Använd ditt GitHub-konto för att logga in på Azure

Skapa en Microsoft Entra-app och tjänstens huvudnamn i portalen

Azure-portalen

1. • tilldela säkerhetsrollen till en app.

3. Kopiera prenumerations-ID:t.

Azure CLI

1. Skapa en Microsoft Entra ID-app.

   az ad app create --display-name myApp
   

2. Skapa ett huvudnamn för tjänsten.

    az ad sp create --id $appId
   

3. az role assignment create --role contributor --subscription $subscriptionId --assignee-object-id  $assigneeObjectId --assignee-principal-type ServicePrincipal --scope /subscriptions/$subscriptionId/resourceGroups/$resourceGroupName
   

Azure PowerShell

1. Skapa en Microsoft Entra ID-app.

   New-AzADApplication -DisplayName myApp
   

2. Skapa ett huvudnamn för tjänsten.

   $clientId = (Get-AzADApplication -DisplayName myApp).AppId
   New-AzADServicePrincipal -ApplicationId $clientId
   

3. Guide till att skapa en ny rolltilldelning

   $objectId = (Get-AzADServicePrincipal -DisplayName myApp).Id
   New-AzRoleAssignment -ObjectId $objectId -RoleDefinitionName Contributor -ResourceGroupName $resourceGroupName
   

4. $clientId = (Get-AzADApplication -DisplayName myApp).AppId
   $subscriptionId = (Get-AzContext).Subscription.Id
   $tenantId = (Get-AzContext).Subscription.TenantId
   

Azure-portalen

2. 
   
3. 

Fält	Description	Exempel
Organisation		contoso
Lagringsplats	GitHub-lagringsplatsnamn	contoso-app
Entitetstyp		Environment, Branch, Pull request, Tag
GitHub-namngivning		main
Name		contoso-deploy

Azure CLI

• • Exempel: repo:n-username/ node_express:ref:refs/heads/my-branch eller repo:n-username/ node_express:ref:refs/tags/my-tag.

az ad app federated-credential create --id <APPLICATION-OBJECT-ID> --parameters credential.json
("credential.json" contains the following content)
{
    "name": "<CREDENTIAL-NAME>",
    "issuer": "https://token.actions.githubusercontent.com",
    "subject": "repo:octo-org/octo-repo:environment:Production",
    "description": "Testing",
    "audiences": [
        "api://AzureADTokenExchange"
    ]
}

Azure PowerShell

• • Exempel: repo:n-username/ node_express:ref:refs/heads/my-branch eller repo:n-username/ node_express:ref:refs/tags/my-tag.

New-AzADAppFederatedCredential -ApplicationObjectId APPLICATION-OBJECT-ID -Audience api://AzureADTokenExchange -Issuer 'https://token.actions.githubusercontent.com/' -Name 'GitHub-Actions-Test' -Subject 'repo:octo-org/octo-repo:environment:Production'

1. 

2. 

3. GitHub-hemligheter	Azure Active Directory-programmet
   	App-ID (klient-ID)
   	Katalog-ID (klientorganisation)
   	Prenumerations-ID:t

Linux

name: Run Azure Login with OpenID Connect
on: [push]

permissions:
      id-token: write
      contents: read
      
jobs: 
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
    - name: 'Az CLI login'
      uses: azure/login@v1
      with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
  
    - name: 'Run Azure CLI commands'
      run: |
          az account show
          az group list
          pwd 

Windows

name: Run Azure Login with OpenID Connect and PowerShell
on: [push]

permissions:
  id-token: write
  contents: read
      
jobs: 
  Windows-latest:
    runs-on: windows-latest
    steps:
      - name: OIDC Login to Azure Public Cloud with AzPowershell (enableAzPSSession true)
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} 
          enable-AzPSSession: true

      - name: 'Get resource group with PowerShell action'
        uses: azure/powershell@v1
        with:
          inlineScript: |
            Get-AzResourceGroup
          azPSVersion: "latest"

Du bör se meddelandet Login successful.

Skapa ett huvudnamn för tjänsten

1. Kommentar

   az cloud update -n {environmentName} --endpoint-sql-management https://notsupported

2. Skapa en Azure AD-app och tjänstens huvudnamn i portalen

       az ad sp create-for-rbac --name "myApp" --role contributor \
                                   --scopes /subscriptions/{subscription-id}/resourceGroups/{resource-group} \
                                   --json-auth
   

3. {
       "clientId": "<GUID>",
       "clientSecret": "<GUID>",
       "subscriptionId": "<GUID>",
       "tenantId": "<GUID>",
       (...)
   }
   

1. Gå till GitHub-lagringsplatssidan.

2. I navigeringsmenyn går du till InställningarDetaljer.

3. 

6. Välj Add secret (Lägg till hemlighet).

on: [push]

name: AzureLoginSample

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Log in with Azure
        uses: azure/login@v1
        with:
          creds: '${{ secrets.AZURE_CREDENTIALS }}'

on: [push]

name: AzureLoginSample

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Log in with Azure
        uses: azure/login@v1
        with:
          creds: '${{ secrets.AZURE_CREDENTIALS }}'
          enable-AzPSSession: true
      - name: Azure PowerShell Action
        uses: Azure/powershell@v1
        with:
          inlineScript: Get-AzResourceGroup -Name "< YOUR RESOURCE GROUP >"
          azPSVersion: "latest"

on: [push]

name: AzureLoginSample

jobs:
build-and-deploy:
  runs-on: ubuntu-latest
  steps:

    - name: Log in with Azure
      uses: azure/login@v1
      with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

    - name: Azure CLI script
      uses: azure/CLI@v1
      with:
          azcliversion: 2.0.72
          inlineScript: |
            az account show
            az storage -h

   - name: Login to Azure US Gov Cloud with CLI
     uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_US_GOV_CREDENTIALS }}
          environment: 'AzureUSGovernment'
          enable-AzPSSession: false
   - name: Login to Azure US Gov Cloud with Az Powershell
      uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_US_GOV_CREDENTIALS }}
          environment: 'AzureUSGovernment'
          enable-AzPSSession: true

Använda med andra Azure-tjänster

Microsoft Entra-ID

Power BI

Anslutningar

• Vanliga frågor och svar rörande anpassade anslutningsprogram för Azure Logic Apps, Power Automate och Power Apps

Azure Databricks

Distribuera till Azure från GitHub