PowerShell - Connecting to Azure Active Directory using Microsoft Account PowerShell - Connecting to Azure Active Directory using Microsoft Account powershell powershell

PowerShell - Connecting to Azure Active Directory using Microsoft Account


(Updated 2018-04-23 to clarify how to do this with AzureAD (v2) module.)

The AzureAD (v2) PowerShell module accepts the ‑TenantId parameter in Connect‑AzureAD, which can be either the Guid tenant ID, or any verified domain name in the Azure AD tenant. Doing so will allow you to sign in using an external account (e.g. you personal Microsoft account, or a work or school account from another Azure AD tenant, as long as this account was previously invited into the tenant):

Connect-AzureAD -TenantId "contoso.com"

The MSOnline (v1) module does not have an equivalent parameter, but it does accept ‑AdGraphAccessToken and ‑MsGraphAccessToken, which are access tokens to the Azure AD Graph API (https://graph.windows.net) and the Microsoft Graph API (https://graph.microsoft.com), respectively. Though you can use ADAL (for example) to obtain these access tokens for your specific tenant (which allows you to use external users), it's probably simpler to just create a "local" account to your Azure AD tenant for this.

Signing in to AAD PowerShell with a Microsoft Account is not currently supported. Your approach (make a new user that is "native" to the directory) is the way to go.


For those that run across this question in the future, the previous answer still appears to be correct. Basically, you have to create a new account that is native to the directory. This account can be used to login when running connect-msolservice in PowerShell, and then you can run set-msoluser to convert the user from "Guest" to "Member".

The following blog post has detailed step-by-step directions to do this. Note that you need to follow the Appendix first if your Global Admin account is not a work or school account. Also, I've added a few important details in the Comments section of the blog post.

https://blogs.msdn.microsoft.com/dstfs/2015/12/23/issues-with-azure-active-directory-guest-users-in-aad-backed-visual-studio-team-services-accounts/

For reference, a similar problem and resolution using set-msoluser can be found in this forum post:https://social.msdn.microsoft.com/Forums/azure/en-US/469baa2d-7ff1-4e17-a8f0-f257cbdbf50b/cannot-see-the-active-directory-item-in-the-azure-portal?forum=WindowsAzureAD