Azure Function调用Connect-MSolService遇身份验证错误（本地正常）

开发了一个连接Office365的Azure Function，对应的PowerShell代码在本地PC可正常执行，但部署到Azure Function环境后运行出现身份验证错误。该账号未启用MFA。

#Input bindings are passed in via param block.
param($Request, $TriggerMetadata)

#Import-Module AzureAD -UseWindowsPowershell
Import-Module MSonline -UseWindowsPowershell -Force

$PWord = ConvertTo-SecureString –String "MyPass" –AsPlainText -Force
$Credential = New-Object –TypeName System.Management.Automation.PSCredential –ArgumentList "MyTenantAdmin", $PWord

#Connect-AzureAD -credential $Credential
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Connect-MSolService -credential $Credential

2022-12-28T20:45:09Z [Error] ERROR: Authentication Error: Unable
to complete authentication request (potentially a proxy issue)

OriginInfo : localhost Exception :
Type : System.Management.Automation.RemoteException
SerializedRemoteException : System.Exception: Authentication Error: Unable to complete authentication request (potentially a proxy
issue) --->
Microsoft.IdentityModel.Clients.ActiveDirectory.AdalException: User
realm discovery failed
at Microsoft.Identity.Core.WsTrust.CommonNonInteractiveHandler.d__5.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Core\WsTrust\CommonNonInteractiveHandler.cs:line
74
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenUsernamePasswordHandler.d__5.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Internal\Flows\NonInteractive\AcquireTokenUsernamePasswordHandler.cs:line
77
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.d__60.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Internal\Flows\AcquireTokenHandlerBase.cs:line
241
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.d__39.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\AuthenticationContext.cs:line
542
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContextIntegratedAuthExtensions.d__0.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Features\WinCommon\AuthenticationContextIntegratedAuthExtensions.cs:line
59
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.Online.Administration.Automation.CommonFiles.AuthManager.AuthenticateUser(AuthenticationContext
ac, PSCredential cred) in
X:\bt\1225946\repo\src\dev\PowerShell.V1\modules\psmodule\CommonFiles\AuthManager.cs:line
115
--- End of inner exception stack trace ---
at Microsoft.Online.Administration.Automation.CommonFiles.AuthManager.ProcessADALException(AdalException
aeGeneral, AuthenticationContext ac, IDictionary`2 accessTokens) in
X:\bt\1225946\repo\src\dev\PowerShell.V1\modules\psmodule\CommonFiles\AuthManager.cs:line
529
at Microsoft.Online.Administration.Automation.CommonFiles.AuthManager.AuthenticateUser(AuthenticationContext
ac, PSCredential cred) in
X:\bt\1225946\repo\src\dev\PowerShell.V1\modules\psmodule\CommonFiles\AuthManager.cs:line
136
at Microsoft.Online.Administration.Automation.ConnectMsolService.MsolCmdletProcessRecord()
in
X:\bt\1225946\repo\src\dev\PowerShell.V1\modules\psmodule\Cmdlets\Connect-Service.cs:line
247
SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfo
ErrorRecord :
Exception :
Type : System.Management.Automation.RemoteException
SerializedRemoteException : System.Exception: Authentication Error: Unable to complete authentication request
(potentially a proxy issue) --->
Microsoft.IdentityModel.Clients.ActiveDirectory.AdalException: User
realm discovery failed
at Microsoft.Identity.Core.WsTrust.CommonNonInteractiveHandler.d__5.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Core\WsTrust\CommonNonInteractiveHandler.cs:line
74
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenUsernamePasswordHandler.d__5.MoveNext()
in
D:\a\1\s\src\Microsoft.IdentityModel.Clients.ActiveDirectory\Internal\Flows\NonInteractive\AcquireTokenUsernamePasswordHandler.cs:line
77
--- End of stack trace from previous location where exception was thrown ---

1. 弃用MSOnline模块，改用Microsoft Graph PowerShell模块 #

MSOnline模块已被标记为弃用，Azure Function环境对其支持有限，且依赖的ADAL库存在云环境兼容性问题。推荐使用基于MSAL库的Microsoft Graph PowerShell模块，适配性更强。

替换后的核心代码示例：

param($Request, $TriggerMetadata)

# 导入Microsoft Graph模块
Import-Module Microsoft.Graph.Users

# 使用客户端凭据认证（推荐方式，避免用户名密码硬编码）
$clientId = "你的应用注册客户端ID"
$tenantId = "你的租户ID"
$clientSecret = ConvertTo-SecureString "你的应用注册客户端密钥" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($clientId, $clientSecret)

# 连接Microsoft Graph
Connect-MgGraph -Credential $credential -TenantId $tenantId -Scopes "User.Read.All"

2. 避免硬编码凭据，使用Azure Function应用配置 #

在Azure Function的配置页面添加应用设置（如TenantId、ClientId、ClientSecret），代码中通过环境变量读取，杜绝明文存储敏感信息：

$clientId = $env:ClientId
$tenantId = $env:TenantId
$clientSecret = ConvertTo-SecureString $env:ClientSecret -AsPlainText -Force

3. 检查Azure Function网络配置 #

若必须继续使用MSOnline模块，需确认：

• 若Azure Function启用了虚拟网络集成，需确保允许访问Office365核心端点（如login.microsoftonline.com）
• 检查Function的出站网络规则，是否有防火墙或代理拦截了认证请求
• 保留代码中[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12的设置，确保TLS版本合规

4. 确认账号权限与状态 #

• 检查租户管理员账号是否被云环境的条件访问策略限制
• 确认账号未被强制要求使用特定认证方式，即使未启用MFA

内容的提问来源于stack exchange，提问作者user2239414