Getting access token in azure with azure account username and password

Question

I am trying to gather metrics info of azure resources. For that i need an access token to authorize. But to get an access token i have to give client id, client secret, subscription id, tenant id.I was wondering if i could get this access token without giving so many details except username and password of my azure account.

Answer 1

it is possible, but it is considered not safe. And you would still need a lot of parameters:

Name    Description
grant_type  The OAuth 2 grant type: password
resource    The app to consume the token, such as Microsoft Graph, Azure AD Graph or your own Restful service
client_id   The Client Id of a registered application in Azure AD
username    The user account in Azure AD
password    The password of the user account
scope   optional, such as openid to get Id Token

Reference:
https://blogs.msdn.microsoft.com/wushuai/2016/09/25/resource-owner-password-credentials-grant-in-azure-ad-oauth/

ps. Don't mind Walter, he is wrong like 50% of the time in his answers.

Answer 2

Basically you need the parameters. Azure's APIs are protected by Azure AD so you have to authenticate against it first. If you want to make calls as the user, you still need to authenticate with one of the few ways available. The password grant (as shown in @4c74356b41 answer) is one option, though it is not really recommended. The reason is that if the user's password has expired or has MFA enabled, it won't work.

What you usually do is request the user to login via Azure AD sign-in page (via redirect or web view), and then exchange the resulting authorization code for an access token and refresh token. Then you can make calls against the APIs as the user.

Another option is to register your app in Azure AD and grant its service principal some roles in your Azure subscriptions/resource groups/resources. Then it can authenticate with client credentials (using only its client id and secret + your Azure AD tenant id).

Answer 3

It really depends on your need and if you want this fully automated or not.

If you want to have a token for a ServicePrincipal, the answer of 4c74356b41 is a great way to do it.

However if you would want to obtain a bearer token for a user (you or another AAD user) that is already authenticated in a PowerShell session, you could do this very easily if you use this piece of code that I wrote.

https://gallery.technet.microsoft.com/scriptcenter/Easily-obtain-AccessToken-3ba6e593

Basically what it does, it fetch the current token from the token cache and return it to you. This way you don't have to deal with clientId, cliendSecret or certificate. I use this all the time when I need to call the Azure REST API on a Just In Time fashion.