如何使用Azure KeyVault或Automation证书连接Exchange及PnPOnline

一、Azure KeyVault 实现步骤 #

1. 连接Exchange Online #

• 前置条件：已在KeyVault中存储带私钥的PFX/PKCS12格式证书，当前操作身份拥有KeyVault的GetCertificate权限
• 操作代码：

# 从KeyVault拉取证书并转换为X509对象
$cert = Get-AzKeyVaultCertificate -VaultName "your-vault-name" -Name "your-cert-name"
$certBytes = $cert.SecretValue | ConvertFrom-SecureString -AsPlainText | ConvertFrom-Base64String
$x509Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certBytes, $null, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable)

# 建立Exchange Online连接
Connect-ExchangeOnline -Certificate $x509Cert -AppId "your-app-reg-id" -Organization "your-tenant-domain.onmicrosoft.com"

2. 连接PnPOnline（CertificateBase64Encoded方式） #

• 核心优势：无需本地生成证书文件，直接用KeyVault中证书的Base64编码完成身份验证
• 操作代码：

# 从KeyVault获取证书的PFX格式Base64编码（证书的SecretValue存储的就是该内容）
$certSecret = Get-AzKeyVaultSecret -VaultName "your-vault-name" -Name "your-cert-name"
$certBase64 = $certSecret.SecretValue | ConvertFrom-SecureString -AsPlainText

# 建立PnPOnline连接
Connect-PnPOnline -Url "https://your-site.sharepoint.com" -ClientId "your-app-reg-id" -CertificateBase64Encoded $certBase64 -Tenant "your-tenant-domain.onmicrosoft.com"

• 注意：确保KeyVault中存储的证书包含私钥，且应用注册已授予SharePoint站点的对应权限（如Sites.FullControl.All）

二、Azure Automation 实现步骤 #

1. 连接Exchange Online #

• 前置条件：已将带私钥的证书导入Azure Automation账户的「证书」资产，自动化账户身份拥有Exchange Online访问权限
• Runbook操作代码：

# 从Automation资产库获取证书
$cert = Get-AutomationCertificate -Name "your-automation-cert-name"

# 建立Exchange Online连接
Connect-ExchangeOnline -Certificate $cert -AppId "your-app-reg-id" -Organization "your-tenant-domain.onmicrosoft.com"

2. 连接PnPOnline（CertificateBase64Encoded方式） #

• 核心逻辑：将Automation中的证书导出为PFX字节数组，再转换为Base64编码传入参数
• Runbook操作代码：

# 获取Automation证书并转换为Base64编码
$cert = Get-AutomationCertificate -Name "your-automation-cert-name"
$certBytes = $cert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pkcs12)
$certBase64 = [System.Convert]::ToBase64String($certBytes)

# 建立PnPOnline连接
Connect-PnPOnline -Url "https://your-site.sharepoint.com" -ClientId "your-app-reg-id" -CertificateBase64Encoded $certBase64 -Tenant "your-tenant-domain.onmicrosoft.com"

• 注意：导入证书到Automation时需勾选「允许私钥导出」，且Automation账户已安装PnP PowerShell模块

内容的提问来源于stack exchange，提问作者William Lee