Unable to Export-M365DSCConfiguration using the -AccessTokens parameter. about microsoft365dsc HOT 2 OPEN

Have to ask: does the -ManagedIdentity switch not work in this scenario?

from microsoft365dsc.

Thank you for the suggestion @mlhickey.

As far as I know, the -ManagedIdentity switch can be used on a self-hosted runner is the managed identity is assigned to the VM. This is a Microsoft hosted runner, where I have configured the service connection to use Workload Identity federation to use a managed identity for authentication.

I have tested this technique in two different pipelines. Both use an AzurePowerShell@5 task to connect to Azure in which I refer my ServiceConnection as input. The Managed identity has read permissions on my Azure subscription and can connect successfully to Azure.

In my first pipeline, I try Connect-MgGraph with the -Identity parameter and this gives the following error:

##[error]Failed to connect to Microsoft Graph: ManagedIdentityCredential authentication unavailable. The requested identity has not been assigned to this resource.

If I use the Connect-MgGraph with both the -Identity and -ClientId parameter with the Client ID of the managed identity, I get exactly the same error.

However in my second pipeline I use the -AccessToken technique for authentication and that works:

$accessToken = Get-AzAccessToken -ResourceType MSGraph -AsSecureString
Connect-MgGraph -AccessToken $accessToken.Token

After that, I can successfully query resources using graph cmdlets.

But trying to use the same technique with the -AccessTokens parameter for the Export-M365DSCConfiguration is failing with the above errors.

from microsoft365dsc.