Skip to content

Commit 3290296

Browse files
ktoliverktoliver
authored
Merge pull request #69312 from tamram/tamram-0311
adding PS and CLI GA examples
2 parents ff2cd30 + 1197107 commit 3290296

File tree

1 file changed

+79
-48
lines changed

1 file changed

+79
-48
lines changed

‎articles/storage/common/storage-auth-aad-script.md

Lines changed: 79 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,98 +1,129 @@
11
---
2-
title: Run Azure CLI or PowerShell commands under an Azure AD identity to access Azure Storage (Preview) | Microsoft Docs
2+
title: Run Azure CLI or PowerShell commands under an Azure AD identity to access Azure Storage | Microsoft Docs
33
description: Azure CLI and PowerShell support logging in with an Azure AD identity to run commands on Azure Storage containers and queues and their data. An access token is provided for the session and used to authorize calling operations. Permissions depend on the role assigned to the Azure AD identity.
44
services: storage
55
author: tamram
66

77
ms.service: storage
88
ms.topic: article
9-
ms.date: 10/15/2018
9+
ms.date: 03/06/2019
1010
ms.author: tamram
1111
ms.subservice: common
1212
---
1313

14-
# Use an Azure AD identity to access Azure Storage with CLI or PowerShell (Preview)
14+
# Use an Azure AD identity to access Azure Storage with CLI or PowerShell
1515

16-
Azure Storage provides preview extensions for Azure CLI and PowerShell that enable you to log in and run scripting commands under an Azure Active Directory (Azure AD) identity. The Azure AD identity can be a user, group, or application service principal, or it can be a [managed identity for Azure resources](../../active-directory/managed-identities-azure-resources/overview.md). You can assign permissions to access storage resources to the Azure AD identity via role-based access control (RBAC). For more information about RBAC roles in Azure Storage, see [Manage access rights to Azure Storage data with RBAC (Preview)](storage-auth-aad-rbac.md).
16+
Azure Storage provides extensions for Azure CLI and PowerShell that enable you to log in and run scripting commands under an Azure Active Directory (Azure AD) identity. The Azure AD identity can be a user, group, or application service principal, or it can be a [managed identity for Azure resources](../../active-directory/managed-identities-azure-resources/overview.md). You can assign permissions to access storage resources to the Azure AD identity via role-based access control (RBAC). For more information about RBAC roles in Azure Storage, see [Manage access rights to Azure Storage data with RBAC (Preview)](storage-auth-aad-rbac.md).
1717

1818
When you log in to Azure CLI or PowerShell with an Azure AD identity, an access token is returned for accessing Azure Storage under that identity. That token is then automatically used by CLI or PowerShell to authorize operations against Azure Storage. For supported operations, you no longer need to pass an account key or SAS token with the command.
1919

20-
[!INCLUDE [storage-auth-aad-note-include](../../../includes/storage-auth-aad-note-include.md)]
21-
2220
## Supported operations
2321

24-
The preview extensions are supported for operations on containers and queues. Which operations you may call depends on the permissions granted to the Azure AD identity with which you log in to Azure CLI or PowerShell. Permissions to Azure Storage containers or queues are assigned via role-based access control (RBAC). For example, if a Data Reader role is assigned to the identity, then you can run scripting commands that read data from a container or queue. If a Data Contributor role is assigned to the identity, then you can run scripting commands that read, write, or delete a container or queue or the data they contain.
22+
The extensions are supported for operations on containers and queues. Which operations you may call depends on the permissions granted to the Azure AD identity with which you log in to Azure CLI or PowerShell. Permissions to Azure Storage containers or queues are assigned via role-based access control (RBAC). For example, if a Data Reader role is assigned to the identity, then you can run scripting commands that read data from a container or queue. If a Data Contributor role is assigned to the identity, then you can run scripting commands that read, write, or delete a container or queue or the data they contain.
2523

2624
For details about the permissions required for each Azure Storage operation on a container or queue, see [Permissions for calling REST operations](https://docs.microsoft.com/rest/api/storageservices/authenticate-with-azure-active-directory#permissions-for-calling-rest-operations).
2725

28-
## Call CLI commands with an Azure AD identity
26+
## Call CLI commands using Azure AD credentials
27+
28+
Azure CLI supports the `--auth-mode` parameter for data operations against Azure Storage:
29+
30+
- Set the `--auth-mode` parameter to `login` to sign in using an Azure AD security principal.
31+
- Set the `--auth-mode` parameter to the legacy `key` value to attempt to query for an account key if no authentication parameters for the account are provided.
32+
33+
The following example shows how to create a container in a new storage account from Azure CLI using your Azure AD credentials. Remember to replace placeholder values in angle brackets with your own values:
2934

