Description
Description
Hi team,
Cx has encountered the issue when fetching secret in KV using compliant device.
Background information:
The organization has a CA policy which only allows complaint device access
The Powershell version is 7. As documented, when PS version is 7, device authentication is set as default authentication type.
Then following issue happens:
Run the command Connect-azaccount, this trigger device authentication.
Then cx has been re-directed to device authentication page, pasted the code and then being requested for user credential sign in.
Cx account has successfully signed in to the Powershell session then.
Then we use this command Set-AzContext Pulsars(subscription name) to locate the subscription ID where the Key Vault is stored and it works fine.
However when we try to fetch the Key Vault Secret using the command Get-AzKeyVaultSecret, it seems that the sign-in session does not pass the device status information and getting blocked by CA policy: ‘Security - Non-compliant InTune Devices’
The fact is cx's device is compliant already. We have engaged AAD Auth colleague and they have explained that
when we run the “Connect-azaccount” and trigger device authentication, you need to open a browser outside of PowerShell to finish the device code auth. The whole authentication progress will be accomplished in the browser scope, which will make the PowerShell cannot get the device info. And when you run the command “Get-AzKeyVaultSecret”, PowerShell cannot pop up a browser window to utilize the PRT to get device info. That’s why you will meet the error.
This seems to be a design behavior for device authentication, but as indicated PS 7 will use device auth as default authentication type, more and more customer may encounter the issue in the future.
We have consulted our Key Vault product group, they have advised that since AKV dev team doesn't really own the PowerShell modules, especially the auth infrastructure and The error interaction_required looks like PSH is refusing to show a pop-up window for collecting credentials. Indeed best to involve Azure Powershell team.
Thank you in advance and please let me know if anything else needed from my side.
Steps to reproduce
Environment data
Module versions
Debug output
Error output