| external help file | Module Name | online version | schema | content_git_url | original_content_git_url |
|---|---|---|---|---|---|
Microsoft.Azure.PowerShell.Cmdlets.Accounts.dll-Help.xml |
Az.Accounts |
2.0.0 |
Connect to Azure with an authenticated account for use with cmdlets from the Az PowerShell modules.
Connect-AzAccount [-Environment <String>] [-Tenant <String>] [-AccountId <String>] [-Subscription <String>]
[-AuthScope <String>] [-ContextName <String>] [-SkipContextPopulation] [-MaxContextPopulation <Int32>]
[-UseDeviceAuthentication] [-Force] [-Scope <ContextModificationScope>]
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
Connect-AzAccount [-Environment <String>] -Credential <PSCredential> [-ServicePrincipal] -Tenant <String>
[-Subscription <String>] [-AuthScope <String>] [-ContextName <String>] [-SkipContextPopulation]
[-MaxContextPopulation <Int32>] [-Force] [-Scope <ContextModificationScope>]
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
Connect-AzAccount [-Environment <String>] -Credential <PSCredential> [-Tenant <String>]
[-Subscription <String>] [-AuthScope <String>] [-ContextName <String>] [-SkipContextPopulation]
[-MaxContextPopulation <Int32>] [-Force] [-Scope <ContextModificationScope>]
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
Connect-AzAccount [-Environment <String>] -CertificateThumbprint <String> -ApplicationId <String>
[-ServicePrincipal] -Tenant <String> [-Subscription <String>] [-AuthScope <String>] [-ContextName <String>]
[-SkipContextPopulation] [-MaxContextPopulation <Int32>] [-Force] [-SendCertificateChain]
[-Scope <ContextModificationScope>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
[<CommonParameters>]
Connect-AzAccount [-Environment <String>] -ApplicationId <String> [-ServicePrincipal] -Tenant <String>
[-Subscription <String>] [-ContextName <String>] [-SkipContextPopulation] [-MaxContextPopulation <Int32>]
[-Force] -FederatedToken <String> [-Scope <ContextModificationScope>]
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
Connect-AzAccount [-Environment <String>] -ApplicationId <String> [-ServicePrincipal] -Tenant <String>
[-Subscription <String>] [-ContextName <String>] [-SkipContextPopulation] [-MaxContextPopulation <Int32>]
[-Force] [-SendCertificateChain] -CertificatePath <String> [-CertificatePassword <SecureString>]
[-Scope <ContextModificationScope>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
[<CommonParameters>]
Connect-AzAccount [-Environment <String>] [-Tenant <String>] -AccessToken <String> [-GraphAccessToken <String>]
[-MicrosoftGraphAccessToken <String>] [-KeyVaultAccessToken <String>] -AccountId <String>
[-Subscription <String>] [-ContextName <String>] [-SkipValidation] [-SkipContextPopulation]
[-MaxContextPopulation <Int32>] [-Force] [-Scope <ContextModificationScope>]
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
Connect-AzAccount [-Environment <String>] [-Tenant <String>] [-AccountId <String>] [-Identity]
[-Subscription <String>] [-AuthScope <String>] [-ContextName <String>] [-SkipContextPopulation]
[-MaxContextPopulation <Int32>] [-Force] [-Scope <ContextModificationScope>]
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
The Connect-AzAccount cmdlet connects to Azure with an authenticated account for use with cmdlets
from the Az PowerShell modules. You can use this authenticated account only with Azure Resource
Manager requests. To add an authenticated account for use with Service Management, use the
Add-AzureAccount cmdlet from the Azure PowerShell module. If no context is found for the current
user, the user's context list is populated with a context for each of their first 25 subscriptions.
The list of contexts created for the user can be found by running Get-AzContext -ListAvailable. To
skip this context population, specify the SkipContextPopulation switch parameter. After
executing this cmdlet, you can disconnect from an Azure account using Disconnect-AzAccount.
This example connects to an Azure account. You must provide a Microsoft account or organizational ID credentials. If multi-factor authentication is enabled for your credentials, you must log in using the interactive option or use service principal authentication.
Connect-AzAccountPlease select the account you want to login with.
Retrieving subscriptions for the selection...
[Tenant and subscription selection]
No Subscription name Subscription ID Tenant domain name
---- ------------------------------------ ---------------------------------------- --------------------------
[1] Subscription1 xxxx-xxxx-xxxx-xxxx xxxxxxxxx.xxxxxxxxxxx.com
[2] Subscription2 xxxx-xxxx-xxxx-xxxx xxxxxxxxx.xxxxxxxxxxx.com
...
[9] Subscription9 xxxx-xxxx-xxxx-xxxx xxxxxxxxx.xxxxxxxxxxx.com
Select a tenant and subscription: 1 <requires user's input here>
Subscription name Tenant domain name
------------------------------------ --------------------------
Subscription1 xxxxxxxxx.xxxxxxxxxxx.com
[Announcements]
Share your feedback regarding your experience with `Connect-AzAccount` at: https://aka.ms/azloginfeedback
If you encounter any problem, please open an issue at: https://aka.ms/azpsissue
SubscriptionName Tenant
----------------- ------
Subscription1 xxxxxxxxx.xxxxxxxxxxx.com
This scenario works only when the user does not have multi-factor auth turned on. The first command
prompts for user credentials and stores them in the $Credential variable. The second command
connects to an Azure account using the credentials stored in $Credential. This account
authenticates with Azure using organizational ID credentials.
$Credential = Get-Credential
Connect-AzAccount -Credential $CredentialAccount SubscriptionName TenantId Environment
------- ---------------- -------- -----------
azureuser@contoso.com Subscription1 xxxx-xxxx-xxxx-xxxx AzureCloud
This command stores the service principal credentials in the $Credential variable. Then, it
connects to the specified Azure tenant using the service principal credentials stored in the
$Credential variable. The ServicePrincipal switch parameter indicates that the account
authenticates as a service principal.
$SecurePassword = Read-Host -Prompt 'Enter a Password' -AsSecureString
$TenantId = 'yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyy'
$ApplicationId = 'zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz'
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $ApplicationId, $SecurePassword
Connect-AzAccount -ServicePrincipal -TenantId $TenantId -Credential $CredentialAccount SubscriptionName TenantId Environment
------- ---------------- -------- -----------
xxxx-xxxx-xxxx-xxxx Subscription1 xxxx-xxxx-xxxx-xxxx AzureCloud
This example connects to an Azure account with the specified tenant and subscription.
Connect-AzAccount -Tenant 'xxxx-xxxx-xxxx-xxxx' -SubscriptionId 'yyyy-yyyy-yyyy-yyyy'Account SubscriptionName TenantId Environment
------- ---------------- -------- -----------
azureuser@contoso.com Subscription1 xxxx-xxxx-xxxx-xxxx AzureCloud
This example connects using a system-assigned Managed Service Identity (MSI) of the host environment. For example, you #to Azure from a virtual machine that has an assigned MSI.
Connect-AzAccount -Identity
Set-AzContext -Subscription Subscription1Account SubscriptionName TenantId Environment
------- ---------------- -------- -----------
MSI@50342 Subscription1 xxxx-xxxx-xxxx-xxxx AzureCloud
This example connects using the Managed Service Identity of myUserAssignedIdentity. It adds the user assigned identity to the virtual machine, then connects using the ClientId of the user assigned identity. For more information, see Configure managed identities for Azure resources on an Azure VM.
$identity = Get-AzUserAssignedIdentity -ResourceGroupName 'myResourceGroup' -Name 'myUserAssignedIdentity'
Get-AzVM -ResourceGroupName contoso -Name testvm | Update-AzVM -IdentityType UserAssigned -IdentityId $identity.Id
Connect-AzAccount -Identity -AccountId $identity.ClientId # Run on the virtual machineAccount SubscriptionName TenantId Environment
------- ---------------- -------- -----------
yyyy-yyyy-yyyy-yyyy Subscription1 xxxx-xxxx-xxxx-xxxx AzureCloud
This example connects to an Azure account using certificate-based service principal authentication. The service principal used for authentication must be created with the specified certificate. For more information on creating a self-signed certificates and assigning them permissions, see Use Azure PowerShell to create a service principal with a certificate
$Thumbprint = 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
$TenantId = 'yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyy'
$ApplicationId = '00000000-0000-0000-0000-00000000'
Connect-AzAccount -CertificateThumbprint $Thumbprint -ApplicationId $ApplicationId -Tenant $TenantId -ServicePrincipalAccount SubscriptionName TenantId Environment
------- ---------------- -------- -----------
xxxxxxxx-xxxx-xxxx-xxxxxxxxx Subscription1 yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyy AzureCloud
Account : xxxxxxxx-xxxx-xxxx-xxxxxxxx
SubscriptionName : MyTestSubscription
SubscriptionId : zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz
TenantId : yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyy
Environment : AzureCloud
AuthScope is used to support scenario that data plane resources have enhanced authentication than ARM resources, e.g. storage needs MFA but ARM does not.
