使用 powershell 使用访问令牌连接到 azure 广告

Question

I'm writing a powershell script to connect to azure ad using access token. I'm using below command:

Connect-AzureAD -TenantId "$tenantId"  -AadAccessToken $tokenResponse.access_token -AccountId "$appId"

I have given application "Contirbute" & "Global Administrator" Role, also Application has all required permissions.

When I execute the script I can connect to Azure AD but if I try to run subsequent commands after this it gives be below error.

Please assist me on this further.

Get-AzureADUser : Error occurred while executing GetUsers
Code: Authentication_ExpiredToken
Message: Your access token has expired. Please renew it before submitting the request.
HttpStatusCode: Unauthorized
HttpStatusDescription: Unauthorized
HttpResponseStatus: Completed
At C:\Users\kajalchaudhari\Desktop\test_connect.ps1:22 char:1
+ Get-AzureADUser -Top 10
+ ~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiException
+ FullyQualifiedErrorId : 
Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUser

Answer 1

seems like you need to configure the token expiry in Azure AD. if you have already done that and the error message is instant then see if following blog is helpful

https://www.insight.com/en_US/content-and-resources/tech-tutorials/azure-active-directory-authentication-token.html

Answer 2

The error means the AAD Graph token you passed has expired, you need to pass a new one.

Or if you want to automate this, you could follow the steps below.

1.First, make sure you have installed the Az module. Then get the application id , tenant id , client secret of the AD App which is the global admin.

2.Then run the script below, it works fine on my side.

$azureAplicationId ="<application id>"
$azureTenantId= "<tenant id>"
$azurePassword = ConvertTo-SecureString "<client secret>" -AsPlainText -Force
$psCred = New-Object System.Management.Automation.PSCredential($azureAplicationId , $azurePassword)
Connect-AzAccount -Credential $psCred -TenantId $azureTenantId -ServicePrincipal

$context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
$aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.windows.net").AccessToken
Connect-AzureAD -AadAccessToken $aadToken -AccountId $context.Account.Id -TenantId $context.tenant.id

Get-AzureADUser