Get-AzContext doesn't always grab the UPN

[FallenHoot]

Description

This might be a duplicate, but creating it for an issue tracker product. Azure/Enterprise-Scale#601

Get-AzContext doesn't always grab the UPN.

#13797

Steps to reproduce

#sign in to Azure  from Powershell, this will redirect you to a web browser for authentication, if required
Connect-AzAccount

Get the UPN from this:
(Get-AzContext).Account

(Get-AzContext).Account.Id
``

[dingmeng-xue]

Thanks for reporting. The account name may be different from UPN. We didn't find clear rule between account id for login and UPN from AAD graph or MSGraph. Is there any official doc?

[FallenHoot]

The only docs I see is the following:
https://docs.microsoft.com/en-us/powershell/module/az.accounts/get-azcontext?view=azps-6.0.0

It looks to be a legacy issue with Get-AzureRmSubscription
#1665

I have asked several people to see if they can reproduce this, but everything works as normal. It might be an issue with Service Principles or Guest Accounts. Will verify with (Get-AzContext).Account.Type

I was told this method works in Bash with no issue.

#sign  into AZ CLI, this will redirect you to a web browser for authentication, if required
az login

#assign Owner role to Tenant root scope  ("/") as a Owner (gets object Id of the current user (az login))
az role assignment create --scope '/'  --role 'Owner' --assignee-object-id $(az ad signed-in-user show --query  objectId)

[dingmeng-xue]

Our proposal is Get-AzAdUser -SignedInUser returns current signed in user. It should call /{tenantID}/me
https://github.com/Azure/azure-rest-api-specs/blob/c059fb47f87a35ce5a90631883dfba8f01a41d8e/specification/graphrbac/data-plane/Microsoft.GraphRbac/stable/1.6/graphrbac.json#L39

[VeryEarly]

please try above suggestion, close this issue for now.
Feel free to reopen if you meet have further questions.

[adamasmar]

Oh boy, I really wish this would work using Azure Powershell. Using Azure CLI as a workaround really doesn't work too well when trying to integrate with other scripts.

In my example, my Microsoft account is linked with my personal e-mail address. It produces a UPN that looks something like
{my email}_gmail.com#EXT#@{my email}gmail.onmicrosoft.com with a user type of Member on the Azure portal.

However, note the results of the following commands using Azure Powershell:

(Get-AzContext).Account.Id
# returns '{my email}@gmail.com'

(Get-AzContext).Account.Type
# returns 'User'

I am trying to create a script that assigns Key Vault access policies dynamically to the executing user, but this makes it nearly impossible for this type of account scenario as I don't believe there is any good way to assign it without hardcoding a -UserPrincipalName.

[dingmeng-xue]

@adamasmar , thanks for contacting us. Please try to use Get-AzAdUser -SignedIn. If you still cannot get expected result, please create a Github issue.