Comments (5)
M365DSC supports authentication with a service principal. This is the most versatile option in automation scenarios. Please make sure to secure your secrets and environments properly ( e.g. comparable to a domain controller).
-
LCM needs access to the certificate as soon as operations are triggered: verification of a configuration.
-
The whitepaper got published in November 22. By now, there were plenty updates in M365DSC. The support for SP improved a lot and there are only a few resources left that do not fully support SPs.
-
In such a multi tenant scenario with a multi tenant application would be the easiest option and needs to be verified if it will work across all services.
from microsoft365dsc.
In our case we use service principals secured by a certificate. We store the certificate in a Key Vault. The creation of the app and related infrastructure for the certificates is managed through Terraform. The other reason we use this approach is we can be granular with the perms we request (i.e, we don't use global admin but use the relevant API permissions).
from microsoft365dsc.
@GeldHades27355 We are doing it pretty much the same way as @adhodgson1, but with Bicep instead of Terraform. For more granular authentication, we have different service principals for different workloads, so that one compromised service principal is not able to compromise the entire company (although it could still do a lot of damage).
from microsoft365dsc.
Thanks for sharing.
In our case different service principals would easily escalate to hundreds of not thousands with a few hundred clients. And certificates... But yeah, makes sense.
So what do bicep and terraform add that wouldn't already work using vanilla M365DSC and Azure DevOps?
from microsoft365dsc.
@GeldHades27355 Terraform and Bicep are tools to manage the state of your infrastructure, in my case that's the management of the service principals, certificates, Key Vault, Automation Account and more. Azure DevOps is the "pipeline" mechanism that executes the infrastructure management (in my company, we're using GitLab) and more.
The usage of infrastructure management tools like Terraform and / or Bicep is only necessary if you want a "configuration-as-code" approach, where you define in code how your environment is supposed to look like and the tools then apply that configuration. You're totally fine with running Azure DevOps with vanilla M365DSC. Don't sweat too much about it.
from microsoft365dsc.
Related Issues (20)
- Export-M365DSCConfiguration - System.Management.Automation.RuntimeException: You cannot call a method on a null-valued expression. HOT 3
- Examples of M365 DSC Blueprints HOT 5
- While Exporting Configuration of Planner | It return an empty .ps1 File HOT 2
- Issue when sync conditional access policy HOT 7
- O365OrgSettings: Fix: Boolean Parameters default to false if not specified in configuration
- Composite resources at component level for devops HOT 1
- composite resource structure at component level (instead of workload level), for Devops HOT 2
- SPOTenantSettings: Failing to deploy or test the resource's state with latest Graph version HOT 27
- Partial Export was saved at... HOT 2
- ENHANCEMENT / FEATURE REQUEST - Filter on Property HOT 3
- Clarification on Setting Execution Policy for Microsoft 365 DSC HOT 2
- NewResourceName: Intune Apple iPadOS/iOS Device feature policies
- NewResourceName: Intune Apple custom iPadOS/iOPS device configuration profiles
- IntuneApplicationControlPolicyWindows10: App Control for Business (preview) policies are not in the export.
- Assert-M365DSCBlueprint Not Reporting Missing Included Roles HOT 1
- AADUser resource incomplete HOT 1
- SCDLPComplianceRule: Attributes are missing when exporting HOT 1
- Problem with uploading exchange configuration
- C'est
- Can event log be disabled when use DSC? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from microsoft365dsc.