Once AuthScope is specified, e.g. Storage, Connect-AzAccount will first login with storage scope https://storage.azure.com/, then silently require token for ARM.
Connect-AzAccount -AuthScope StorageAccount SubscriptionName TenantId Environment
------- ---------------- -------- -----------
yyyy-yyyy-yyyy-yyyy Subscription1 xxxx-xxxx-xxxx-xxxx AzureCloud
This example connects to an Azure account using certificate-based service principal authentication.
The certificate file, which is specified by CertficatePath, should contains both certificate and private key as the input.
$SecurePassword = ConvertTo-SecureString -String "****" -AsPlainText -Force
$TenantId = 'yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyy'
$ApplicationId = 'zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzz'
Connect-AzAccount -ServicePrincipal -ApplicationId $ApplicationId -TenantId $TenantId -CertificatePath './certificatefortest.pfx' -CertificatePassword $SecurePasswordAccount SubscriptionName TenantId Environment
------- ---------------- -------- -----------
xxxxxxxx-xxxx-xxxx-xxxxxxxx Subscription1 yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyy AzureCloud
This example demonstrates how to enable the config for WAM (Web Account Manager) and use it to connect to Azure.
Update-AzConfig -EnableLoginByWam $true
Connect-AzAccountAccount SubscriptionName TenantId Environment
------- ---------------- -------- -----------
xxxxxxxx-xxxx-xxxx-xxxxxxxx Subscription1 yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyy AzureCloud
Specifies an access token.
Caution
Access tokens are a type of credential. You should take the appropriate security precautions to keep them confidential. Access tokens also timeout and may prevent long running tasks from completing.
Type: System.String
Parameter Sets: AccessTokenWithSubscriptionId
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseId for Account, associated with your access token. In User authentication flows, the AccountId is user name / user id; In AccessToken flow, it is the AccountId for the access token; In ManagedService flow, it is the associated client Id of UserAssigned identity. To use the SystemAssigned identity, leave this field blank.
Type: System.String
Parameter Sets: UserWithSubscriptionId, ManagedServiceLogin
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseType: System.String
Parameter Sets: AccessTokenWithSubscriptionId
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseApplication ID of the service principal.
Type: System.String
Parameter Sets: ServicePrincipalCertificateWithSubscriptionId, ClientAssertionParameterSet, ServicePrincipalCertificateFileWithSubscriptionId
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseOptional OAuth scope for login, supported pre-defined values: AadGraph, AnalysisServices, Attestation, Batch, DataLake, KeyVault, OperationalInsights, Storage, Synapse. It also supports resource id like https://storage.azure.com/.
Type: System.String
Parameter Sets: UserWithSubscriptionId, ServicePrincipalWithSubscriptionId, UserWithCredential, ServicePrincipalCertificateWithSubscriptionId, ManagedServiceLogin
Aliases: AuthScopeTypeName
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseThe password required to access the pkcs#12 certificate file.
Type: System.Security.SecureString
Parameter Sets: ServicePrincipalCertificateFileWithSubscriptionId
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseThe path of certficate file in pkcs#12 format.
Type: System.String
Parameter Sets: ServicePrincipalCertificateFileWithSubscriptionId
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseCertificate Hash or Thumbprint.
Type: System.String
Parameter Sets: ServicePrincipalCertificateWithSubscriptionId
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseName of the default Azure context for this login. For more information about Azure contexts, see Azure PowerShell context objects.
Type: System.String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseSpecifies a PSCredential object. For more information about the PSCredential object, type
Get-Help Get-Credential. The PSCredential object provides the user ID and password for
organizational ID credentials, or the application ID and secret for service principal credentials.