30-
To install the preview extension for Azure CLI:
35+
1. Make sure that you have installed Azure CLI version 2.0.46 or later. Run `az --version` to check your installed version.
3136

32-
1. Make sure that you have installed Azure CLI version 2.0.32 or later. Run `az --version` to check your installed version.
33-
2. Run the following command to install the preview extension:
37+
1. Run `az login` and authenticate in the browser window:
3438

3539
```azurecli
36-
az extension add -n storage-preview
40+
az login
3741
```
42+
43+
1. Specify your desired subscription. Create a resource group using [az group create](https://docs.microsoft.com/cli/azure/group?view=azure-cli-latest#az-group-create). Create a storage account within that resource group using [az storage account create](https://docs.microsoft.com/cli/azure/storage/account?view=azure-cli-latest#az-storage-account-create):
3844
39-
The preview extension adds a new `--auth-mode` parameter to supported commands:
40-
41-
- Set the `--auth-mode` parameter to `login` to sign in using an Azure AD identity.
42-
- Set the `--auth-mode` parameter to the legacy `key` value to attempt to query for an account key if no authentication parameters for the account are provided.
45+
```azurecli
46+
az account set --subscription <subscription-id>
47+
48+
az group create \
49+
--name sample-resource-group-cli \
50+
--location eastus
51+
52+
az storage account create \
53+
--name <storage-account> \
54+
--resource-group sample-resource-group-cli \
55+
--location eastus \
56+
--sku Standard_LRS \
57+
--encryption-services blob
58+
```
59+
60+
1. Before you create the container, assign the [Storage Blob Data Contributor (preview)](../../role-based-access-control/built-in-roles.md#storage-blob-data-contributor-preview) role to yourself. Even though you are the account owner, you need explicit permissions to perform data operations against the storage account. For more information about assigning RBAC roles, see [Grant access to Azure containers and queues with RBAC in the Azure portal (preview)](storage-auth-aad-rbac.md).
4361
44-
For example, to download a blob in Azure CLI using an Azure AD identity, first run `az login`, then call the command with `--auth-mode` set to `login`:
62+
> [!IMPORTANT]
63+
> During the preview of Azure AD support for blobs and queues, RBAC role assignments may take up to 5 minutes to propagate.
64+
65+
1. Call the [az storage container create](https://docs.microsoft.com/cli/azure/storage/container?view=azure-cli-latest#az-storage-container-create) command with the `--auth-mode` parameter set to `login` to create the container using your Azure AD credentials:
4566
46-
```azurecli
47-
az login
48-
az storage blob download --account-name storagesamples --container sample-container --name myblob.txt --file myfile.txt --auth-mode login
49-
```
67+
```azurecli
68+
az storage container create \
69+
--account-name <storage-account> \
70+
--name sample-container \
71+
--auth-mode login
72+
```
5073
51-
The environment variable associated with the `--auth-mode` parameter is `AZURE_STORAGE_AUTH_MODE`.
74+
The environment variable associated with the `--auth-mode` parameter is `AZURE_STORAGE_AUTH_MODE`. You can specify the appropriate value in the environment variable to avoid including it on every call to an Azure Storage data operation.
5275
53-
## Call PowerShell commands with an Azure AD identity
76+
## Call PowerShell commands using Azure AD credentials
5477
5578
[!INCLUDE [updated-for-az](../../../includes/updated-for-az.md)]
5679
57-
To use Azure PowerShell to sign in with an Azure AD identity:
80+
To use Azure PowerShell to sign in and run subsequent operations against Azure Storage using Azure AD credentials, create a storage context to reference the storage account, and including the `-UseConnectedAccount` parameter.
5881
59-
1. Uninstall any previous installations of Azure PowerShell:
82+
The following example shows how to create a container in a new storage account from Azure PowerShell using your Azure AD credentials. Remember to replace placeholder values in angle brackets with your own values:
6083
61-
- Remove any previous installations of Azure PowerShell from Windows using the **Apps & features** setting under **Settings**.
62-
- Remove all **Azure*** modules from `%Program Files%\WindowsPowerShell\Modules`.
84+
1. Sign in to your Azure subscription with the `Connect-AzAccount` command and follow the on-screen directions to enter your Azure AD credentials:
6385
64-
