Grrrr DevOps Pipeline... premier gros crash 😤/en

I knew Microsoft had given a warning… but as usual, no one really took it seriously 😅

We work in a fullstack DevOps team, with scripts that call SQL procedures in thousands of Azure SQL databases, whether for maintenance, exports, cleanup… you know, the usual stuff.

And for that, we use the token obtained with the Get-AzAccessToken functionGet-AzAccessToken..

The catch? Microsoft continuously updates their backend. So the Azure Pipeline pool that runs our PowerShell scripts gets updated automatically, without any action on our part.

And this Sunday… boom 💥: they updated the Az.Accounts module from version 4 to 5, with a major breaking change:

   The token is no longer returned as a String, but as a SecureString!

The result? All the older functions that handle these tokens can’t read them anymore, and everything breaks. In production. 😩

Le pire ? Comme tout tourne dans un backend, on ne remonte pas les warnings, donc personne ne l’a vu venir. C’est seulement une fois que les exports sont tombés en erreur qu’on a compris.

🎓 Leçon apprise : ne jamais ignorer les warnings… même s’ils sont planqués dans les logs.

🔧 Fix : il faut ajouter le paramètre -AsPlainText dans certains cas ou revoir complètement la gestion du token selon le module utilisé.

Voici le warning qu’on aurait dû prendre au sérieux :

get-azaccesstoken
WARNING: Upcoming breaking changes in the cmdlet 'Get-AzAccessToken' :
The Token property of the output type will be changed from String to SecureString. Add the [-AsSecureString] switch to avoid the impact of this upcoming breaking change.
- The change is expected to take effect in Az version : '14.0.0'
- The change is expected to take effect in Az.Accounts version : '5.0.0'
Note : https://aka.ms/azps-changewarnings
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">

WorkArround

$azAccountsVersion = (Get-Module -ListAvailable -Name Az.Accounts | Sort-Object Version -Descending | Select-Object -First 1).Version
$dexResourceUrl   = 'https://database.windows.net/'
if ($azAccountsVersion -ge [Version]'5.0.0') {
    write-host  "Az.Accounts 5.0.0 and above"
    $AccessTokenSecure = (Get-AzAccessToken -ResourceUrl $dexResourceUrl).Token
    $token  = ConvertFrom-SecureString -SecureString $AccessTokenSecure -AsPlainText
} else {
    write-host  "Az.Accounts below 5.0.0"
    $token = (Get-AzAccessToken -ResourceUrl $dexResourceUrl).Token
}