{"id":2258,"date":"2025-04-30T20:42:44","date_gmt":"2025-05-01T00:42:44","guid":{"rendered":"https:\/\/enterpriseadmins.org\/blog\/?p=2258"},"modified":"2025-04-30T20:42:44","modified_gmt":"2025-05-01T00:42:44","slug":"how-to-use-powercli-with-entra-id-federated-vcenter-logins","status":"publish","type":"post","link":"https:\/\/enterpriseadmins.org\/blog\/scripting\/how-to-use-powercli-with-entra-id-federated-vcenter-logins\/","title":{"rendered":"How to Use PowerCLI with Entra ID Federated vCenter Logins"},"content":{"rendered":"\n<p>vCenter Server 8.0 allows administrators to federate identity with Entra ID (formerly Azure AD), enabling seamless SSO and MFA. However, integrating this setup with automation tools like PowerCLI introduces a few challenges. This guide walks through enabling and using PowerCLI with federated logins.<\/p>\n\n\n\n<p>After enabling this federated identity feature, a few additional considerations are required when connecting using PowerCLI.  In most Entra ID environments multifactor authentication is enforced, for example via conditional access policy.  As such, attempting to login with just a username and password will fail.  Here is a sample error response:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&gt; Connect-VIServer vc3.example.com -User h163-user2@lab.enterpriseadmins.org -Password VMware1!\n\nConnect-VIServer : 4\/29\/2025 6:29:26 PM Connect-VIServer                Cannot complete login due to an incorrect user name or password.\nAt line:1 char:1\n+ Connect-VIServer vc3.example.com -User h163-user2@lab.enterpriseadmin ...\n+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n    + CategoryInfo          : NotSpecified: (:) &#91;Connect-VIServer], InvalidLogin\n    + FullyQualifiedErrorId : Client20_ConnectivityServiceImpl_Reconnect_SoapException,VMware.VimAutomation.ViCore.Cmdlets.Command\n   s.ConnectVIServer<\/code><\/pre>\n\n\n\n<p>The good news is we can still allow clients\/end users to login via their federated identities with a little setup.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Administrator \/ Grant access to PowerCLI User<\/h2>\n\n\n\n<p>As an administrator, we&#8217;ll create a new OAuth2 client. We will share this client details with the client who wishes to use PowerCLI.  In the codeblock below we&#8217;ll use splatting to make the code a bit more readable.  <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$newOAuthArguments = @{\n  ClientID     = 'h366-powercli-native-Brian'\n  Name         = 'h366-PowerCLI Client2'\n  Scope        = @(\"openid\", \"user\", \"group\")\n  GrantTypes   = @(\"authorization_code\", \"refresh_token\")\n  RedirectUris = @(\"http:\/\/localhost:8844\/authcode\")\n  PkceEnforced = $true\n  AccessTokenTimeToLiveMinutes      = 30\n  RefreshTokenTimeToLiveMinutes     = 43200\n  RefreshTokenIdleTimeToLiveMinutes = 28800\n}\n$newClient = New-VIOAuth2Client @newOAuthArguments<\/code><\/pre>\n\n\n\n<p>In the above example, we assigned the output of <code>New-VIOAuth2Client<\/code> to a variable and did not specify a <code>Secret<\/code> parameter.  With this configuration, a secret will be automatically generated, but that value is not returned in the default output of the cmdlet. We&#8217;ll use <code>$newClient.secret<\/code>  to view the new secret of: <code>s1A9RxZ0FbBEGoMplD0HcbQITBODtX85<\/code>.  We&#8217;ll need to share the ClientID and Secret value with the person wishing to authenticate.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Client \/ PowerCLI User<\/h2>\n\n\n\n<p>In the step above, our administrator created a <code>New-VIOAuth2Client<\/code> for us and shared the following details:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ClientID = <code>h366-powercli-native-Brian<\/code><\/li>\n\n\n\n<li>Secret = <code>s1A9RxZ0FbBEGoMplD0HcbQITBODtX85<\/code><\/li>\n<\/ul>\n\n\n\n<p>We&#8217;ll now use those values to login to our vCenter Server using PowerCLI.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$newOAuthArguments = @{\n  TokenEndpointUrl         = 'https:\/\/test-vcsa-03.lab.enterpriseadmins.org\/acs\/t\/CUSTOMER\/token'\n  AuthorizationEndpointUrl = 'https:\/\/test-vcsa-03.lab.enterpriseadmins.org\/acs\/t\/CUSTOMER\/authorize' \n  RedirectUrl              = 'http:\/\/localhost:8844\/authcode'\n  ClientId                 = 'h366-powercli-native-Brian'\n  ClientSecret             = 's1A9RxZ0FbBEGoMplD0HcbQITBODtX85'\n}\n\n$oauthSecContext = New-OAuthSecurityContext @newOAuthArguments<\/code><\/pre>\n\n\n\n<p>This results in our default web browser opening to an Azure \/ Entra AD login page.  