Connect to SPO from Azure automation runbook using a certificate

Question

How to connect to SPO using Pnp powershell Connect-PnpOnline using a certificate with script being executed from Azure automation runbook.

I have exported a self-signed certificate and uploaded to Azure Automation. When I use the following it does not work. Another thing I noticed is that Connect-PnPOnline requires a certificatePath paramater. What are my options here when certificate is stored in Azure automation.

This does not work:

Connect-PnPOnline -Thumbprint "3234234" -Url $url -ClientId $clientId -Tenant "tenant.onmicrosoft.com"

Alternative, with script being run from runbook what could I use for path

Connect-PnPOnline -CertificatePath "??????" -CertificatePassword "3234234" -Url $url -ClientId $clientId -Tenant "tenant.onmicrosoft.com"

david remillard · Answer

Hi Gurdev,I'm having the same issue. I can actually connect using a thumbprint when running from my laptop, but when running the same command and same app reg and thumbprint in an Azure runbook, the connect fails and says it can't find a cert. Where did you end up storing the .pfx file so that you could reference it in your runbook? Azure Storage? Do you have an example of your powershell commands for the connection?Thanks,Dave

gurdev singh · Answer

Hi&nbsp;David Remillard&nbsp;&nbsp;I gave up on using a certificate for authentication when running a script from Azure Runbook. One thing that I found bit promising was to store the exported certificate file (including the private key) in runbook account, in runbook script store the certificate to runbook temporary storage and then invoke Connect-PnPOnline (code below).&nbsp;What I ended up ultimately was to use the legacy SharePoint App-Only principals?&nbsp;&nbsp;&nbsp;# # Save authentication certificate to temp location
$certificate = Get-AutomationCertificate -Name "&lt;certificate name&gt;";
$credentials = Get-AutomationPSCredential -Name "&lt;credentials i.e. the password for certificate file&gt;";
$secureCertificatePassword = $credentials.Password;
$certificatePassword = $credentials.GetNetworkCredential().Password;
$certificatePath = "$env:TEMP	emp.pfx";
$pfxCertificate = $certificate.Export(3, $certificatePassword);
if(Test-Path $certificatePath){
	Remove-Item -Path $certificatePath;
}
Set-Content -Value $pfxCertificate -Path $certificatePath -Encoding Byte;

# #verify certificate
if(Test-Path $certificatePath){
	$pnpCert = Get-PnPAzureCertificate -CertificatePassword $secureCertificatePassword -CertificatePath $certificatePath;
	Write-Output "Saved certificate to $certificatePath, Thumbprint=$($pnpCert.Thumbprint)";
 }

# Connect using the certificate
$url = "&lt;site url&gt;";
$tenantAdminUrl = "&lt;SOP admin url&gt;";
$clientId = "&lt;app client ID&gt;";
$tenantId = "&lt;tenant ID&gt;";
Write-Output "Connecting to $url with $clientId";
$connection = Connect-PnPOnline -ReturnConnection -Url $url -ClientId $clientId -Tenant $tenantId -CertificatePath $certificatePath -CertificatePassword $secureCertificatePassword -ValidateConnection;&nbsp;

nanddeepnachan · Answer

Hi Gurdev Singh&nbsp;
Please see&nbsp;https://sharepains.com/2021/07/09/pnp-powershell-azure-automation-accounts/&nbsp;

gurdev singh · Answer

Thanks Nanddeep...However, I have discovered with new version of PowerShell and PnP, the certificate thumbprint parameter no longer works and Connect-PnPOnline requires a certificatePath parameter instead.

herschelj · Answer

I was having difficulties as well, will try the above, thanks for sharing!

Forum Discussion

Connect to SPO from Azure automation runbook using a certificate

Share

Resources