Azure Function - Connect-MSolservice error - azure

Question

Today, I've created an Azure Function to connect to Office365.
This is the code, which it works on my PC:
#Input bindings are passed in via param block.
param($Request, $TriggerMetadata)
#Import-Module AzureAD -UseWindowsPowershell
Import-Module MSonline -UseWindowsPowershell -Force
$PWord = ConvertTo-SecureString –String "MyPass" –AsPlainText -Force
$Credential = New-Object –TypeName System.Management.Automation.PSCredential –ArgumentList "MyTenantAdmin", $PWord
#Connect-AzureAD -credential $Credential
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Connect-MSolService -credential $Credential
However, when I try it on the Azure Function, I obtain this error:
2022-12-28T20:45:09Z [Error] ERROR: Authentication Error: Unable
to complete authentication request (potentially a proxy issue)
OriginInfo : localhost Exception :
Type : System.Management.Automation.RemoteException
SerializedRemoteException : System.Exception: Authentication Error: Unable to complete authentication request (potentially a proxy
issue) --->
Microsoft.IdentityModel.Clients.ActiveDirectory.AdalException: User
realm discovery failed
at Microsoft.Identity.Core.WsTrust.CommonNonInteractiveHandler.d__5.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Core\WsTrust\CommonNonInteractiveHandler.cs:line
74
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenUsernamePasswordHandler.d__5.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Internal\Flows\NonInteractive\AcquireTokenUsernamePasswordHandler.cs:line
77
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.d__60.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Internal\Flows\AcquireTokenHandlerBase.cs:line
241
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.d__39.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\AuthenticationContext.cs:line
542
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContextIntegratedAuthExtensions.d__0.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Features\WinCommon\AuthenticationContextIntegratedAuthExtensions.cs:line
59
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.Online.Administration.Automation.CommonFiles.AuthManager.AuthenticateUser(AuthenticationContext
ac, PSCredential cred) in
X:\bt\1225946\repo\src\dev\PowerShell.V1\modules\psmodule\CommonFiles\AuthManager.cs:line
115
--- End of inner exception stack trace ---
at Microsoft.Online.Administration.Automation.CommonFiles.AuthManager.ProcessADALException(AdalException
aeGeneral, AuthenticationContext ac, IDictionary`2 accessTokens) in
X:\bt\1225946\repo\src\dev\PowerShell.V1\modules\psmodule\CommonFiles\AuthManager.cs:line
529
at Microsoft.Online.Administration.Automation.CommonFiles.AuthManager.AuthenticateUser(AuthenticationContext
ac, PSCredential cred) in
X:\bt\1225946\repo\src\dev\PowerShell.V1\modules\psmodule\CommonFiles\AuthManager.cs:line
136
at Microsoft.Online.Administration.Automation.ConnectMsolService.MsolCmdletProcessRecord()
in
X:\bt\1225946\repo\src\dev\PowerShell.V1\modules\psmodule\Cmdlets\Connect-Service.cs:line
247
SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfo
ErrorRecord :
Exception :
Type : System.Management.Automation.RemoteException
SerializedRemoteException : System.Exception: Authentication Error: Unable to complete authentication request
(potentially a proxy issue) --->
Microsoft.IdentityModel.Clients.ActiveDirectory.AdalException: User
realm discovery failed
at Microsoft.Identity.Core.WsTrust.CommonNonInteractiveHandler.d__5.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Core\WsTrust\CommonNonInteractiveHandler.cs:line
74
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenUsernamePasswordHandler.d__5.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Internal\Flows\NonInteractive\AcquireTokenUsernamePasswordHandler.cs:line
77
--- End of stack trace from previous location where exception was thrown ---
The user has not MFA enabled.

Answer 1

Enable "System assigned identity" under Identity in Function App to register with AzureAD when running insideAzure functions. It will then grant all permissions/scopes required to operate with AzureAD-related modules.
To run connect-MsolService, MsOnline(Connecting to 365) module needs to be added in requirements.psd1 under App files in Azure functions. comes under Azure Acitve directory Module.
check the version compatibility for Msonline & Powershell
Add 64 bit version installer to handle binaries for the online office 365 modules.
FunctionApp -> Settings -> Configuration:
After checking all the above conditions try executing the same script to connect Msolservice.
Other approach:
As detailed in the article, I created a triggered function and connected to MsolService (office 365) with FTP hostname.
Function Properities in Portal:
Install Msoline module in local folder and deploy it to azure. Add username & password credentials in local path and mention that path in script to get the encrypted values.
FunctionApp -> Configuration -> Application settings:
Script:
param($Request, $TriggerMetadata)
$ModuleName = 'MSOnline'
$ModuleVersion = '1.1.*'
$user = $Env:user
$pword = $Env:pword
$path = "C:xxxx"
Import-module $ModuleName
$pWord = ConvertTo-SecureString –String $pword –AsPlainText -Force
$Credential = New-Object –TypeName System.Management.Automation.PSCredential –ArgumentList $user, $pWord
Connect-MsolService -Credential $credential
Got successful response as shown:
Monitor Log check: