Automate Connect-AzureAD using powershell in Azure Devops Pipeline for SPN

Question

I am doing the following for connecting to the AAD usingazure devops Pipeline for Powershell task

1. created a SPN and granted the Permissions for the Graph
2. While using the code below to connect using the access token it says Error Pipleline

My code is simple As below

    Install-Module -Name "AzureAD" -Force
   $context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
   $graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.microsoft.com").AccessToken
   $aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.windows.net").AccessToken      
  
   Write-Output "Hi I'm $($context.Account.Id)"
   Write-Output "AAD Token is  $($aadToken)"
   Connect-AzureAD -TenantId $context.tenant.id -AadAccessToken $aadToken -MsAccessToken $graphToken -AccountId $context.Account.Id 
   $outputusers= get-azureaduser -Top 5
   Write-Output "The users are listed $($outputusers)"

Could you please let me know if i missed any detail. The SPN is just a devops pipeline one and its not a AAD user. So the token may be invalid for authentication.

What do i need to do for the SPN to be a user in AAD. Please advice

Answer 1

From your code, you use Get-AzureADUser to call Azure AD Graph, so try to add Azure Active Directory Graph Directory.Read.All permissions, can solve your problem.

By the way, the -MsAccessToken $graphToken command can be omitted.