Answered

Securely storing account password for PowerShell running in PAD

(0) Share

Report

Posted on by Ukiman1014

For reasons too long to explain in this post, a PowerShell script I'm running in an unattended PAD flow must log in as another user account for a portion of the script. I used ConvertTo-SecureString to obfuscate the password and store it in a text file (see this article). To keep the file off of local machines, I was hoping to store it only in the OneDrive of the PAD user account. Unfortunately, using the Read file content (OneDrive for Business) action did not work, as it reads the contents in as binary. I also tried using the Read text from file action, but for some reason that was not working either. The only thing that would work is the Get-Content PowerShell command. My concern is that text file will now need to be present on any machine on which the PAD flow will need to run.

Is there a better, and more secure, way to do this?

Categories:

Power Automate Desktop

I have the same question (0)

All responses (3)

Answers (2)

Sort by

Verified answer

Agnius Bartninkas Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

If you want to use the Get file content action under he OneDrive for Business connector, you should then use Convert binary data to file afterwards to save it as a local file, then Read text from file from the local file, and then Delete file(s) to delete the file from the local machine. It's a funky workaround for the solution you're thinking of.

A more secure way could be using Azure Key Vault (adds extra cost) and getting the credential via the cloud flow, and then passing it as an input variable to the desktop flow when you launch it. You can make the variables sensitive, so as not to log them in the run action details in the cloud portal.

-------------------------------------------------------------------------
If I have answered your question, please mark it as the preferred solution. If you like my response, please give it a Thumbs Up.

I also provide paid consultancy and development services using Power Automate. If you're interested, DM me and we can discuss it.

Was this reply helpful? Yes No
Verified answer

Ukiman1014 on at

Like
a
(0)

Report
Copy link

Link copied!

I ended up using Azure Key Vault to store the password - works great! The only downside is I have to use an account that has access to premium connectors. I'm able to pull the value from the vault, then pass it to Power Automate Desktop and finally to a PowerShell script. Much better than having to store it in a text file somewhere, even if it is obfuscated.

Was this reply helpful? Yes No
Agnius Bartninkas Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

Since I suggested that, I kind of feel like my answer deserves to also be marked as the solution (gets me some karma points).

But the important thing is that you made it work for you. Great job!

Was this reply helpful? Yes No