Forum Discussion
Russell Gove
May 10, 2019Iron Contributor
Using Connect-SPOService in Azure Runbooks with MFA Enabled Account
Hi, I'm trying to move my SPO Admin scripts to Azure Runbooks. My Admin Account is MFA enabled. When I run the commands: $creds=Get-AutomationPSCredential -Name 'MyCredentials' Connect-SPOServic...
- May 13, 2019
Hi Russell Gove, no you can't use an MFA account when doing this level of automation unfortunately as the usual behaviour is to open a popup to request the authentication. There are a couple of options which you have available to you:
1. Use a "service account" which doesn't have MFA (this is the easiest way, just ensure you have a strong password on the account)
2. Connect using App ID and Secret
I hope that helps
Matt Weston
May 13, 2019Iron Contributor
Hi Russell Gove, no you can't use an MFA account when doing this level of automation unfortunately as the usual behaviour is to open a popup to request the authentication. There are a couple of options which you have available to you:
1. Use a "service account" which doesn't have MFA (this is the easiest way, just ensure you have a strong password on the account)
2. Connect using App ID and Secret
I hope that helps
Beau Cameron
May 13, 2019MVP
Matt Weston Agreed. I prefer #2 as it's a more granular approach to permissions than re-using service accounts for multiple things in your environment.
- Russell GoveMay 13, 2019Iron Contributor
Beau Cameron Thanks for the info. So I created an app ID and secret, and then created a new credentials in my Azure Automation account (called runbooksappidandsecret) using the app id and secret.
Then I try to use that credential in my script:
param([Parameter(Mandatory=$true)][String] $SitePath)$creds=Get-AutomationPSCredential -Name 'runbooksappidandsecret'$adminUrl = Get-AutomationVariable -Name 'AdminUrl'Write-Output "Admin Url is $adminUrl"Connect-SPOService -Url "$adminUrl" -Credential $credsWrite-Output "Connected"This gives me an error:Connect-SPOService : The 'username' argument is invalid. At line:9 char:1 + Connect-SPOService -Url "$adminUrl" -Credential $creds + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Connect-SPOService], ArgumentException + FullyQualifiedErrorId : System.ArgumentException,Microsoft.Online.SharePoint.PowerShell.ConnectSPOService
- RobOnyxPublishingFeb 17, 2021Copper Contributor
I am having the same problem but I am actually trying to access PNP Cmdlts. I'm fairly new so I am curious on the process of " So I created an app ID and secret, and then created a new credentials in my Azure Automation account (called runbooksappidandsecret) using the app id and secret."
Could you tell me the process to get to this point?
Many thanks
Rob
- Paul BullockFeb 24, 2021MVP
RobOnyxPublishing - I have created a while ago a sample for the PnP PowerShell with scripts to set this up using App Only, Azure AD App, and Azure Automation -
https://github.com/pnp/powershell/tree/dev/samples/Connect.AzureAutomation
hope it helps.
- Beau CameronMay 14, 2019MVP
Russell Gove My apologies as I wasn't fully thinking in this regard. SPO Commandlets do not support app only credentials... I forget because I only use the PnP Commandlets (as they have more features than the SPO commandlet).
- RobOnyxPublishingFeb 17, 2021Copper Contributor
Beau Cameron How do you connect to PnP using the App ID and Secret. I have created the App and secret but I am stuck at that point... Your help would be hugely appreciated