Silent Batch Job Certificate Issue

[cstaubli]

I tried to setup a CI Pipeline with silent mode and certificate authentication, but was unable to. With secret authentication everything works as desired. After some debugging I've found the following issue:

The method Microsoft.Identity.Client.ConfidentialClientApplicationBuilder WithCertificate expects a value of type X509Certificate2 rather than a string as defined in Start-IntuneManagement.ps1 and CloudAPIPowerShellManagement.psm1 (Source). The method in question is located in MSALAuthentication.psm1

Changing the param type to X509Certificate2 fixed the authentication with certificate for me, I fetch a certificate from LocalMachine store and pass this to the parameter Certificate, like this

$f = [System.Security.Cryptography.X509Certificates.OpenFlags]::ReadOnly

$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("My", "LocalMachine")

$null = $store.Open($f)

$cert = $store.Certificates | Where-Object {$_.Subject -eq "..."}

$TenantId = "..."

$AppId = "..."

$SilentBatchFile = "BulkExport.json"

.\intunemanagement\Start-IntuneManagement.ps1 -Silent -TenantId $TenantId -AppId $AppId -SilentBatchFile $SilentBatchFile -Certificate $cert

$null = $store.Close()

If you prefer I can submit a PR with these changes

[Micke-K]

Hello Christian,

Great find!

The question is where it is better to convert it to a cert. That should probably happen where it is actually used and not in the start script.

Can you get it to work if you implement it in the function in the MSALAuthenication.psm1 file instead? I'm happy to approve a PR if you get that to work.

Thank you!

Cheers!

[cstaubli]

Hi Mikael

Sure I can change it in MSALAuthenication.psm1 and convert the thumbprint provided to a X509Certificate2. I propose to search in LocalMachine store for a certificate, what do you think?

Cheers
Christian

[Micke-K]

We can start there. Next option would be to check User store if not found in the machine store.

Thank you so much!

Cheers!

[cstaubli]

I've created a PR, which checks both LocalMachine and CurrentUser store

[Micke-K]

Closing this since the PR is merged

Cheers!