Managed identities provide a secure way in which applications can access resources in Azure without the need for administrators to manage additional passwords or secrets. This means that authentication can happen smoothly without the need for eventual intervention by a human.
Fortunately for those who code in PowerShell for the administration of their tenant or reporting of their tenant, Microsoft Graph PowerShell v2 supports the use of Managed Identities with Azure Automation.
In this tutorial, I am going to show you how you can create and assign permissions to a Managed Identity in Azure and then use that Managed Identity in your Microsoft Graph PowerShell scripts.
Page Contents
- What are Managed Identities?
- System-assigned vs User-assigned Managed Identities
- How to create a user assigned Managed Identity
- Assign Graph API permissions to Managed Identities
- Use a System-assigned managed identity with your Azure Automation Account
- Use a User-assigned managed identity with your Azure Automation Account
- How to use Connect-MgGraph -Identity with Microsoft Graph PowerShell
What are Managed Identities?
Managed Identities are resources in Azure that can automatically request and receive Azure AD access tokens to authenticate resources. For programmatic/automatic scenarios, this eliminates the need for tenant administrators to manage passwords, keys or secrets as authentication is completely managed by Azure and inside Azure only, making it simple and more secure.
In practical terms, Managed Identities are Service Principals (or applications) in Azure AD, to which you can assign specific permissions or roles to complete the tasks they are created to perform.
You can view Managed Identities in Azure Active Directory by selecting:
Applications > All applications, then change the application type filter to Managed Identities.
System-assigned vs User-assigned Managed Identities
There are two types of Managed Identities in Azure that enable you to get an Azure AD token for access to resources. These are System-assigned and User-assigned Managed Identities.
Although they both serve the same purpose, they work a little differently. System-assigned Managed Identities are tied to a specific resource and only provide specific access to that for that resource, whereas User-assigned Managed Identities are independent and can be assigned to single or multiple different resources.
Choosing between using each type of Managed Identity depends on both the scenario where is it being deployed and how you manage your infrastructure.
System-assigned Managed Identities may generally mean more administration if you are needing to apply Graph API permissions to multiple identities, which could be simplified with a single User-assigned managed identity if the permission requirements are the same. Furthermore, if you assign roles instead of Graph API permissions, each System-assigned Managed Identity could also be added to a Security Group with the role assigned, thus reducing administration.
The lifecycle of a System-assigned Managed Identity is also tied to the resource, so it is created when the resource is created and deleted when the resource is deleted. While in some cases this may help maintain security and keep your environment tidy, it may become troublesome while creating multiple resources, especially if permissions need to be managed or approved by a different department.
The below diagram shows the permission assignment flow while using System-assigned or User-assigned Managed Identities. Generally speaking, if you have a single job with a specific permission that needs to run, a System-assigned Manage Identity would be the better option, any other scenario requires additional thought.
How to create a User-assigned Managed Identity
As User-assigned managed identities are independent of the resources they service, they must first be created manually either using the Azure Portal or PowerShell and then the required permissions must be assigned. Follow the steps below you create and configure a User-assigned Managed Identity.
Using the Azure Portal
2. Seach for Managed Identities and open the service
3. Click Create to start the Managed Identity creation wizard
4. Complete the information areas on the screen then click Review & Create > Create
Using PowerShell
While I like to do everything with Microsoft Graph, Managed Identities are Azure Resources and cannot be created directly in Azure AD, which is what Microsoft Graph enables you to manage. To create a Managed Identity with PowerShell, you must use the Azure (Az) PowerShell module as follows:
1. Install the Az PowerShell module.
Install-Module Az -Scope CurrentUser -AllowPrerelease -Force2. Connect to Azure using Connect-AzAccount.
Connect-AzAccount3. Before you create a managed identity, you must first create a resource group which will contain it.
New-AzResourceGroup -Name RG-UKSAA-MgPowerShell -Location "UK South"4. Now create a new Managed Identity and define the name of your new resource group.
New-AzUserAssignedIdentity -ResourceGroupName RG-UKSAA-MgPowerShell -Name MI-AA-MgPowerShell1 -location UKSouthAssign Graph API permissions to Managed Identities
To give the necessary (and least amount) of privilege for our managed identity to perform the tasks set out in our final script, we need to assign Graph API permissions through PowerShell.
Unfortunately, Graph API permissions are not yet supported to be assigned to Managed Identities via the Microsoft Entra portal, so I will show you how to do it with Microsoft Graph PowerShell.
The following script will connect to Microsoft Graph and assign the defined permissions to your Managed Identity. Make sure you modify the variables as advised in the script below.
# Connect to Microsoft Graph with least required permission scope
Connect-MgGraph -Scopes Application.Read.All, AppRoleAssignment.ReadWrite.All
### Define these variables here first ##
$ManagedIdentityName = "OCN-AA-MgPowerShell"
$permissions = "Mail.send", "AuditLog.Read.All", "Application.Read.All"
# Get service principal and roles
$getPerms = (Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'").approles | Where {$_.Value -in $permissions}
$ManagedIdentity = (Get-MgServicePrincipal -Filter "DisplayName eq '$ManagedIdentityName'")
$GraphID = (Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'").id
# Assign roles
foreach ($perm in $getPerms){
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $ManagedIdentity.Id `
-PrincipalId $ManagedIdentity.Id -ResourceId $GraphID -AppRoleId $perm.id
}Once your permissions are assigned, the Permissions tab for your Managed Identity in the Microsoft Entra portal will look like the following:
Use a system-assigned managed identity with Azure Automation Account
System-assigned managed identities can be created directly from the Azure Automation Account or the resource that they apply to. Follow the below steps to create the Managed Identity.
1. Start by opening your Automation Account and then select Identity from the account settings area.
2. Set the System assigned Managed Identity to On then click Save.
3. You will now see the Managed Identity listed in the applications list as seen at the top of this tutorial.
Use a User-assigned managed identity with Azure Automation Account
User-assigned Managed Identities must be assigned manually to the resource they will be authenticating. Follow the below steps to assign the Managed Identity to your Automation Account.
2. Select the User assigned tab, then click Add.
3. Select your subscription and Managed Identity from the list and click Add.
How to use Connect-MgGraph -Identity with Microsoft Graph PowerShell
Now you have an Automation Account with a Managed Identity assigned uncluding the correct permissions, you must include the -Identity parameter in your Microsoft Graph authentication commands to use it.
Use Connect-MgGraph with a System-assigned Managed Identity
Simply define the -Identity parameter alone while connecting with a System-assigned Managed Identity, no further authentication commands are required.
Connect-MgGraph -IdentityUse Connect-MgGraph with a User-assigned Managed Identity
To use a User-assigned Managed Identity, both the -Identity and -ClientId parameters need to be defined. You must also include the object ID of the User-assigned Managed Identity (service principal) so the authentication command knows which Managed Identity to use.
Connect-MgGraph -Identity -ClientId %Object ID of Managed Identity%
Nice post, thanks
In your case (system-managed identity using Connect-MgGraph -Identity), is the scopes properly set when you run (Get-MgContext).Scopes?
In my case, the scopes is blank even though I have added the permission/role properly to the managed identity (as shown in the Azure Portal also)
Are you using the command as defined in the post? Connect-MgGraph -Identity -ClientID *ID*
Very Clear and usefull post. Thanks Daniel!!!
Is it possible to create managed-identity with delegated permissions? I need to access the excel file with Graph workbook api, but endpoints for workbook do not support application permissions.
I do not believe they support delegated permissions. You may be able to use a normal app registration instead, although this would be less secure of course.