Azure DevOps Get Current User ObjectId

user_2546291 0
Viewed 2475

Is there a way to get the ObjectId of the Service Principal that is currently executing an Azure PowerShell task in Azure DevOps at all?

I am creating a resource, and then want to apply permissions for the 'current' user.. but can't work out how to get the current user ObjectId / ApplicationId

Is this possible?

azure-devops powershell
2 Answers

Ok - based of the above, I've made a little function - it may work for a lot of cases:


function Get-CurrentUserObjectID {
    $ctx = Get-AzContext

    #This is different for users that are internal vs external
    #We can use Mail for users and guests
    $User = Get-AzADUser -Mail $ctx.Account.id
    if (-not $user) {  #Try UPN
        $User = Get-AzADUser -UserPrincipalName $ctx.Account.Id
    }
    if (-not $User) { #User was not found by mail or UPN, try MailNick
        $mail = ($ctx.Account.id -replace "@","_" ) + "#EXT#"
        $User = Get-AzADUser | Where-Object { $_MailNick -EQ $Mail}
    }

    Return $User.id
}
Christopher_G_Lewis_135320

There seems to be two ways of doing this depending on if it's a user, or a service principal:-

Get-AzADUser
Get-AzADServicePrincipal

These i believe are in the Az.Resources module. So, to give you the ObjectId (for permissions), you could take a two step approach like this:

$x = (Get-AzContext).Account.Id
$x
> df6fc4f6-cb05-4301-91e3-11d93d7fd43d # ApplicationId

$y = Get-AzADServicePrincipal -ApplicationId $x
$y.Id
> c3588e6a-b48b-4111-8241-3d6bd726ca40 # ObjectId

I can't get anything to work reliably with standard users though.. if your user is created in the AzureAD directly, and not external (i.e. gmail.com, outlook.com, etc) this should work:

$x = (Get-AzContext).Account.Id
$x
> sample@your-domain.onmicrosoft.com # UserPrincipalName

$y = Get-AzADUser -UserPrincipalName $x
$y.Id
> c5d4339b-48dc-4190-b9fb-f5397053844b # ObjectId

If your user is external, and has the weird your.email.address_outlook.com#EXT#@your-domain.onmicrosoft.com as the UserPrincipalName you'll need to solve that with a bit of string manipulation i think .

But! You shouldn't be scripting things with user accounts anyway, so it probably doesn't matter .

Note: I have not tried this in Azure DevOps, you will probs need to upgrade the PowerShell packages, but i think the same commands should exist as Get-AzureRmADUser, and Get-AzureRmADServicePrincipal. Please let me know.

user_25462910
Related