Hi Saul-
I've broken the process down into a bunch of functions to allow for code reuse by other employees. Suffice to say that the process works entirely as expected against our CSP tenant, including connecting to our shared services tenant to access the AKV we're using to store secrets.
All of this code more or less works, but I've substituted any hardcoded IDs and stuff like vault names/secret names.
Client login (specifically AZ account, but AAD fails as well in the same ways):
function Connect-ClientAZAccount {
param (
[Parameter(Mandatory)][string]$CID
)
$tokenObject = GenerateTokenAuth
$refreshToken = UnsecureString($tokenObject.RefreshToken)
try {
$azureToken = New-PartnerAccessToken -ApplicationId $tokenObject.ApplicationId -Credential $tokenObject.credential -RefreshToken $refreshToken -Scopes 'https://management.azure.com/user_impersonation' -ServicePrincipal -Tenant $CID
$graphToken = New-PartnerAccessToken -ApplicationId $tokenObject.ApplicationId -Credential $tokenObject.credential -RefreshToken $refreshToken -Scopes 'https://graph.windows.net/.default' -ServicePrincipal -Tenant $CID
}
catch {
$azureToken = New-PartnerAccessToken -ApplicationId $tokenObject.ApplicationId -Credential $tokenObject.credential -RefreshToken $refreshToken -Scopes 'https://api.partnercenter.microsoft.com/user_impersonation' -ServicePrincipal -Tenant $CID -UseAuthorizationCode
#$graphToken = New-PartnerAccessToken -ApplicationId $tokenObject.ApplicationId -Credential $tokenObject.credential -RefreshToken $refreshToken -Scopes 'https://graph.windows.net/.default' -ServicePrincipal -Tenant $CID -UseAuthorizationCode
}
$ClientAZAccount = Connect-AzAccount -AccessToken $azureToken.AccessToken -AccountId $upn -GraphAccessToken $graphToken.AccessToken -TenantId $CID
return $ClientAZAccount
}
GenerateTokenAuth (Grabs an authentication info and returns it as an object)
function GenerateTokenAuth {
$azc = Get-AzContext -ListAvailable | Where-Object Tenant -match '00000000-0000-0000-0000-000000000000' | Select-AzContext
if (!$azc) {
Connect-AzAccount -Tenant '00000000-0000-0000-0000-000000000000' -ContextName "CSP"
} else {
Select-AzSubscription -TenantId "00000000-0000-0000-0000-000000000000" | Out-Null
}
$AppCred = New-Object System.Management.Automation.PSCredential([Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR(((Get-AzKeyVaultSecret -VaultName "vault" -Name 'CSPAppId').SecretValue))), (Get-AzKeyVaultSecret -VaultName "vault" -Name 'CSP-AppSecret').SecretValue)
$ThisObject = @{}
$ThisObject.Add('CSPTenant', '00000000-0000-0000-0000-000000000000')
$ThisObject.Add("UPN", $upn)
$ThisObject.Add("ApplicationId", (UnsecureString((Get-AzKeyVaultSecret -VaultName "vault" -Name 'CSPAppId').SecretValue)))
$ThisObject.Add("RefreshToken", (RefreshToken))
$ThisObject.Add("Credential", $AppCred)
return $ThisObject
}
RefreshToken (Grabs+returns refresh token, and if expiration date < 14 days away it refreshes it + stores it)
function RefreshToken {
$azc = Get-AzContext -ListAvailable | Where-Object Tenant -match '00000000-0000-0000-0000-000000000000' | Select-AzContext
if (!$azc) {
Connect-AzAccount -Tenant '00000000-0000-0000-0000-000000000000' -ContextName "CSP"
} else {
Select-AzSubscription -TenantId '00000000-0000-0000-0000-000000000000' | Out-Null
}
$CSPR = Get-AzKeyVaultSecret -VaultName "vault" -Name 'CSPR'
if ($cspr.Expires -le (get-date).adddays(14)) {
$AppSecret = Get-AzKeyVaultSecret -VaultName "vault" -Name 'CSP-AppSecret'
$SecureAppID = (Get-AzKeyVaultSecret -VaultName "vault" -Name 'CSPAppId').SecretValue
$AppId = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecureAppID))
$credential = new-object -typename System.Management.Automation.PSCredential -argumentlist $AppID, $AppSecret.SecretValue
$token = New-PartnerAccessToken -ApplicationId $AppID -Scopes 'https://api.partnercenter.microsoft.com/user_impersonation' -ServicePrincipal -Credential $credential -Tenant '00000000-0000-0000-0000-000000000000' -UseAuthorizationCode
$refreshToken = convertto-securestring $token.RefreshToken -asplaintext -force
Set-AzKeyVaultSecret $CSPR -Expires (get-date).AddDays(90) -SecretValue $refreshToken
}
$refreshToken = (Get-AzKeyVaultSecret -VaultName "vault" -Name 'CSPR').SecretValue
return $refreshToken
}
UnsecureString (because I got tired of seeing the code to decrypt secure strings everywhere)
function UnsecureString {
param (
[Parameter(Mandatory)][securestring]$SecureString
)
$UString = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecureString))
return $UString
}
Running Connect-ClientAZAccount starts the expected authentication flow... browser pop up, MFA auth push then this:
Where the first red box is our app ID and the second red box is a client Tenant ID.
The app in our CSP tenant has the appropriate permissions and has been granted admin:
