Microsoft Cloud Products - Repeated Powershell Authentication

[FN-GM]

Hello,

 

We use a number of different Powershell script to perform tasks for MS cloud products. A basic example is offboarding. The script sets a forwarding address in Exchange Online and then removes licenses from the user account. It also modifies something in Azure AD.

 

It is requiring us to authenticate 3 times. Once for Connect-MsolService, the second for Connect-ExchangeOnline and a third for Connect-AzureAD.

 

We also have some more advance ones that also make modifications to Dynamics and Business Central.

 

Is there a way to authenticate once please?

 

We used to use get-credential but it doesn't work with MFA. I don't think it works at all anymore?

 

I know there is "Connect-ExchangeOnline -UserPrincipalName [email protected]" for Exchange Online. I could figure out how to populate the UserPrincipalName automatically however this option isn't available on on modules.

 

I was wondering if anyone has any suggestions please?

 

Thanks

Edited August 5, 2021 by FN-GM

[Norphy]

Certificate based authentication:

 

https://docs.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps

[FN-GM]

Thanks - what happens if someone (a service desk guy) takes a copy of the certificate? We wouldn't know. At least at the moment when they leave we will disable their accounts and cut off access.

 

Also if we used this method would the audit log show who had executed the commands / script?

 

Thanks

[RobD]

We run all ours from a specific site and then exclude that site from MFA using conditional access.

[FN-GM]

We run all ours from a specific site and then exclude that site from MFA using conditional access.

 

It is something I have considered. However in the next 12 months or so we are to be completely cloud. There will be no VPN so will create issues when working from home when that time comes.

[RobD]

Potentially not the cheapest method but could you run it from a vm in azure? Then exclude it from MFA??

[chaplic]

I like using graph API where possible which means you can be very granular with the rights you give it and using a service principal means no MFA headache. It's a bit lacking in the Exchange side of things.