1. Make sure that you have the latest version of PowerShellGet installed. Open a Windows PowerShell window, and run the following command to install the latest version:
65-
6686
```powershell
67-
Install-Module PowerShellGet –Repository PSGallery –Force
87+
Connect-AzAccount
6888
```
69-
1. Close and reopen the PowerShell window after installing PowerShellGet.
89+
90+
1. Create an Azure resource group by calling [New-AzResourceGroup](/powershell/module/az.resources/new-azresourcegroup).
7091
71-
1. Install the latest version of Azure PowerShell:
92+
```powershell
93+
$resourceGroup = "sample-resource-group-ps"
94+
$location = "eastus"
95+
New-AzResourceGroup -Name $resourceGroup -Location $location
96+
```
97+
98+
1. Create a storage account by calling [New-AzStorageAccount](/powershell/module/az.storage/new-azstorageaccount).
99+
100+
```powershell
101+
$storageAccount = New-AzStorageAccount -ResourceGroupName $resourceGroup `
102+
-Name "<storage-account>" `
103+
-SkuName Standard_LRS `
104+
-Location $location `
105+
```
106+
107+
1. Get the storage account context that specifies the new storage account by calling [New-AzStorageContext](/powershell/module/az.storage/new-azstoragecontext). When acting on a storage account, you can reference the context instead of repeatedly passing in the credentials. Include the `-UseConnectedAccount` parameter to call any subsequent data operations using your Azure AD credentials:
72108
73109
```powershell
74-
Install-Module Az –Repository PSGallery –AllowClobber
110+
$ctx = New-AzStorageContext -StorageAccountName "<storage-account>" -UseConnectedAccount
75111
```
76112
77-
1. Install an Azure Storage preview module that supports Azure AD:
78-
79-
```powershell
80-
Install-Module Az.Storage -Repository PSGallery -AllowPrerelease -AllowClobber -Force
81-
```
82-
1. Close and reopen the PowerShell window.
83-
1. Call the [New-AzStorageContext](https://docs.microsoft.com/powershell/module/az.storage/new-azstoragecontext) cmdlet to create a context, and include the `-UseConnectedAccount` parameter.
84-
1. To call a cmdlet with an Azure AD identity, pass the newly created context to the cmdlet.
113+
1. Before you create the container, assign the [Storage Blob Data Contributor (preview)](../../role-based-access-control/built-in-roles.md#storage-blob-data-contributor-preview) role to yourself. Even though you are the account owner, you need explicit permissions to perform data operations against the storage account. For more information about assigning RBAC roles, see [Grant access to Azure containers and queues with RBAC in the Azure portal (preview)](storage-auth-aad-rbac.md).
114+
115+
> [!IMPORTANT]
116+
> During the preview of Azure AD support for blobs and queues, RBAC role assignments may take up to 5 minutes to propagate.
85117
86-
The following example shows how to list the blobs in a container from Azure PowerShell using an Azure AD identity. Be sure to replace the placeholder account and container names with your own values:
118+
1. Create a container by calling [New-AzStorageContainer](/powershell/module/az.storage/new-azstoragecontainer). Because this call uses the context created in the previous steps, the container is created using your Azure AD credentials.
87119
88-
```powershell
89-
$ctx = New-AzStorageContext -StorageAccountName storagesamples -UseConnectedAccount
90-
Get-AzStorageBlob -Container sample-container -Context $ctx
91-
```
120+
```powershell
121+
$containerName = "sample-container"
122+
New-AzStorageContainer -Name $containerName -Context $ctx
123+
```
92124
93125
## Next steps
94126
95127
- To learn more about RBAC roles for Azure storage, see [Manage access rights to storage data with RBAC (Preview)](storage-auth-aad-rbac.md).
96128
- To learn about using managed identities for Azure resources with Azure Storage, see [Authenticate access to blobs and queues with Azure managed identities for Azure Resources (Preview)](storage-auth-aad-msi.md).
97-
- To learn how to authorize access to containers and queues from within your storage applications, see [Use Azure AD with storage applications](storage-auth-aad-app.md).
98-
- For additional information about Azure AD integration for Azure Blobs and Queues, see the Azure Storage team blog post, [Announcing the Preview of Azure AD Authentication for Azure Storage](https://azure.microsoft.com/blog/announcing-the-preview-of-aad-authentication-for-storage/).
129+
- To learn how to authorize access to containers and queues from within your storage applications, see [Use Azure AD with storage applications](storage-auth-aad-app.md).

0 commit comments

Comments
 (0)