How to connect-azaccount in Azure DevOps release pipeline

Question

In the release pipeline, I am trying to connect to Azure AD by using Connect-Azaccount so I can run Get-AzADgroup to retrieve some Az AD group names and their guid and output to variables.

I created Azure Powershell task with the following inline script.

(Get-AzADGroup -DisplayName "group-name").origin

If my reply is helpful, please mark it as the answer(on the left of my reply, there is an option to mark), thanks. — Joy Wang-MSFT
Hi Joy, I haven't tried yet as I don't have permission to create AD application and Service Principal. I will update you as soon as I get the permissions. — wonderfulworldwithcharity
You can also use the existing AD application, if you create a devops project, it will automatically create an AD App named like organizationname-projectname-513f22f1-befd-xxxxxxcfe90f in the App Registerations in your tenant. But you also need the permission to Grant admin consent for xxx. May be you could ask your admin to grant the api permission for you.:-) — Joy Wang-MSFT
Hi Joy, i've created request to have our security team create the AD application. Still waiting.. — wonderfulworldwithcharity
Hi Joy, under Azure Subscription in AZ powershell task, are you using service principal or Managed Service Identity service connection? — wonderfulworldwithcharity

Joy Wang-MSFT Joy Wang-MSFT · Accepted Answer · 2019-05-29T04:41:21

It seems you need to use a non-interactive login, follow the steps as below.

1.Create an Azure Active Directory application and create a secret for the app, save the secret and get values for signing in.

2.In your AD App -> API permissions -> Add a permission -> select Azure Active Directory Graph -> Application permissions -> Directory.Read.All -> click Add permissions -> click Grant admin consent for xxx, refer to the screenshot.

3.Try the script as below, use the values which you get in step 1, it works fine on my side.

Note: You need to use the Task version with 4.*(preview) when you use Az powershell module.

$azureAplicationId ="<your ad app application id>"
$azureTenantId= "<your tenant id>"
$azurePassword = ConvertTo-SecureString "<the secret of your ad app>" -AsPlainText -Force
$psCred = New-Object System.Management.Automation.PSCredential($azureAplicationId , $azurePassword)
Connect-AzAccount -Credential $psCred -TenantId $azureTenantId  -ServicePrincipal 
#I just test to get all groups, you could do other operations
Get-AzADGroup

How to connect-azaccount in Azure DevOps release pipeline

1 Answers