Microsoft 365 Community Identity, 8 Sep 2020

Previous Meeting

⏯

youtube image

►

From YouTube: PnP Virtual Conference - 09/2020 - Keyless Authentication Using Azure Managed Identity

Description

A common challenge when building cloud integrations is how to manage the credentials needed by your code to authenticate with cloud services.

Azure solves this problem by providing a way to securely authenticate with any service that supports Azure AD authentication, without having to store any credentials in your code.

In this session, you will learn

• What Azure Managed Identity is
• How to enable and configure Azure Managed Identity to gain access to other Azure resources
• How to use Azure Managed Identity in Azure Functions and Logic Apps to call Azure AD backed APIs such as SharePoint Online and the Microsoft Graph
• How to configure your local machine for developing with Azure Managed Identity

Speaker: Garry Trinder (CPS) | @garrytrinder

Supporting materials:
• What are managed identities for Azure resources? - https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

Learn more:
• Learn more about the Microsoft 365 Patterns and Practices (PnP) community at: http://aka.ms/m365pnp
• Visit the Microsoft 365 Patterns and Practices community YouTube channel: https://aka.ms/m365pnp-videos

A

Hello and welcome to this pmp virtual conference, today's session keyless authentication using azure, managed identity hi. My name is gary trinder and I'll. Take you through today's session.

A

So a little bit about me, so I'm a solutions architect working for cps who a multi-uh goal. Microsoft calls partner based in the uk, I'm also a microsoft, 365 office, development, mvp and I'm a member of the pmp team. I helped maintain the cli for microsoft, 365 project, which you may have formally known it as office 365 cli.

A

So if you want to get hold of me, um follow me I'm on twitter on github. I've also got a blog, and if you want to listen to me a little bit more, I'm also a co-host of the gray hatbeard podcast. Where we talk about all things: microsoft, 365.

A

So in today's session, first we're gonna actually go through the problem that we're solving um I'm gonna talk about what azure managed identity is and how that solves our problem, and then I have four demos which are gonna show how to use azure managed identity with different azure resources and in in different ways.

A

So what problem are we trying to solve so a common challenge when building cloud applications is how do we manage the credentials in our code for authenticating to cloud services?

A

Keeping these credentials secure is is a real key task, so just have a think about. How do you manage your credentials currently? Do you store them in configuration files? Do you use something like as your key vault and how do you manage those credentials? How do you manage the expiration and the renewal of those credentials when they're they're running and if you are using as you as your key vault, although it provides a way to securely store credentials?

A

How do you connect that to that key vault by using credentials which you have to store somewhere else, so azure managed identity helps solve this problem? So a show managed identity is, is its full name is managed identities for azure resources, and it was previously named managed service, identity, msi.

A

Now what azure managed identity enables is it enables your azure resource to authenticate with any azure ad backed serviced, and it doesn't require any credentials to be placed in code. It also performs automatic, credential rolling, so every four to six days. It will actually refresh those credentials for you without you having to actually do anything and, what's even better, there's no additional cost. This is free with azure active directory.

A

So, where there's your managed identity there, there are two distinct types of identities that you can enable. There are system assigned, managed identities and user assigned managed identities.

A

A system assigned managed identity is something that's enabled directly on a azure service instance, so this might be an azure virtual machine, for example, and it cannot be shared with any other resource in the tenant and its lifecycle is tied to that resource, meaning if that resource is deleted, the managed identity is also deleted as well.

A

However, in contrast, a user-assigned managed identity is something that's created as a standalone resource. It's a standalone identity that can be shared across multiple resources, but its lifecycle is independent to those resources. So if a resource is deleted, then the user assigned managed identity remains for the remainder of this talk, um we would be just concentrating on the system assigned managed identity as it's the most supported and really when we're using um managed identity. It really does lend itself very well to secured secured app-only scenarios running as as application level.

A

So how does the azure managed identity actually work, and how does it authenticate without the need for credentials?

A

So here is a a flow chart of what happens when you first enable a managed identity, and in this scenario uh the managed identity is being enabled on a as your virtual machine, but it's the same process for for every uh supported, um azure resource. So, first of all, there will be a request to the azure resource manager to enable a managed identity on the azure resource, so we'll use the azure vm in this example.

A

So what that does is it creates a new managed identity service principle in the azure active directory um of the tenant that that azure resource lives in, at the same time, there's an update made to the azure instance metadata service. With details of this new managed identity.

