fix: support multiple azure subscriptions

Author: JohnDuprey

Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1

@@ -1,6 +1,6 @@
 function Set-CippApiAuth {
     [CmdletBinding(SupportsShouldProcess)]
-    Param(
+    param(
         [string]$RGName,
         [string]$FunctionAppName,
         [string]$TenantId,
@@ -9,7 +9,9 @@ function Set-CippApiAuth {
 
     if ($env:MSI_SECRET) {
         Disable-AzContextAutosave -Scope Process | Out-Null
-        $Context = (Connect-AzAccount -Identity).Context
+        $null = Connect-AzAccount -Identity
+        $SubscriptionId = $ENV:WEBSITE_OWNER_NAME -split '+' | Select-Object -First 1
+        $Context = Set-AzContext -SubscriptionId $SubscriptionId
     } else {
         $Context = Get-AzContext
     }

Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecSAMSetup.ps1

@@ -51,7 +51,9 @@ Function Invoke-ExecSAMSetup {
     } else {
         if ($env:MSI_SECRET) {
             Disable-AzContextAutosave -Scope Process | Out-Null
-            $AzSession = Connect-AzAccount -Identity
+            $null = Connect-AzAccount -Identity
+            $SubscriptionId = $ENV:WEBSITE_OWNER_NAME -split '+' | Select-Object -First 1
+            $null = Set-AzContext -SubscriptionId $SubscriptionId
         }
     }
     if (!$ENV:SetFromProfile) {

Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-UpdateTokensTimer.ps1

@@ -25,7 +25,9 @@ function Start-UpdateTokensTimer {
             } else {
                 if ($env:MSI_SECRET) {
                     Disable-AzContextAutosave -Scope Process | Out-Null
-                    $AzSession = Connect-AzAccount -Identity
+                    $null = Connect-AzAccount -Identity
+                    $SubscriptionId = $ENV:WEBSITE_OWNER_NAME -split '+' | Select-Object -First 1
+                    $null = Set-AzContext -SubscriptionId $SubscriptionId
                 }
                 $KV = ($ENV:WEBSITE_DEPLOYMENT_ID -split '-')[0]
                 if ($Refreshtoken) {

Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1

@@ -20,6 +20,8 @@ function Get-CIPPAuthentication {
             }
         } else {
             Connect-AzAccount -Identity
+            $SubscriptionId = $ENV:WEBSITE_OWNER_NAME -split '+' | Select-Object -First 1
+            $null = Set-AzContext -SubscriptionId $SubscriptionId
             $keyvaultname = ($ENV:WEBSITE_DEPLOYMENT_ID -split '-')[0]
             $Variables | ForEach-Object {
                 Set-Item -Path ENV:$_ -Value (Get-AzKeyVaultSecret -VaultName $keyvaultname -Name $_ -AsPlainText -ErrorAction Stop) -Force

Modules/CIPPCore/Public/Test-CIPPAccessPermissions.ps1

@@ -34,7 +34,9 @@ function Test-CIPPAccessPermissions {
         if ($env:MSI_SECRET) {
             try {
                 Disable-AzContextAutosave -Scope Process | Out-Null
-                $AzSession = Connect-AzAccount -Identity
+                $null = Connect-AzAccount -Identity
+                $SubscriptionId = $ENV:WEBSITE_OWNER_NAME -split '+' | Select-Object -First 1
+                $null = Set-AzContext -SubscriptionId $SubscriptionId
 
                 $KV = $ENV:WEBSITE_DEPLOYMENT_ID
                 $KeyVaultRefresh = Get-AzKeyVaultSecret -VaultName $kv -Name 'RefreshToken' -AsPlainText

Modules/CippExtensions/Public/Extension Functions/Get-ExtensionAPIKey.ps1

@@ -22,6 +22,8 @@ function Get-ExtensionAPIKey {
         } else {
             $keyvaultname = ($ENV:WEBSITE_DEPLOYMENT_ID -split '-')[0]
             $null = Connect-AzAccount -Identity
+            $SubscriptionId = $ENV:WEBSITE_OWNER_NAME -split '+' | Select-Object -First 1
+            $null = Set-AzContext -SubscriptionId $SubscriptionId
             $APIKey = (Get-AzKeyVaultSecret -VaultName $keyvaultname -Name $Extension -AsPlainText)
         }
         Set-Item -Path "ENV:$Var" -Value $APIKey -Force -ErrorAction SilentlyContinue

Modules/CippExtensions/Public/Extension Functions/Set-ExtensionAPIKey.ps1

@@ -25,6 +25,8 @@ function Set-ExtensionAPIKey {
         } else {
             $keyvaultname = ($ENV:WEBSITE_DEPLOYMENT_ID -split '-')[0]
             $null = Connect-AzAccount -Identity
+            $SubscriptionId = $ENV:WEBSITE_OWNER_NAME -split '+' | Select-Object -First 1
+            $null = Set-AzContext -SubscriptionId $SubscriptionId
             $null = Set-AzKeyVaultSecret -VaultName $keyvaultname -Name $Extension -SecretValue (ConvertTo-SecureString -AsPlainText -Force -String $APIKey)
         }
         Set-Item -Path "ENV:$Var" -Value $APIKey -Force -ErrorAction SilentlyContinue

Modules/CippExtensions/Public/Gradient/Get-GradientToken.ps1

@@ -4,6 +4,8 @@ function Get-GradientToken {
     )
     if ($Configuration.vendorKey) {
         $null = Connect-AzAccount -Identity
+        $SubscriptionId = $ENV:WEBSITE_OWNER_NAME -split '+' | Select-Object -First 1
+        $null = Set-AzContext -SubscriptionId $SubscriptionId
         $keyvaultname = ($ENV:WEBSITE_DEPLOYMENT_ID -split '-')[0]
         $partnerApiKey = (Get-AzKeyVaultSecret -VaultName $keyvaultname -Name 'Gradient' -AsPlainText)
         $authorizationToken = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("$($configuration.vendorKey):$($partnerApiKey)"))

Modules/CippExtensions/Public/HIBP/Get-HIBPAuth.ps1

@@ -9,6 +9,9 @@ function Get-HIBPAuth {
             $Secret = (Get-CIPPAzDataTableEntity @DevSecretsTable -Filter "PartitionKey eq 'HIBP' and RowKey eq 'HIBP'").APIKey
         } else {
             $null = Connect-AzAccount -Identity
+            $SubscriptionId = $ENV:WEBSITE_OWNER_NAME -split '+' | Select-Object -First 1
+            $null = Set-AzContext -SubscriptionId $SubscriptionId
+
             $VaultName = ($ENV:WEBSITE_DEPLOYMENT_ID -split '-')[0]
             try {
                 $Secret = Get-AzKeyVaultSecret -VaultName $VaultName -Name 'HIBP' -AsPlainText -ErrorAction Stop