Is there a way to switch between authentication contexts in the “AzureAD” powershell module the same way you can with the “Az” module?

2
votes

I'm working on a script that involves jumping between two different user accounts in two different Azure tenants. With the Az powershell module, I can set different auth contexts using:

Connect-AzAccount -ContextName "FirstContext" # interactive auth prompt 1
Connect-AzAccount -ContextName "SecondContext" # interactive auth prompt 2

then jump between them without any additional interactive prompts like this:

Select-AzContext -Name "FirstContext"
# do stuff within the first context
Select-AzContext -Name "SecondContext"
# do stuff within the second context

I need to do something similar (jumping back and forth between auth contexts in the same script) using cmdlets in the AzureAD powershell module now... Does anyone know this may be able to be achieved? Both auth contexts require interactive MFA, which Get-Credential doesn't seem to support.

Thanks!

1
azurepowershellazure-active-directoryazure-ad-powershell-v2
Do you want to circumvent MFA auth or switch auth contexts? How do you plan to jump between the contexts without using their name? Could you store the result of Connect-AzAccount such as $contextOne = Connect-AzAccount -ContextName "FirstContext"? is there a reason why you are avoiding fixing up the accounts to follow least priviledge? – lloyd
@lloyd I want to switch auth contexts on-the-fly for the AzureAD module. I already can for the Az module, but they're different modules, so I can't take the auth contexts from Az and pass them to AzureAD. I'm happy to front-load MFA auth as much as necessary (once per module, per context, so 4x), but I'm looking to avoid re-MFAing within the same PS window when I want to switch between them. – Benjin

1 Answers

1
votes

Currently, Azure AD PowerShell module does not support to select context.

If you just want to avoid interactive MFA again, you can login with a service principal, after doing something you want, disconnect it and change another service principal.

Connect-AzureAD -TenantId "bb58915c-xxxxx5b97ed6c65" -ApplicationId "ec614bcd-d129-4ca4xxxxx19b07" -CertificateThumbprint "F1D9FE13xxxxx8B07D1666"

#do something you want

Disconnect-AzureAD

Besides, this is the Azure AD feedback, you can post it as an idea.