Azure Devops: value cannot be null, parameter token

Question

I am running an Azure Powershell task in Azure DevOps. Inside the script I use the following command

Get-AzureRmADUser -UserPrincipalName $adusernameNewPermission

But my Release pipeline fails with following error code

 ##[error]Value cannot be null.
Parameter name: token

First I thought that the command didn't have the right context or enough permission so I've added the defaultprofile.

Get-AzureRmADUser -DefaultProfile (Get-AzureRmContext) -UserPrincipalName $adusernameNewPermission

The GetAzureRmContext did go to the right context if I print the output of that command.

The command itself didn't had any problem when running locally (with my own user account) So the only reason I think its heading is that the service connection doesn't have the right to perform that action. But my user account has the least permissions on the tenant whilst the service connnection in azure devops has much more permissions.

It's driving me crazy where the problem lays with this one. Which token does it mean ? No reasonable error message :( Does someone encounter the same problem or knows what I am missing ?

PS: the $adusernameNewPermission variable works like I said the exact same code runs perfectly on my local machine with the only difference being the user that is logged in.

Answer 1

Did you try using Get-azureaduser instead? This is a command that requires the function to be authenticated against Azure AD.

$azurePassword = ConvertTo-SecureString $env:client_secret -AsPlainText -Force
$psCred = New-Object System.Management.Automation.PSCredential($env:clientid , $azurePassword)
Connect-AzAccount -Credential $psCred -TenantId $env:tenantid -ServicePrincipal

Answer 2

如果您正在使用“脚本文件路径”的脚本类型，请检查您是否没有尝试传递任何参数（例如-token）。

Answer 3

I'd try 2 things to get back to basics. This will let you know if it is actually the AzDO Service Principal or not and the type of object to use in the pipeline.

1. Test the functionality of the command in its simplest form and run it with the account as a string:

Get-AzureRmADUser -UserPrincipalName "achahbar@stankoverflow.com"

#OR

$UPN = "achahbar@stankoverflow.com"
Get-AzureRmADUser -UserPrincipalName $UPN

Assuming this works and depending on what your variable contains you simply need to pass the the UPN/Email object into the command:

Get-AzureRmADUser -UserPrincipalName $adusernameNewPermission.UPN

2. If this doesn't work pdate your task to Version 4 (Preview) and update your commands to Get-AzADUser and test step 1. again