Home
Windows
    Windows Server
    Windows Client OS
Linux
Powershell
Virtualization
    VMware
    Hyper-V
Cloud Computing
    Citrix XenApp
    Citrix Xendesktop
Useful links
About
ajni.IT -
  • Home
  • Windows
    • Windows Server
    • Windows Client OS
  • Linux
  • Powershell
  • Virtualization
    • VMware
    • Hyper-V
  • Cloud Computing
    • Citrix XenApp
    • Citrix Xendesktop
  • Useful links
  • About

Create Azure Service Principals with Azure Powershell

June 29, 2020 by AJNI No Comments

An Azure Service Principal is a service account created in Azure AD and can be leveraged in PowerShell scripts for automation. It is recommended to use Service Principals for security reasons since they have separate credentials and very constrained rights.

You can either use password-based authentication or certificate-based authentication with Service Principals. In this article, only password-based authentication is covered. Certificate-based authentication is treated in the Microsoft article linked at the end of the page.

First of all, the Az Powershell Module is needed.

Install-Module -Name Az -AllowClobber -Scope Allusers

If you have multiple subscriptions, make sure you have selected the correct one.

Get-AzSubscription

Select-AzSubscription -SubscriptionId xxxxxxxxx

Now create the Principal:

$sp = New-AzADServicePrincipal -DisplayName PowershellAutomation

The $sp object contains a secret parameter (the password), which is not in clear-text and an ApplicationID, that will be used as the username. To decrypt the secret parameter use the following commands:

$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($sp.secret)
$UnsecurePassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)

In a script the $UnsecurePassword should not be hardcoded, instead, it should be saved as an encrypted XML file and decrypted when the script is executed. I wrote a post about securing credentials in PowerShell scripts, check it out: https://www.ajni.it/2020/05/powershell-encrypt-and-store-your-credentials-securely/.

Logging in is also straightforward. The Tenant id can be retrieved in the main page of Azure AD.

Connect-AzAccount -ServicePrincipal -Credential $credentials -Tenant xxxxx

When assigning rights, the newly created identity will be listed:

References:

https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-3.8.0

Reading time: 1 min

Tip Of the Day

  • Delete or rename a folder with a blank space at the end

    1 month ago

Recent Posts

  • Microsoft AlwaysOn VPN Deployment
  • Delete or rename a folder with a blank space at the end
  • Automatic program start at logon with GPOs
  • Reset Computer Secure Channel of a Domain Computer with one PowerShell command
  • Let Outlook connect to Exchange Online instead of Exchange On-Prem

Categories

  • Azure (5)
  • Citrix XenApp (6)
  • Citrix Xendesktop (4)
  • Cloud Computing (18)
  • Coding (1)
  • Hyper-V (5)
  • Linux (8)
  • Powershell (8)
  • Security (2)
  • VDI (4)
  • Virtualization (12)
  • VMware (5)
  • Windows (16)
  • Windows Client OS (14)
  • Windows Server (23)

Archives

  • December 2020
  • November 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • November 2019
  • October 2019
  • September 2019
  • August 2019
  • July 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019

ajni IT © 2019