The concept behind having a token expire is by far the most secure option. I think it is a good balance between security and convenience, and I would have been concerned if Azure had implemented it any other way. However, if you're on a machine that you have complete trust of there are easier, more convenient ways.
The easiest method you can use is to use ConvertTo-SecureString
to create a secure string that you can store locally to disk. That way instead of logging into Azure with a token obtained from your credentials you simply log in with your credentials every time. The downside of this is that it will only work on the same computer, you can't transfer the credential file to another computer. You would need to create a new credential file on each machine.
#Write password out to disk
"password" | ConvertTo-SecureString -AsPlainText -Force |
ConvertFrom-SecureString |
Out-File E:\ps\tmp\test.txt
#Read Password from disk, convert to securestring, store in variable.
$secureStringPassword = Get-Content E:\ps\tmp\test.txt |
ConvertTo-SecureString
#Create credential with secure string,
$cred = new-object -typename System.Management.Automation.PSCredential `
-argumentlist "[email protected]", $secureStringPassword
#login with those credentials
Add-AzureRmAccount -Credential $cred
This is a much simplified version of the distributed version I created here
It is possible to create a certificate login for Azure, but that is a considerably more involved process to implement, and is much harder to revoke. With this solution a password change will stop the whole thing from working.