Category: Azure

There are lot's of reasons why unattended authentication is handy using modern authentication methods. This is true in Azure, Exchange Online, Azure AD, SharePoint & more. Azure Automation is the main reason I tend to use them but more regularly, I create scripts, functions & modules that will be used by my colleagues. If I set up authentication using a service principal/Azure App registration, I can then pre-configure the less sensitive data within, leaving my colleagues to pass the certificate password, secret or perhaps thumbprint to the script via the console. This keeps the sensitive data safe but takes away they need for the MFA prompts and permission checks.

In this example, I am going to walk through how I set up an Azure App registration that can be used in this way. There is a very helpful post at PnP-PowerShell covering Connect Using App Permissions that is probably worth a read. This approach is more simple but works very well and it uses a self signed certificate. I have found it pretty easy to put the certificate in a shared area making it simple for the code to access when colleagues use my PowerShell offerings too.

Here is the code

$Password = "P4ssW0rd"

$SecPassword = ConvertTo-SecureString -String $Password -AsPlainText -Force

$Params = @{
    Out                 = "C:\temp\LabSPOAccess.pfx" 
    ValidYears          = 30 
    CertificatePassword = $SecPassword 
    CommonName          = "LabSPOAccess" 
    Country             = "GB" 
    State               = "Scotland" 
    Locality            = "Glasgow"
}

$Cert = New-PnPAzureCertificate @Params