Managed Identity UAMI: Graph PowerShell Authentication

Introduction: SAMI vs UAMI in Azure Automation

When automating Microsoft 365 tasks via Azure Automation, authentication is central to the solution. The most common approach relies on System Assigned Managed Identities (SAMI): simple to configure, they are created and managed automatically by Azure with a direct link to an automation account. However, this exclusive binding is also their main limitation.

In complex environments — multiple automation accounts, multiple Azure subscriptions, or resources such as Logic Apps, Function Apps or virtual machines — User Assigned Managed Identity (UAMI) emerges as a more flexible and robust alternative. Unlike a SAMI, a UAMI is an independent Azure object, reusable across multiple resources, and whose lifecycle is not tied to a specific automation account.

This article details step-by-step configuration of a UAMI, assignment of Microsoft Graph permissions, and its integration into a PowerShell runbook.

Comparison of SAMI and UAMI

Before proceeding with configuration, it is useful to understand the structural differences between the two types of managed identities.

Creating a User Assigned Managed Identity

Creating a UAMI is done directly from the Azure portal.

Assigning Microsoft Graph Permissions to the UAMI

Like any managed identity, a UAMI has a service principal visible in the enterprise applications of the Entra admin center. Assignment of App Roles (application permissions) of the Microsoft Graph API cannot be performed through the Entra graphical interface: it must be done via PowerShell with the Microsoft Graph PowerShell SDK module.

PowerShell Script for Graph Permission Assignment

The following script illustrates the assignment of AuditLog.Read.All, User.Read.All, and GroupMember.Read.All permissions to a UAMI named UAMI2.

Step 1 — Retrieve service principals

1# Retrieve the service principal of the UAMI
2$TargetSP = Get-MgServicePrincipal -Filter "displayName eq 'UAMI2'"
3 
4# Retrieve the service principal of Microsoft Graph
5$GraphApp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"

Step 2 — Define permissions to assign

1$GraphPermissions = @(
2    "AuditLog.Read.All",
3    "User.Read.All",
4    "GroupMember.Read.All"
5)

Step 3 — Assign App Roles via New-MgServicePrincipalAppRoleAssignment

1ForEach ($GraphPermission in $GraphPermissions) {
2 
3    $AppRole = $GraphApp.AppRoles | Where-Object {
4        $_.Value -eq $GraphPermission -and
5        $_.AllowedMemberTypes -contains "Application"
6    }
7 
8    If ($AppRole) {
9        Try {
10            $Assignment = @{
11                PrincipalId = $TargetSP.Id
12                ResourceId  = $GraphApp.Id
13                AppRoleId   = $AppRole.Id
14            }
15 
16            $Status = New-MgServicePrincipalAppRoleAssignment `
17                -ServicePrincipalId $TargetSP.Id `
18                -BodyParameter $Assignment `
19                -ErrorAction Stop
20 
21            Write-Host ("Permission '{0}' assigned to '{1}' successfully." -f $AppRole.DisplayName, $TargetSP.DisplayName)
22        }
23        Catch {
24            Write-Host "Failed to assign permission: $GraphPermission"
25        }
26    } Else {
27        Write-Host "Permission not found in Graph service principal: $GraphPermission"
28    }
29}

Linking the UAMI to an Azure Automation Account

Unlike a SAMI, a UAMI is not automatically associated with an automation account. This linking step is essential and often forgotten during initial setup.

Authentication in a Runbook with a UAMI

Syntax Difference with a SAMI

Authentication via a SAMI boils down to a single command:

1# Authentication with a SAMI
2Connect-MgGraph -Identity

For a UAMI, it is necessary to specify the Client ID so that Azure identifies which identity to use:

1# Authentication with a UAMI
2Connect-MgGraph -Identity -ClientId "<client-id-of-the-uami>"

Complete Runbook Example with Dynamic Client ID Retrieval

The recommended approach is to store the Client ID in an Azure Automation variable and retrieve it dynamically via Get-AutomationVariable. This avoids any hardcoding in the script.

1# Retrieve the Client ID from an Azure Automation variable
2$UamiAppId = Get-AutomationVariable -Name "UAMIAppId"
3 
4# Connect to Azure Resource Manager (optional depending on runbook needs)
5Connect-AzAccount -Identity -AccountId $UamiAppId
6Get-AzContext
7 
8# Connect to Microsoft Graph via the UAMI
9Connect-MgGraph -Identity -ClientId $UamiAppId -NoWelcome
10 
11Write-Host "Connection to Microsoft Graph established with UAMI: $UamiAppId"
12 
13# Example usage: retrieve users
14Get-MgUser | Select-Object DisplayName

PowerShell Module Compatibility with Managed Identities

Most Microsoft 365 PowerShell modules support authentication via managed identities. Here is a summary:

• ✅ Microsoft Graph PowerShell SDK — full support
• ✅ Az PowerShell — full support
• ✅ Exchange Online Management Module — support via Entra role
• ✅ Microsoft Teams PowerShell — full support
• ⚠️ SharePoint Online PnP PowerShell — partial support, needs testing
• ❌ SharePoint Online Management Shell — not natively supported

When to Choose a UAMI Over a SAMI?

The choice between SAMI and UAMI depends mainly on the architecture of your Azure tenant. Here are the criteria to consider:

Choose a SAMI if:

• Your tenant uses a limited number of automation accounts
• Configuration simplicity is a priority
• The identity is not intended to be shared across multiple resources

Choose a UAMI if:

• Multiple automation accounts need to share the same identity
• You use various Azure resources (Logic Apps, Function Apps, VMs)
• You want to decouple the lifecycle of identities from that of resources
• Cost management is distributed across multiple operational units with separate subscriptions

References and Additional Resources

• Overview of Managed Identities — Microsoft Learn
• New-MgServicePrincipalAppRoleAssignment — Cmdlet Documentation
• Azure Automation Authentication with Managed Identity
• Microsoft Graph PowerShell SDK — Authentication
• Microsoft Graph Permissions Reference