Public/Connect-AzRetirementMonitor.ps1
|
function Connect-AzRetirementMonitor { <# .SYNOPSIS Authenticates to Azure and stores an access token .DESCRIPTION Uses Azure CLI (default) or Az.Accounts to authenticate and obtain an access token scoped to https://management.azure.com for read-only Azure Advisor API access. The token obtained is used exclusively for: - Reading Azure Advisor recommendations (Microsoft.Advisor/recommendations/read) - Reading Azure Advisor metadata (Microsoft.Advisor/metadata/read) - Listing subscriptions (Microsoft.Resources/subscriptions/read) Required RBAC permissions: Reader role at subscription or resource group scope The token is stored in a module-scoped variable for the duration of the PowerShell session and is validated for proper audience (https://management.azure.com) before use. .PARAMETER UseAzCLI Use Azure CLI (az) for authentication. This is the default. .PARAMETER UseAzPowerShell Use Az.Accounts PowerShell module for authentication. .EXAMPLE Connect-AzRetirementMonitor Connects using Azure CLI (default method) .EXAMPLE Connect-AzRetirementMonitor -UseAzPowerShell Connects using Az.Accounts PowerShell module .OUTPUTS None. Displays a success message when authentication completes. #> [CmdletBinding(DefaultParameterSetName = 'AzCLI')] [OutputType([void])] param( [Parameter(ParameterSetName = 'AzCLI')] [switch]$UseAzCLI, [Parameter(ParameterSetName = 'AzPS')] [switch]$UseAzPowerShell ) try { if ($UseAzPowerShell) { if (-not (Get-Module -ListAvailable -Name Az.Accounts)) { throw "Az.Accounts module is not installed." } Import-Module Az.Accounts -ErrorAction Stop $context = Get-AzContext if (-not $context) { throw "Run Connect-AzAccount first." } Write-Verbose "Using Az.Accounts for authentication" Write-Verbose "Requesting token scoped to https://management.azure.com for read-only Azure Advisor access" $token = Get-AzAccessToken -ResourceUrl "https://management.azure.com" $script:AccessToken = $token.Token } else { $null = & az account show 2>$null if ($LASTEXITCODE -ne 0) { throw "Not logged into Azure CLI. Run 'az login'." } Write-Verbose "Using Azure CLI for authentication" Write-Verbose "Requesting token scoped to https://management.azure.com for read-only Azure Advisor access" $script:AccessToken = & az account get-access-token ` --resource https://management.azure.com ` --query accessToken ` --output tsv } Write-Host "Authenticated to Azure successfully" Write-Verbose "Token is scoped to https://management.azure.com for Azure Resource Manager API access" Write-Verbose "This module only uses read-only operations: Microsoft.Advisor/recommendations/read and Microsoft.Advisor/metadata/read" } catch { Write-Error "Authentication failed: $_" } } |