Pragmatic approaches to MFA or alternatives? about microsoft365dsc HOT 5 OPEN

M365DSC supports authentication with a service principal. This is the most versatile option in automation scenarios. Please make sure to secure your secrets and environments properly ( e.g. comparable to a domain controller).

1. LCM needs access to the certificate as soon as operations are triggered: verification of a configuration.

2. The whitepaper got published in November 22. By now, there were plenty updates in M365DSC. The support for SP improved a lot and there are only a few resources left that do not fully support SPs.

3. In such a multi tenant scenario with a multi tenant application would be the easiest option and needs to be verified if it will work across all services.

from microsoft365dsc.

In our case we use service principals secured by a certificate. We store the certificate in a Key Vault. The creation of the app and related infrastructure for the certificates is managed through Terraform. The other reason we use this approach is we can be granular with the perms we request (i.e, we don't use global admin but use the relevant API permissions).

from microsoft365dsc.

@GeldHades27355 We are doing it pretty much the same way as @adhodgson1, but with Bicep instead of Terraform. For more granular authentication, we have different service principals for different workloads, so that one compromised service principal is not able to compromise the entire company (although it could still do a lot of damage).

from microsoft365dsc.

Thanks for sharing.

In our case different service principals would easily escalate to hundreds of not thousands with a few hundred clients. And certificates... But yeah, makes sense.

So what do bicep and terraform add that wouldn't already work using vanilla M365DSC and Azure DevOps?

from microsoft365dsc.

@GeldHades27355 Terraform and Bicep are tools to manage the state of your infrastructure, in my case that's the management of the service principals, certificates, Key Vault, Automation Account and more. Azure DevOps is the "pipeline" mechanism that executes the infrastructure management (in my company, we're using GitLab) and more.

The usage of infrastructure management tools like Terraform and / or Bicep is only necessary if you want a "configuration-as-code" approach, where you define in code how your environment is supposed to look like and the tools then apply that configuration. You're totally fine with running Azure DevOps with vanilla M365DSC. Don't sweat too much about it.

from microsoft365dsc.