Type: System.Management.Automation.PSCredential
Parameter Sets: ServicePrincipalWithSubscriptionId, UserWithCredential
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseThe credentials, account, tenant, and subscription used for communication with Azure.
Type: Microsoft.Azure.Commands.Common.Authentication.Abstractions.Core.IAzureContextContainer
Parameter Sets: (All)
Aliases: AzContext, AzureRmContext, AzureCredential
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseEnvironment containing the Azure account.
Type: System.String
Parameter Sets: (All)
Aliases: EnvironmentName
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseSpecifies a token provided by another identity provider. The issuer and subject in this token must be first configured to be trusted by the ApplicationId.
Caution
Federated tokens are a type of credential. You should take the appropriate security precautions to keep them confidential. Federated tokens also timeout and may prevent long running tasks from completing.
Type: System.String
Parameter Sets: ClientAssertionParameterSet
Aliases: ClientAssertion
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseOverwrite the existing context with the same name without prompting.
Type: System.Management.Automation.SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseAccessToken for Graph Service.
Type: System.String
Parameter Sets: AccessTokenWithSubscriptionId
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseLogin using a Managed Service Identity.
Type: System.Management.Automation.SwitchParameter
Parameter Sets: ManagedServiceLogin
Aliases: MSI, ManagedService
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseAccessToken for KeyVault Service.
Type: System.String
Parameter Sets: AccessTokenWithSubscriptionId
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseMax subscription number to populate contexts after login. Default is 25. To populate all subscriptions to contexts, set to -1.
Type: System.Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseAccess token to Microsoft Graph
Type: System.String
Parameter Sets: AccessTokenWithSubscriptionId
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseDetermines the scope of context changes, for example, whether changes apply only to the current process, or to all sessions started by this user.
Type: Microsoft.Azure.Commands.Profile.Common.ContextModificationScope
Parameter Sets: (All)
Aliases:
Accepted values: Process, CurrentUser
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseSpecifies if the x5c claim (public key of the certificate) should be sent to the STS to achieve easy certificate rollover in Azure AD.
Type: System.Management.Automation.SwitchParameter
Parameter Sets: ServicePrincipalCertificateWithSubscriptionId, ServicePrincipalCertificateFileWithSubscriptionId
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseIndicates that this account authenticates by providing service principal credentials.
Type: System.Management.Automation.SwitchParameter
Parameter Sets: ServicePrincipalWithSubscriptionId
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseType: System.Management.Automation.SwitchParameter
Parameter Sets: ServicePrincipalCertificateWithSubscriptionId, ClientAssertionParameterSet, ServicePrincipalCertificateFileWithSubscriptionId
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseSkips context population if no contexts are found.
Type: System.Management.Automation.SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseSkip validation for access token.
Type: System.Management.Automation.SwitchParameter
Parameter Sets: AccessTokenWithSubscriptionId
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseSubscription Name or ID.
Type: System.String
Parameter Sets: (All)
Aliases: SubscriptionName, SubscriptionId
Required: False
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: FalseOptional tenant name or ID.
Note
Due to limitations of the current API, you must use a tenant ID instead of a tenant name when connecting with a business-to-business (B2B) account.
Type: System.String
Parameter Sets: UserWithSubscriptionId, UserWithCredential, AccessTokenWithSubscriptionId, ManagedServiceLogin
Aliases: Domain, TenantId
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseType: System.String
Parameter Sets: ServicePrincipalWithSubscriptionId, ServicePrincipalCertificateWithSubscriptionId, ClientAssertionParameterSet, ServicePrincipalCertificateFileWithSubscriptionId
Aliases: Domain, TenantId
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseUse device code authentication instead of a browser control.
Type: System.Management.Automation.SwitchParameter
Parameter Sets: UserWithSubscriptionId
Aliases: DeviceCode, DeviceAuth, Device
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalsePrompts you for confirmation before running the cmdlet.
Type: System.Management.Automation.SwitchParameter
Parameter Sets: (All)
Aliases: cf
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: FalseShows what would happen if the cmdlet runs. The cmdlet is not run.
Type: System.Management.Automation.SwitchParameter
Parameter Sets: (All)
Aliases: wi
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: FalseThis cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.