After successfully entering our credentials, we are redirected to a page that looks like the following image: <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/enterpriseadmins.org\/blog\/wp-content\/uploads\/2025\/04\/image-17.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"72\" src=\"https:\/\/enterpriseadmins.org\/blog\/wp-content\/uploads\/2025\/04\/image-17-1024x72.png\" alt=\"\" class=\"wp-image-2260\" srcset=\"https:\/\/enterpriseadmins.org\/blog\/wp-content\/uploads\/2025\/04\/image-17-1024x72.png 1024w, https:\/\/enterpriseadmins.org\/blog\/wp-content\/uploads\/2025\/04\/image-17-300x21.png 300w, https:\/\/enterpriseadmins.org\/blog\/wp-content\/uploads\/2025\/04\/image-17-768x54.png 768w, https:\/\/enterpriseadmins.org\/blog\/wp-content\/uploads\/2025\/04\/image-17.png 1340w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>The text states: <code>PowerCLI authenticated successfully. Please continue in the PowerShell console. You can close this window now.<\/code>  If you look closely at the URL, you&#8217;ll note the page is the <code>RedirectUrl<\/code> we specified above.<\/p>\n\n\n\n<p>We&#8217;ll now take the <code>$ouathSecContext<\/code> return from the previous codeblock and use it to create a <code>$samlSecContext<\/code> and use that to connect to our vCenter.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$samlSecContext = New-VISamlSecurityContext -VCenterServer 'test-vcsa-03.lab.enterpriseadmins.org' -OAuthSecurityContext $oauthSecContext\nConnect-VIServer -Server 'test-vcsa-03.lab.enterpriseadmins.org' -SamlSecurityContext $samlSecContext<\/code><\/pre>\n\n\n\n<p>The above commands will return a successful login prompt:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Name                           Port  User\n----                           ----  ----\ntest-vcsa-03.lab.enterprisead\u2026 443   LAB.ENTERPRISEADMINS.ORG\\h163\u2026<\/code><\/pre>\n\n\n\n<p>We can now run PowerCLI cmdlets using our federated identity.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p>Using Entra ID federation with vCenter Server 8.0 is a great way to step up your security game, especially with MFA in the mix.  As we\u2019ve seen, it can trip up tools like PowerCLI if you&#8217;re expecting username and password logins.<\/p>\n\n\n\n<p>Thankfully, with a little setup (like creating an OAuth client and using the right security contexts), we can still automate tasks and scripts using federated identity.  If this is something your team will do often, it\u2019s worth putting together a quick internal guide or template for setting up new PowerCLI clients.  It&#8217;ll save time and keep everyone on the same page.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>vCenter Server 8.0 allows administrators to federate identity with Entra ID (formerly Azure AD), enabling seamless SSO and MFA. However, integrating this setup with automation tools like PowerCLI introduces a few challenges. This guide walks through enabling and using PowerCLI &hellip; <a href=\"https:\/\/enterpriseadmins.org\/blog\/scripting\/how-to-use-powercli-with-entra-id-federated-vcenter-logins\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-2258","post","type-post","status-publish","format-standard","hentry","category-scripting","category-virtualization"],"_links":{"self":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts\/2258","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/comments?post=2258"}],"version-history":[{"count":3,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts\/2258\/revisions"}],"predecessor-version":[{"id":2262,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts\/2258\/revisions\/2262"}],"wp:attachment":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/media?parent=2258"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/categories?post=2258"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/tags?post=2258"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}