The Login-AzureRmAccount PowerShell command allows you to login to your Azure account from PowerShell. However, it brings up a prompt and you have to manually type in your credentials. Obviously this is fine for development or things you are doing for one time administration. But in order to have fully automated scripts, this is one of the first pieces in the puzzle, especially when you are likely to be running these on a build server and you don’t want an account that is tied to an acual person.
Creating a service principal
You certainly don’t want to have your personal signin credentials in the script. You need a service account that has just enough permissions to run the scripts that are being run.
This is accomplished with service principal which is an instance of an application on your Active Directory which you grant access to resourcess.
1. Login to your Azure account with:
2. Then we need to create an Active Directory application.
$displayName = "App Display Name" $homePage = "http://YourApplicationHomePage" $identifierUris = "http://YourApplicationUri" $password = "APasswordHere" $app = New-AzureRmADApplication –DisplayName $displayName –HomePage $homePage –IdentifierUris $identifierUris –Password $password
3. Create the Service Principal
Now we need to create a service principal for that application which needs to access resources. This takes the applicationId of the application we created above.
New-AzureRmADServicePrincipal –ApplicationId $app.ApplicationId
4. Grant the Service Principal roles
You can view a list of the default roles here: https://azure.microsoft.com/en-gb/documentation/articles/role-based-access-built-in-roles/
New-AzureRmRoleAssignment –RoleDefinitionName Contributor –ServicePrincipalName $app.ApplicationId
Authenticating using a service principal
1. Create a PSCredential object
$username = "YourUserName" $pass = ConvertTo-SecureString "YourPassword" -AsPlainText –Force $cred = New-Object -TypeName pscredential –ArgumentList $username, $pass
2. Get the TenantId from your subscription
$tenant = (Get-AzureRmSubscription).TenantId
Login with the credential object
Login-AzureRmAccount -Credential $cred -ServicePrincipal –TenantId $tenant
Save Token to login later
You can save the profile as a token and login with that token later. This however does expire, and typically lasts around 12 hours.
Save-AzureRmProfile -Path c:\AzureLoginToken.json
Next time you want to login, just load the Profile
Select-AzureRmProfile -Path c:\AzureLoginToken.json
Authenticating using a service principal and certificate
This will look mostly familiar to the above, except we first must generate the certificate that we are going to use and then create the AD Application with that certificate.
1. Login to Azure
2. Create certificate
$cert = New-SelfSignedCertificate -CertStoreLocation "cert:\CurrentUser\My" -Subject "CN=exampleapp" -KeySpec KeyExchange $keyValue = [System.Convert]::ToBase64String($cert.GetRawCertData())
3. Create AD Application
$azureAdApplication = New-AzureRmADApplication -DisplayName "exampleapp" -HomePage "https://www.contoso.org" -IdentifierUris "https://www.contoso.org/example" -KeyValue $keyValue -KeyType AsymmetricX509Cert -EndDate $cert.NotAfter -StartDate $cert.NotBefore
4. Create Service Principal
New-AzureRmADServicePrincipal -ApplicationId $azureAdApplication.ApplicationId
5. Assign roles to Service Principal
New-AzureRmRoleAssignment -RoleDefinitionName Contributor -ServicePrincipalName $azureAdApplication.ApplicationId.Guid
Create Login script for certificate
1. Get Application Id
$applicationId = $azureAdApplication.ApplicationId # Alternatively # $applicationId = (Get-AzureRmADApplication -IdentifierUri "https://www.yourappURL.com").ApplicationId
2. Get thumbprint of the certificate
$thumbprint = $cert.Thumbprint # Alternatively # $thumbprint = (Get-ChildItem -Path cert:\CurrentUser\My\* -DnsName exampleapp).Thumbprint
3. Get the tenant
$tenantId = (Get-AzureRmSubscription).TenantId
4. Save file called login.ps1
This script is the login script that you will use, it contains the thumbprint, applicationId and tenantId needed to login as the newly created Service Principal.
$loginCommand = "Add-AzureRmAccount -ServicePrincipal -CertificateThumbprint $thumbprint -ApplicationId $applicationId -TenantId $tenantId" Add-Content 'c:\login.ps1' $loginCommand
Hopefully that has given you a few options and taken you through how to login non-interactively into Azure.
Script examples are on GitHub here.