Forum Discussion
Cert not found for Connect-MgGraph via Runbook Hybrid Worker
I know nothing about the Azure Hybrid Runbook Worker.
I've just had a quick read of the following article just to get an overview of it - which hardly makes me knowledgeable on the topic, but it does provide some useful information to even someone in my position. Notably that:
- If you're using the "User run as credentials" option, then your certificate will need to live either within the crypto store of that user's profile on the server running the runbook agent (if you wish to use the -CertificateThumbprint or -CertificateName parameters) or within the LocalMachine crypto store (if you use the -Certificate parameter) on that same server;
- The Windows Service name appears to be "Azure Hybrid Instance Metadata Service".
Reference article:
This topic isn't really about PowerShell but rather the hybrid runbook worker's configuration. You might want to ask about it in one of the Azure-centric forums as well.
Once the correct certificate is positioned in the correct store or you switch to using the third example from the earlier example where you load the certificate separately before using it in the Connect-MgGraph call (using the -Certificate parameter, not -CertificateThumbprint or Name), the error should be resolved.
Cheers,
Lain
Hi, Alex.
Have a read of the following and note the difference in accessing the certificate between the current user store versus the machine store:
As the article notes, you can't use a file location for the -CertificateName or -CertificateThumbprint options, only the crypto stores.
Additionally, if the running process is actually a service, make sure you:
- Load up a blank MMC;
- Add the Certificates snap-in;
- When adding it, choose the "Service account" option;
- Select the appropriate service;
- Add the certificate (.pfx, not .cer) to the Personal store.
That will allow the service to locate the certificate within its "currentuser" store. (Note: PowerShell can't access service crypto stores via the Cert:\ drive making the MMC your only option.)
It's actually less fiddley just to use the machine store and add the separate command for fetching the certificate first (in my opinion) for this service example, but this at least covers your options.
I suppose the other obvious point is to ensure that it is indeed the same certificate (i.e. the correct thumbprint), but I'm sure you've tripled-checked that already.
Cheers,
Lain
Thanks for the suggestions.
The article you are referring to says:
> To use a certificate stored in your machine's certificate store or another location when connecting to Microsoft Graph, specify the certificate's location.
I guess it's talking about "Service account" nevertheless?
Also, when selecting "Service account" there are the list of services is presented where you have to select the needed. However, no services with *powershell* keyword is available. Microsoft documentation just says: "Hybrid Runbook Worker jobs run under the local System account", but what Service account exactly used is unknown.
I know nothing about the Azure Hybrid Runbook Worker.
I've just had a quick read of the following article just to get an overview of it - which hardly makes me knowledgeable on the topic, but it does provide some useful information to even someone in my position. Notably that:
- If you're using the "User run as credentials" option, then your certificate will need to live either within the crypto store of that user's profile on the server running the runbook agent (if you wish to use the -CertificateThumbprint or -CertificateName parameters) or within the LocalMachine crypto store (if you use the -Certificate parameter) on that same server;
- The Windows Service name appears to be "Azure Hybrid Instance Metadata Service".
Reference article:
This topic isn't really about PowerShell but rather the hybrid runbook worker's configuration. You might want to ask about it in one of the Azure-centric forums as well.
Once the correct certificate is positioned in the correct store or you switch to using the third example from the earlier example where you load the certificate separately before using it in the Connect-MgGraph call (using the -Certificate parameter, not -CertificateThumbprint or Name), the error should be resolved.
Cheers,
Lain
It is worked, when I installed a certificate over "Azure Hybrid Instance Metadata Service" (Personal store). Now I'm getting another error, which I'm going to open another topic about.