Run PowerShell commands with Microsoft Entra credentials to access queue data

  • Article

Azure Storage provides extensions for PowerShell that enable you to sign in and run scripting commands with Microsoft Entra credentials. When you sign in to PowerShell with Microsoft Entra credentials, an OAuth 2.0 access token is returned. That token is automatically used by PowerShell to authorize subsequent data operations against Queue Storage. For supported operations, you no longer need to pass an account key or SAS token with the command.

You can assign permissions to queue data to a Microsoft Entra security principal via Azure role-based access control (Azure RBAC). For more information about Azure roles in Azure Storage, see Manage access rights to Azure Storage data with Azure RBAC.

Supported operations

The Azure Storage extensions are supported for operations on queue data. Which operations you may call depends on the permissions granted to the Microsoft Entra security principal with which you sign in to PowerShell. Permissions to queues are assigned via Azure RBAC. For example, if you have been assigned the Queue Data Reader role, then you can run scripting commands that read data from a queue. If you have been assigned the Queue Data Contributor role, then you can run scripting commands that read, write, or delete a queue or the data they contain.

For details about the permissions required for each Azure Storage operation on a queue, see Call storage operations with OAuth tokens.

Important

When a storage account is locked with an Azure Resource Manager ReadOnly lock, the List Keys operation is not permitted for that storage account. List Keys is a POST operation, and all POST operations are prevented when a ReadOnly lock is configured for the account. For this reason, when the account is locked with a ReadOnly lock, users who do not already possess the account keys must use Microsoft Entra credentials to access queue data. In PowerShell, include the -UseConnectedAccount parameter to create an AzureStorageContext object with your Microsoft Entra credentials.

Call PowerShell commands using Microsoft Entra credentials

Note

We recommend that you use the Azure Az PowerShell module to interact with Azure. See Install Azure PowerShell to get started. To learn how to migrate to the Az PowerShell module, see Migrate Azure PowerShell from AzureRM to Az.

To use Azure PowerShell to sign in and run subsequent operations against Azure Storage using Microsoft Entra credentials, create a storage context to reference the storage account, and include the -UseConnectedAccount parameter.

The following example shows how to create a queue in a new storage account from Azure PowerShell using your Microsoft Entra credentials. Remember to replace placeholder values in angle brackets with your own values:

  1. Sign in to your Azure account with the Connect-AzAccount command:

    Connect-AzAccount -Environment AzureChinaCloud

    For more information about signing into Azure with PowerShell, see Sign in with Azure PowerShell.

  2. Create an Azure resource group by calling New-AzResourceGroup.

    $resourceGroup = "sample-resource-group-ps"
$location = "chinaeast2"
New-AzResourceGroup -Name $resourceGroup -Location $location

  3. Create a storage account by calling New-AzStorageAccount.

    $storageAccount = New-AzStorageAccount -ResourceGroupName $resourceGroup `
  -Name "<storage-account>" `
  -SkuName Standard_LRS `
  -Location $location `

  4. Get the storage account context that specifies the new storage account by calling New-AzStorageContext. When acting on a storage account, you can reference the context instead of repeatedly passing in the credentials. Include the -UseConnectedAccount parameter to call any subsequent data operations using your Microsoft Entra credentials:

    $ctx = New-AzStorageContext -StorageAccountName "<storage-account>" -UseConnectedAccount

  5. Before you create the queue, assign the Storage Queue Data Contributor role to yourself. Even though you are the account owner, you need explicit permissions to perform data operations against the storage account. For more information about assigning Azure roles, see Assign an Azure role for access to queue data.

    Important

    Azure role assignments may take a few minutes to propagate.

  6. Create a queue by calling New-AzStorageQueue. Because this call uses the context created in the previous steps, the queue is created using your Microsoft Entra credentials.

    $queueName = "sample-queue"
New-AzStorageQueue -Name $queueName -Context $ctx

Next steps