A

What that does is it actually creates a certificate and a client id and stores that within the service once that has been set up, then there's a request for to the azure resource manager to grant access to other azure resources via the azure role-based access control- and this may be something like the virtual machine is needing access to as your key vault, for example.

A

So once the identity has been configured and then the permissions have been granted to a particular resource, we can then in our code that is running on that resource. So on the azure virtual machine. In this example, we can request a token from the local endpoint and the local endpoint is a local address within azure, where we can ask for a token for a particular resource. So this may be key vault in this example. So we request the token from uh sorry the azure instance metadata service.

A

Then requests that token from azure id and passes that back to our code. We can then use that token to then call the azure service with a valid as your as your ad token, all this without having to pass any uh client uh client secrets or certificates to authenticate.

A

So, let's jump into the demos. The first demo is I'm going to show the example of the the flowchart. I just showed you of how we can access the azure key vault from a linux, azure vm using azure managed identity, so we're in the azure portal. We've already got a vm and a key vault already provisioned in a resource group. So let's take a look at the resource group, and so we have yep the vm and the key vault. We quickly take a look in the key vault.

A

We can see that we have a secret called super secret and that's what we're going to obtain um in our demo. So if I go to the uh the azure vm, so the first thing we want to do is enable managed identity on this vm.

A

You can do that by going to the left-hand menu and find identity, and this brings you into the screen where you can enable and disable and configure manage identity on this particular azure resource, so to enable a system assigned managed identity, uh change, the toggle status to on and hit save, and it gives you a warning that says that uh it'll be registered in azure active directory and that you can grant it permissions to access resources protected by azure ad. Yes, we do want that.

A

So, let's click yes and that's saved and and created our identity. It's returned an object id which is the id of a service principle that has been created in our azure active directory. um What we can do is we can view that if we go to the azure active directory blade, we can view it by going to enterprise applications and toggle uh the application type to all applications, and what we can do is we can start to type the name of our resource, so the the name of the the vm.

A

So this is our managed identity, the service principle that's been created and it creates it with the name of the resource. So it's quite easy to identify um when you're looking through, okay, which one does this relate to. So you can look at a little bit more detail and you can see that we've got the object id there that we saw before okay, so we've configured the managed identity on this resource. What we need to do now is to give this identity access to read the secret in the key vault.

A

So let's go to the key vault.

A

And we can go to access policies and we can create a new access policy, so we want to be able to get a secret. So let's just create a a get policy against the secrets and here's where we can select our our principle. So what we can do is we can search for our service principle, so the managed identity that was that we created earlier and saw in our azure active directory.

A

We can select this and click add so now that we can see that we've got the uh our managed identity is classed as an application. We can see that it's got a uh a get uh permission for getting secrets and nothing else, so we'll only be able to obtain secrets using this. So let's just save that access policy.

A

What we're going to do is we're going to ssh into the azure vm so that when we're actually making requests that are being made from the actual azure vm within azure, so first, let's remote into the.

A

Vm, so now that we're running inside the vm, what we can do is we can request an access token from azure here's a http request. You can see that we're going to a local endpoint of.

A

169.254.169.254, which is only accessible from azure, and what we're going to do is we're going to request an access token for the key vault service.

A

So we make that request and we'll view the return value, which is our access token. So now that we have this access token, we can use this in a request to our key vault to obtain the secret.

A

So here we have our request. You can see that it's got the name of our key vault there and we're we're looking to return secrets, but specifically our super secret, and we can see that also we're going to be sending the access token that we retrieved in the previous request during the authorization header as a bearer token, so send that request and let's look at the return value.

A

So there we go. We can see that the value is actually the secret. That's from our key vault, but what's been really interesting, is that we don't actually have to pass any credentials, because this request came from the azure vm from within azure and we'd already set up. The permissions azure was quite happy to send back an access token of which then we could send on to our key vault to return our value in this demo.

A

I'm going to show you how you can call a microsoft graph from an azure logic, app using azure, managed identity.

A

So we're back in the azure portal. This time we have a logic app already provisioned and this logic app has already had the system assigned managed identity enabled we can look at that service principle in azure id which we have here and now what we're going to do this time, instead of in the previous example, we granted our service principal access to another azure resource this time, we're going to need to grant our service principal access to an azure ad backed api. In this case the microsoft graph.

A

We can come to the permissions section to see what permissions have been granted to this service principle, and it looks very similar to the app registration page uh that you may have seen previously.

A

Now, unfortunately, for us, this screen is read-only. We can't actually grant permissions to apis through this screen. We have to find another way and luckily, for us um there is an easy way of doing that through the cli for microsoft, 365 and the azure cloud shell, which is installed in so if we open up an azure cloud, shell prompt, we can use the cli and first log in to our tenant and we're also going to use managed identity in this case as well so cloud shell and microsoft.

A

Cli for microsoft, 365 also supports uh managed identity, login, and you can see that that has actually logged me in in my account. So what we can do is we can use a command in the cli to.

A

Create a app role assignment.

A

In azure active directory for us, we can pass it the display name of our service principle, so in this case la keyless.

B

A

Dev, we can also tell it the resource the api that we want to grant permissions to. So in this case, we want microsoft graph.

A

And also the permission and the scope that we want to grant our service principle so in this example, we're just going to grant the read all permission, so they are we've. Granted that permission we get a confirmation back, so we can close down our cloud shell and we can refresh this page and we can see now that the admin consent grant has been a given. It's a application based uh grant and you can see the information of when it was granted and who was granted by.

A

So if we go back to our logic app now, we can use this um to call the microsoft graph. So if we go to the logic app designer and let's create a blank clutch gap and let's use a recurrence to get things going.

B

A

Let's add in a http action.

A

And the method that we're going to use is.

B

A

And let's put in the url to the graph endpoint that we want.

B

A

So now what we can do is we can configure this http action to use our managed identity. So if we click down here, go to authentication click off and we get a number of options of which the bottom one is managed: identity. Okay, so we want to use system assigned managed identity, but now what we also need to do is we need to pass our audience and our audience because we are calling the microsoft graph is the url to the graph, and that is it.

A

So we can save our logic cap and then we can run it.

A

And there we go, we can see that we've made a call to the microsoft graph and we've also been able to return all of the groups that are in the tenant by using managed identity to authenticate. In the background in this demo, I'm going to show you how you can call the microsoft graph from a.net core as your function, using azure managed identity.

A

Here we are in visual studio. We have a net core as your function. Solution contains a single project with one function, endpoint called group. We have a dependency, so we've brought in the microsoft.azure.services.app authentication package from nuget.

A

What this is going to do is this is really going to help us simplify the acquiring of a token from azure rather than having to roll our own http requests to the local endpoint. We're going to let that package do that, handle that request for us, so we have a static class called auth and in auth it instantiates a connection string which is passed into the uh to create a new instance of the azure service. Token provider.

A

Now as we're running in azure in this in this example we're just going to run as app, and what this is telling the token provider to do is to check for the local endpoint in azure. So it's going to call that for us, but we don't have to tell it where to call what we can do is we can tell the provider. We can then tell the provider we want to access token for the microsoft graph and that's going to return an access token for us.

A

We can then pass that into a http client and we can pass that through as the authorization header as a bearer token, and then we can use that http client to make an authenticated request to the microsoft graph to return a list of groups. Then. Finally, the list of groups is just going to be returned back to the original caller.

A

So we've moved back into the azure portal, where we've now got an azure function and application insights added to our resource group. The azure function has already got the managed identity enabled and configured and we've also added the read all groups permission to the microsoft graph to that service principle.

A

We've also deployed all the code and we have our single endpoint here group and what we can do is we can come into the ui here and we can actually test this just to make sure it's actually working.

A

So if we go to test and run, we can just make a request and that's going to go to the azure function. It's then going to get an access token for the graph and return a list of groups which we have here so, let's see what's actually been happening. If we go to application insights and go to the application map, we can now see the calls that were actually made from the function.

A

We can see that there was a call made to a local endpoint in azure from the azure function, and this was to get our access token for the graph, and then there was another request to the graph to actually return the list of groups which were returned in the call response.

A

In the previous demo, we had to publish our code to azure just to see it working now. That is not entirely efficient for us to be deploying code every time we want to make a change.

A

Therefore, in this demo I'll show you how to configure your azure function for local development, so we're back in our visual studio solution. So we're going to do this time is we're going to configure this function so that it uses a local certificate for authentication.

A

That's going to get our access token, rather than the uh the code going to the azure local endpoint, which we won't be able to access because we're running it locally, we're not running within azure, and we need to configure our app to basically use that certificate.

A

So if we go to the auth class, we see that when we're running in the the debug mode, we're actually passing some additional um settings to the auth service, token provider in the connection stream.

A

So we're going to be passing an app id which is going to be a new service principle that we're going to create that's going to relate to uh to that app id. The tenant id of where that app actually is situated um a certificate, a thumbprint for the certificate that we're also going to create and the location of the um the certificate as well, which is going to be created in our current users, store location.

A

So how we're going to do that? Well, I have a powershell script that uses the azure powershell module, there's a few commandlets that we can use. Firstly, there's the new self-signed certificate that we're going to create and we're going to give that a a subject: name of our uh our function name um but with local at the end, just to differentiate between um our function, running in azure and the principle it uses and the principle that we're going to use locally.

A

So once we've created that certificate, we're going to create a new azure id service principle using that certificate and that's going to return us, then the tenant id and also extra information that we're going to use to then update the local.settings.json file.

A

So this file is injected into the runtime when you're running in in your debug mode, when you're running development and they're exposed as environment variables that we can use to pass into our connection stream- and I have a very simple class here that allows us to pull those values from the the local environment and then inject those into our connection stream.

A

So let's go to powershell, so I've already set up a connection with azure with my tenant. So now I can do is I can run my script and that is going to create our certificates already created the identity as well, so I've updated our app id and our tenant id and also the certificate thumbprint in our local settings.json.

A

So now the function is configured, but what we need to do now is we need to go back to the azure portal to make sure that our newly created principal has access to call the graph so we're back in the azure portal. This time we need to go to azure active directory and instead of looking in enterprise applications, we can look in app registrations. Instead, if we go to all applications, we can see there's our principal that was created and we can go in and we can add the permissions to this principle.

A

So, let's go to microsoft, graph, application, permissions and, let's add the group, read all permission. Let's add that and then give admin consent.

A

Okay, great now we have our service principle configured with permissions to call the graph.

A

So back in visual studio, now that we've configured the permissions for our service principle, we can now start to debug this as your function and authenticate with azure using our local certificate. So let's run the azure function locally. So this is now running and there's our endpoint that we can call so I've placed a couple of breakpoints, so one of the ones we're going to check is the connection string.

A

So if I go into powershell, let's create a new request and for this let's use the invoke web request. Commandlet.

B

And pass in the address of our local endpoint and let's call that.

A

So we can now see it's hit the breakpoint. We have our connection string, so we can see that we've got the app id the tent id and the thumbprint injected into there.

B

So, let's let that.

A

Run now we can see that we have an access. Token, that's been returned, so the the azure service token provider has been able to go to azure and say I want to use this certificate and for authentication.

A

Which we can then pass through in our http client, when we make a request to the the microsoft graph, so we're going to make a call to the graph to return the groups and then we'll see in the response. A list of groups.

A

So our request is finished and let's look at the content and there you see, we've been able to locally connect through to azure, using a certificate and being able to get an access token from azure, very little code change and being able to then pass that access token onto the graph to get a response.

A

So, let's recap on today's session, so we found that there's absolutely no need to store credentials in code anymore or actually an azure key vault for connecting to other azure resources or azure ad-backed apis. We can let azure handle that credential management take the pain away. No extra cost we're just using a service that is already available to us.

A

We can see that it simplifies app only scenarios as well. We want to call say, like the microsoft graph, with application only permissions, we could do that easily with managed identities, and we've also seen that we can use the cli for microsoft 365 to update the role assignments on those service principles that are created in azure, because we can't do it through the um the azure portal. We've found that there's a really easy, simple way of adding those app role assignments and also from within the portal itself using the azure cloud shell.

A

Now there is one thing to point out in that: creating those app role assignments does require azure global admin role. So this is something that you need to take into consideration when deploy deploying managed identities into production. Tenants, it's probably a good idea to speak to the administrator.

A

At that point, we've also seen that we can use the microsoft app authentication nuget package to simplify the authentication in our azure functions and using the azure cli in the background as well, we can work locally with azure functions, mimicking the behavior of the managed identities in azure, so all the samples um that we've seen today they're all available on github.

A

um If you want to find out more about managed identity as well, go there, there's lots of links and samples, two different resources for you to look at, and I just want to leave you with this think of your next project. Could you benefit from using as your managed identity? Is there a project that you're working on? Currently, that seems really complex, but is actually now could be quite simplified.

A

I hope this session has helped you to understand more about managed identity, so I want to thank you for attending my session. I want to thank you also for attending today's virtual conference and we hope that we see you in the next one. We obviously love to hear your feedback.

A

Please. Please leave us feedback so that we can make this conference better for the next time, so please scan the qr code or go to the website on the screen and leave your feedback. Thank you very.

B