One of the great features of the recent versions of Azure PowerShell is a non-interactive option for the Add-AzureAccount cmdlet. Unfortunately, the instructions tell you to save your Azure password in plain text, but there are much more secure alternatives. I explain one in this post. <\/p>\n
——————- <\/p>\n
As users of Azure PowerShell know well, there have always been two distinct ways of making your Azure account available to Windows PowerShell. You can download (Get-AzurePublishSettingsFile<\/a>) and import (Import-AzurePublishSettingsFile<\/a>) a PublishSettings file. This technique uses a management certificate with security credentials and, while it\u2019s a bit more complex, once the certificate is on the machine, you can access your Azure account in Windows PowerShell. <\/p>\n You can also use Azure Active Directory (Azure AD). The Add-AzureAccount<\/a> cmdlet prompts you to sign into your Azure account by popping up a sign-in window. When sign-in succeeds, information about your Azure account is saved in a subscription data file in your roaming user profile and Windows PowerShell gets an access token that it can use to access your Azure account on your behalf. This is a great strategy, except that the token expires (in about 12 hours) and the interactive sign-in prompt prevents you from using it in a script. <\/p>\n Until now. <\/p>\n Beginning in Azure PowerShell 0.8.9, you can use the Credential <\/strong>parameter of Add-AzureAccount to suppress the sign-in pop-up. It works only with an organizational ID (not with a Microsoft account), but it\u2019s easy to create an organizational ID for any account. More on that below). <\/p>\n Here\u2019s the snippet for adding an Azure account to Windows PowerShell in a script. As an alternative to the equally interactive Get-Credential<\/a> cmdlet, you use the New-Object<\/a> cmdlet to create a PSCredential object. Then, you pass it the username and a secure string form of the password of your Azure account. When you call Add-AzureAccount with the PSCredential object, it uses the credentials to sign you in so you are not prompted.<\/p>\n This is a great solution, but the instructions in <\/a>How to install and configure Azure PowerShell<\/a> tell you to use plain text for both the user name and password.<\/p>\n This is neither secure nor necessary. Although no method is completely secure, storing a password in plain text in a text\/script file on disk is downright scary. If you need to save a password on disk, at least save it in an encrypted string. <\/p>\n It\u2019s easy to do. In this code, we use the Read-Host<\/a> cmdlet to prompt you for the password (just once). The AsSecureString<\/strong> parameter is equivalent to piping the password string that you type to the ConvertTo-SecureString<\/a> cmdlet. The result is a secure string.<\/p>\n Next, use the ConvertFrom-SecureString<\/a> cmdlet to convert the secure string to an encrypted string and then save it to disk.<\/p>\n If anyone happened to peek in that file, they\u2019d see something that looks like this. <\/p>\n Then, in Azure PowerShell scripts, you use almost the same code for your Add-AzureAccount command, except that you add a Get-Content command to get the encrypted string from its file.<\/p>\n This is easy and much more secure. Here\u2019s a little function that saves any password to disk as an encrypted string.<\/p>\n <\/p>\n Now, about that organizational ID. You can create at least one organizational ID for any Azure account, even one that is secured with a Microsoft account, such as an Outlook.com account. You can find the instructions in the <\/a>\u201cUse the Azure AD method\u201d section of <\/a>How to install and configure Azure PowerShell<\/a>.<\/p>\n I still haven\u2019t figured out a workaround for the expiring Azure AD token, so I include an Add-AzureAccount command that gets a new token in every script. But the password is saved as an encrypted string and the user of the script is not interrupted.<\/p>\n June Blender is a technology evangelist at SAPIEN Technologies, Inc. You can reach her at juneb@sapien.com<\/a> or follow her on Twitter at @juneb_get_help<\/a>.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":" One of the great features of the recent versions of Azure PowerShell is a non-interactive option for the Add-AzureAccount cmdlet. Unfortunately, the instructions tell you to save your Azure password in plain text, but there are much more secure alternatives. I explain one in this post. ——————- As users of Azure PowerShell know well, there […]<\/p>\n","protected":false},"author":31,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[25],"tags":[934,28],"class_list":["post-7994","post","type-post","status-publish","format-standard","hentry","category-windows-powershell","tag-juneb","tag-powershell"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/7994","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/31"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=7994"}],"version-history":[{"count":16,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/7994\/revisions"}],"predecessor-version":[{"id":10598,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/7994\/revisions\/10598"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=7994"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=7994"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=7994"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}$cred = New-Object -TypeName System.Management.Automation.PSCredential ($userName, $securePassword)\r\nAdd-AzureAccount -Credential $cred<\/pre>\n
$username = \"
$secure = Read-Host -AsSecureString -Prompt \"Enter your Azure organization ID password.\"<\/pre>\n
ConvertFrom-SecureString -SecureString $secure | Out-File -FilePath $FilePath<\/pre>\n
\n
01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b2299cb1e643949ae2af8e01153829c00000\r\n00001000000d08c9ddf0115d1118c7a00c04fc297eb010000009b2299cb1e643949ae2af8e01153829c00\r\n000000020000000000106600000001000020000000e5e552e0bc6def08bf715a2511ad26cef2a41211f28\r\n35cba161944b4f17fc017000000000e80000000020000200000008b267e1ac697b27b381925dc4cc43db6\r\na06c6f5524442e340e7b456fb9005a42200000007c829e84ebd387a803b10ca08d0c43c0df7abbc2e1067\r\n07ad21178d0b1f215084000000093ae66ef19b086d52da13b76308ee7f4910d7b70c5af1c8366db5f8be1\r\nc746c301eb88c11e4609ad4ef90a638adba7c571b739978952c165626075282e58eec6<\/pre>\n<\/blockquote>\n
$username = \"coadmin@myenterprise.onmicrosoft.com\"\r\n$securePassword = ConvertTo-SecureString (Get-Content -Path $FilePath)\r\n$cred = New-Object -TypeName System.Management.Automation.PSCredential ($username, $securePassword)\r\n$result = Add-AzureAccount -Credential $cred<\/pre>\n
function<\/span> Save-Password<\/span>\r\n {\r\n <\/span>Param<\/span>\r\n (\r\n [<\/span>parameter<\/span>(Mandatory <\/span>=<\/span> $true<\/span>)]\r\n [<\/span>String<\/span>]\r\n <\/span>$FilePath<\/span>,\r\n \r\n [<\/span>parameter<\/span>(Mandatory <\/span>=<\/span> $true<\/span>)]\r\n [<\/span>Switch<\/span>]\r\n <\/span>$PassThru<\/span>\r\n )\r\n \r\n <\/span>$secure<\/span> =<\/span> Read-Host<\/span> -AsSecureString<\/span> \"Enter your Azure organization ID password.\"<\/span>\r\n $encrypted<\/span> =<\/span> ConvertFrom-SecureString<\/span> -SecureString<\/span> $secure<\/span>\r\n $result<\/span> =<\/span> Set-Content<\/span> -Path<\/span> $FilePath<\/span> -Value<\/span> $encrypted<\/span> -PassThru<\/span>\r\n \r\n if<\/span> (<\/span>!<\/span>$result<\/span>)\r\n {\r\n <\/span>throw<\/span> \"Failed to store encrypted string at $FilePath.\"<\/span>\r\n }\r\n <\/span>if<\/span> (<\/span>$PassThru<\/span>)\r\n {\r\n <\/span>dir<\/span> $FilePath<\/span>\r\n }\r\n }<\/span><\/pre>\n