Issue Entra tokens with Azure CLI

1. Sign in to the Azure CLI using the az login command and follow the on-screen instructions.

2. Set the correct subscription for the signed-in user with these bash commands. Make sure the Azure subscription ID is associated with the tenant connected to the Azure DevOps organization you're trying to access. If you don't know your subscription ID, you can find it in the Azure portal.

   az account set -s <subscription-id>
   

3. Generate a Microsoft Entra ID access token with the az account get-access-token command using the Azure DevOps resource ID: 499b84ac-1321-427f-aa17-267ca6975798.

   az account get-access-token \
   --resource 499b84ac-1321-427f-aa17-267ca6975798 \
   --query "accessToken" \
   -o tsv
   

1. Sign in to Azure PowerShell using the Connect-AzAccount command and follow the on-screen instructions.

2. Set the correct subscription for the signed-in user with these PowerShell commands. Make sure the Azure subscription ID is associated with the tenant connected to the Azure DevOps organization you're trying to access. If you don't know your subscription ID, you can find it in the Azure portal.

   Set-AzContext -Subscription <subscriptionID>
   

3. Generate a Microsoft Entra ID access token with the Get-AzAccessToken command using the Azure DevOps resource ID: 499b84ac-1321-427f-aa17-267ca6975798.

   Get-AzAccessToken -ResourceUrl '499b84ac-1321-427f-aa17-267ca6975798'
   

Acquiring a token for a service principal

1. Sign in to the Azure CLI as the service principal using the az devops login command.
2. Follow the on-screen instructions and finish signing in.

# To authenticate a service principal with a password or cert:
az login --service-principal -u <app-id> -p <password-or-cert> --tenant <tenant>

# To authenticate a managed identity:
az login --identity

3. Set the right correct subscription for the signed-in service principal by entering the command:

az account set -s <subscription-id>

4. Generate a Microsoft Entra ID access token with the az account get-access-token the Azure DevOps resource ID: 499b84ac-1321-427f-aa17-267ca6975798.

$accessToken = az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query "accessToken" --output tsv

5. Now, you can use az cli commands per usual. Let's try to call an Azure DevOps API by passing it in the headers as a Bearer token:

$apiVersion = "7.1-preview.1"
$uri = "https://dev.azure.com/${yourOrgname}/_apis/projects?api-version=${apiVersion}"
$headers = @{
    Accept = "application/json"
    Authorization = "Bearer $accessToken"
}
Invoke-RestMethod -Uri $uri -Headers $headers -Method Get | Select-Object -ExpandProperty value ` | Select-Object id, name