Tip: Read the ‘Important Notes’ section, because these are notes that are important.
1. Optimize Authentication Requests
- What: Check for Existing Authentication Contexts before Repeating
- How: Use Connection Context output
- Why: Avoid repetitive, unnecessary authentication
- Where: Your script code, Azure Automation Runbooks
- When: Right now
Most API’s provide return data or establish a “context” once you complete the authentication process. When using cmdlets like Connect-AzAccount, Connect-Entra, Connect-ExchangeOnline, Connect-MicrosoftTeams, Connect-MgGraph, Connect-PnPOnline, and so on, you can either redirect the output of these to a variable, or use a context function to fetch them.
Why? If you run the same script or code block repeatedly, and it prompts for authentication every time, it not becomes a hassle, but it can waste time. How much this factors into time savings will depend on your environment(s) and usage patterns. Consider the following code example:
# Comment heading, because you always have one, right?
Connect-AzAccount # will force authentication every time
# ...more code...
Each time you run that, it will prompt for the Azure authentication. A small change can make it so you only get prompted the first time…
if (-not (Get-AzContext)) {
# will only get invoked when there is no existing context
Connect-AzAccount
}
If you happen to work with multiple tenants, you may want to add a check for the specific tenant ID as well…
$tenantId = "your_kickass_tenant_id"
if ((Get-AzContext).Tenant.Id -ne $tenantId) {
# only invoked if context doesn't match or there is no context
Connect-AzAccount -Tenant $tenantId
}
More examples…
$tenantId = "your_kickass_tenant_id"
if ((Get-EntraContext).TenantId -ne $tenantId) {
# only invoked when you haven't had coffee
Connect-Entra -Tenant $tenantId
}
if ((Get-MgContext).TenantId -ne $tenantId) {
# only invoked when you're paying attention, same kick-ass Tenant Id most likely
Connect-MgGraph -TenantId $tenantId -NoWelcome
}
$spoSiteUrl = "your_kickass_sharepoint_online_site_url"
if ((Get-PnPContext).Url -ne $spoSiteUrl) {
# only invoked when you first connect to your kick-ass sharepoint site
Connect-PnPOnline -Url $spoSiteUrl -Interactive
}
You can also use Get-PnPConnection as an alternative. The MicrosoftTeams module doesn’t have a context-related cmdlet that I know of, which kind of sucks, like a broken vacuum cleaner. But life isn’t all bad.
2. Avoid Re-typing Credentials
- What: Avoid Re-entering Passwords, Tenant and Subscription IDs
- How: Store Credentials, Tenant ID’s, Subscription ID’s in Secret Vaults
- Why: To reduce mistakes, limit security exposure
- Where: On your computer, in Azure KeyVaults, or Azure Automation Credentials and Variables
- When: As soon as possible
You may have noticed that some of the examples above define $tenantId or $spoSiteUrl. You may be doing this with other things like subscription Id’s, resource groups, usernames, and more. This is VERY BAD – Do NOT do that!
Any sensitive values should be stored securely so that if your scripts land in the wrong hands, they don’t hand the keys to your stolen car.
If you’re using any of the PowerShell Connect- functions that support a -Credential parameter, you can save a little time by feeding that from a credential vault. One simple way to do this is with the SecretManagement module. This works with various credential vaults like Windows Credential Manager, LastPass, 1Password, BitWarden and more.
Note: This does not circumvent safety controls like Entra Privileged Identity Management (PIM)
$myCredential = Get-Secret -Name AzureLogin123 -Vault PersonalVault
3. Suppress Unwanted Noise
- What: Disable or reduce unneeded output
- How: Use parameters like
-NoWelcome,-WarningAction SilentlyContinue,Out-Null(or$null = ...) - Why: Clean output reduces processing overhead and avoids pipeline noise
- Where: Every Connect- cmdlet or function that returns noisy output that you aren’t putting to use.
- When: Always
Each time you connect to Microsoft Graph, it displays a welcome message that looks like the top half of a CVS receipt, only without coupons. There’s a marketing tip for Microsoft: Inject coupon codes in your API connection responses. You’re welcome.
You will also see: “NOTE: You can use the -NoWelcome parameter to suppress this message.” So, guess what: You can add -NoWelcome to quiet it down. They don’t have a -STFU parameter, but you could always wrap that yourself.
In addition to benign output, there are situations where even Warning output can make things messy. For example, within Azure Automation Runbooks, if you have output sent to a Log Analytics Workspace, the Warning output stream doesn’t need idiotic boy-who-cried-wolf warnings filling up your logs.
Some modules have their own special kind of noise, like the PnP.PowerShell module. For this one to STFU you set a variable prior to using it:
$env:PNPPOWERSHELL_UPDATECHECK = "false"Important Notes
These notes are important.
- As with any PowerShell content, things will change over time and some parameters may be added, replaced or removed. The examples provided herein, forthwith, notwithstanding and ipso facto, lorem ipsum are semi-valid as of 2025, December 29, anno domini, 12:25:32 PM Eastern Standard Time, planet Earth, Solar System 423499934.
- Never run any script code, provided by humans, reptiles or AI services, in any production environment without thoroughly testing in non-production environments. Unless of course, you just don’t care about being fired or sued, or sent to a torture facility in El Salvadore.
- References to trademark names like CVS are coincidental and imply no sponsorship, condonement, favor, agreements, contracts, eye winks, strange head nods, or thumbs-up gestures from either party. And who has time for parties. Anyhow, I have a prescription to pick up at CVS.
- If you don’t care for humor, that’s okay. Neither do I.
Skatterbrainz Blog 
You must be logged in to post a comment.