powershellmicrosoft-graph-apiazure-automationazure-runbook

Certificate authentication to Graph API in Azure Automation Account

I'm trying to authenticate to the Graph API through Powershell (5.1) using a certificate in an automation account runbook.

I've created a private key and certificate into a password protected PFX. It's uploaded to the 'Certificate' section in my automation account. I've tested to upload it manually in the portal and using New-AzAutomationCertificate, exportable and non-exportable.

I have tested:

Import-Module Microsoft.Graph.Users

$AppId = '<app id>'
$TenantId = '<tenant id>'

$cert = Get-AzAutomationCertificate -ResourceGroupName "automation" -AutomationAccountName "aa-automation-common" -Name "cert-auth-prod-exportable"

Connect-MgGraph -Certificate $cert -TenantId $TenantId -ClientId $AppId

Get-MgUser -UserId "<user id>"

And

Import-Module Microsoft.Graph.Users

$AppId = '<app id>'
$TenantId = '<tenant id>'

$cert = (Get-AzAutomationCertificate -ResourceGroupName "automation" -AutomationAccountName "aa-automation-common" -Name "cert-auth-prod-exportable").Thumbprint

Connect-MgGraph -CertificateThumbprint $cert -TenantId $TenantId -ClientId $AppId

Get-MgUser -UserId "<user id>"

Both results in an error when running in the runbook in Azure.

Get-AzAutomationCertificate : Object reference not set to an instance of an object. At line:6 char:10 + $cert = (Get-AzAutomationCertificate -ResourceGroupName "automation" ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : CloseError: (:) [Get-AzAutomationCertificate], NullReferenceException + FullyQualifiedErrorId : Microsoft.Azure.Commands.Automation.Cmdlet.GetAzureAutomationCertificate

When I test it locally in VS Code by first signing in using Connect-AzAccount both works fine. I get the certificate info, can connect using Connect-MgGraph and fetch the user info.

Any clues?

Solution

  • I created a password protected PFX and uploaded it to the 'Certificates' section in my automation account:

    enter image description here

    When I ran your code in my environment, I too got same error as below:

    Import-Module Microsoft.Graph.Users

$AppId = 'appId'
$TenantId = 'tenantId'

$cert = (Get-AzAutomationCertificate -ResourceGroupName "Sri" -AutomationAccountName "testautomation" -Name "GraphCert").Thumbprint
Connect-MgGraph -CertificateThumbprint $cert -TenantId $TenantId -ClientId $AppId
Get-MgUser -UserId "xxxxxxxx"

    Response:

    enter image description here

    Note that, the error occurred as you missed calling Connect-AzAccount that is necessary for Get-AzAutomationCertificate command to work.

    To resolve the error, I turned on system-managed identity of automation account and added Contributor (a Reader role would be enough) role to it like below:

    enter image description here

    When I ran below modified script by connecting to Azure via system-managed identity, I got the response with user details successfully like below:

    # Ensures you do not inherit an AzContext in your runbook
Disable-AzContextAutosave -Scope Process

$AzureContext = (Connect-AzAccount -Identity).context
$AzureContext = Set-AzContext -SubscriptionName $AzureContext.Subscription -DefaultProfile $AzureContext

Import-Module Microsoft.Graph.Users

$AppId = 'appId'
$TenantId = 'tenantId'

$cert = (Get-AzAutomationCertificate -ResourceGroupName "Sri" -AutomationAccountName "testautomation" -Name "GraphCert").Thumbprint
Connect-MgGraph -CertificateThumbprint $cert -TenantId $TenantId -ClientId $AppId
Get-MgUser -UserId "xxxxxxxx"

    enter image description here

    Response:

    enter image description here

    enter image description here

    In your case, make sure to call Connect-AzAccount before running Get-AzAutomationCertificate command.

    Reference: Using a system-assigned managed identity for an Azure Automation account | Microsoft