Azure / Azure/azure-powershell
[Feature]: Provide a way to get object id of authenticated service principal
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description of the new feature
Would be great if `Az.Accounts` could provide a way to get the object id of the authenticated service principal, like managed identity.
One use case is to `Get-AzRoleAssignment -ObjectId '' -Scope ''` to check if authenticated principal has sufficient permissions for whatever the script is about to perform. Rather than trying to perform said action and fail because of missing permissions.
If you authenticate with an Azure AD user, getting its' object id is as easy as:
```powershell
(Get-AzContext).'Account'.'ExtendedProperties'.'HomeAccountId'.Split('.')[0]
```
For managed identity I haven't found an easier way than decoding the JWT token you get from `Get-AzAccessToken`. But `Az.Accounts` has no cmdlet for decoding JWT. And using a different module (like [JWTDetails](https://www.powershellgallery.com/packages/JWTDetails)) or implemeting a JWT decoding function in every script seems unneccessary.
With mentioned module I managed to get ObjectId of the managed identity used in an Automation Account like so:
```powershell
Import-Module -Name 'Az.Accounts','JWTDetails'
Clear-AzContext -Force
$null = Connect-AzAccount -Identity -WarningAction 'SilentlyContinue'
(Get-JWTDetails -Token (Get-AzAccessToken -ResourceTypeName 'Arm').'Token').'oid'
Clear-AzContext -Force
```
Conclusion: The information already exists. But `Az.Accounts` does not expose it in an easy way.
### Proposed implementation details (optional)
Output object id of the principal (user, service principal) when `Get-AzContext`?
Output more properties from the JWT, like "oid", when `Get-AzAccessToken`?
Provide a `Az.Accounts` cmdlet to decode JWT tokens?
Contributor guide
Assessment
This issue has not been assessed yet.