automation Run As accounts to connect the module.

The detailed steps are as below.

1. Assign Azure AD role to the Run As accounts. a. Get the object id of the Run As accounts

   b. assign role

 Connect-AzureAD 

 $role =Get-AzureADDirectoryRole -Filter "DisplayName eq 'Company Administrator'" 

    Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId <the object id you copy>

2. PowerShell Script

 $servicePrincipalConnection=Get-AutomationConnection -Name 'AzureRunAsConnection'
 $connectState = Connect-AzAccount `
       -ServicePrincipal `
       -TenantId $servicePrincipalConnection.TenantId `
       -ApplicationId $servicePrincipalConnection.ApplicationId `
       -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
 if ($connectState) {
        "Connected."
    } else {
        "Doesn't seem to be connected."
    }
$context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
$context.Account
$graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.microsoft.com").AccessToken

$aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.windows.net").AccessToken

Connect-AzureAD -TenantId $context.tenant.id -AccountId $context.Account.Id -AzureEnvironmentName $context.Environment.Name -AadAccessToken $aadToken -MsAccessToken $graphToken 

get-azureaduser -Top 5