{"id":810,"date":"2023-12-06T08:00:58","date_gmt":"2023-12-06T16:00:58","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/powerplatform\/?p=810"},"modified":"2023-12-06T11:30:18","modified_gmt":"2023-12-06T19:30:18","slug":"power-platform-cli-simplifying-authentication-profiles","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/powerplatform\/power-platform-cli-simplifying-authentication-profiles\/","title":{"rendered":"Power Platform CLI – Simplifying authentication profiles"},"content":{"rendered":"

Good day developers!<\/p>\n

Power Platform CLI<\/a> is a one stop command line interface to interact with Power Platform – aka PAC CLI.<\/p>\n

We have 3 different kinds of authentication profiles. In the version 1.16 of PAC CLI, we started to deprecate the parameter --kind<\/code> and since then, UNIVERSAL is the default profile kind.<\/p>\n

In this post, I will explain why we have different authentication profile kind, what is the intention of each type and what kind of profile you should use.<\/strong><\/p>\n

\ud83d\udca1 What is an authentication profile?<\/h2>\n

Before you can create environments on Power Platform admin center<\/a>, or create apps on Power Apps<\/a>, you need to authenticate. PAC CLI is not different. By using 'pac auth'<\/code> command you can store, update and delete authentication profiles in your computer.<\/p>\n

If you don’t have an authentication profile, the first time you run any pac<\/code> command that requires one, if you are using windows and logged using an AAD account associated to Power Platform, a new Universal authentication profile will be create for you.<\/p>\n

If you are using it anywhere else, or if you want to use a different account, you can use 'pac auth create'<\/code>. A browser will open, so you can select your account to login. If you are using GitHub Codespaces, you will get the equivalent of --deviceCode<\/code> parameter. Yes, there are quite a few parameters you can use.<\/p>\n

\n

To see all parameter available, you can use pac auth create help<\/a><\/p>\n<\/blockquote>\n

\"Image
‘pac auth create’ parameters.<\/figcaption><\/figure><\/p>\n

Let’s dig deeper on the --kind<\/code> parameter, and why we are deprecating it.<\/p>\n

\ud83d\udca1 Why we have authentication profile kind?<\/h2>\n

The short answer is, for historical reasons.<\/p>\n

With pac cli, you can run commands that will perform ‘ADMIN’ operations. List environments, create environments, list tenant settings. In this scenario, it is irrelevant what is my active environment (I might not have one). This is where an ‘ADMIN’ kind of profile is used.<\/p>\n

\"Creation
Creating an “ADMIN” kind authentication profile.<\/figcaption><\/figure><\/p>\n

There are some commands that will require an active environment. If I only have one ‘ADMIN’ profile and try to run the command 'pac org who'<\/code>, I will get the error bellow:

\"Error:
Error: No auth profiles were found on this computer. Please run ‘pac auth create’ to create one.<\/figcaption><\/figure><\/p>\n

That’s where I would need to create an authentication profile with an active environment. This is the ‘DATAVERSE’ kind.

\"Dataverse
Creating a “Dataverse” kind authentication profile<\/figcaption><\/figure><\/p>\n

Now I have two profiles – one to perform admin operations, and another to perform actions in a specific Dataverse environment.<\/p>\n

\ud83d\udc69\u200d\ud83d\udcbb The UNIVERSAL profile<\/h2>\n

To simplify, we created the UNIVERSAL profile. We can infer what kind of profile you need to use based on the context.<\/p>\n

When you use 'pac auth create'<\/code>, the active environment will be your default environment. You can use the parameter --environment<\/code> to specify the active environment.<\/p>\n

To change the active environment of your current UNIVERSAL profile, use 'pac env select'<\/code>.

\"Creating
Creating universal authentication profile and changing active environment.<\/figcaption><\/figure><\/p>\n

In the current pac cli version, you still can use –kind parameter to create ADMIN and DATAVERSE profiles. The parameter –url still creates a Dataverse profile by default. This will change. Moving forward, we will ALWAYS use UNIVERSAL profiles.<\/strong> Other profiles will still work (we don’t want to break any current usage), but we will make it harder to create any other type than UNIVERSAL.<\/p>\n

The guidance is: Always use UNIVERSAL profiles.<\/strong> There’s no reason to use any other kind. Another important consideration is, avoid using different kinds of authentication profile in the same environment<\/strong>. \u00a0If you mix different profile types, you can have 3 active profiles at the same time, like the example bellow.<\/p>\n

\"Image
Authentication profiles<\/figcaption><\/figure><\/p>\n

In this scenario, you can have unexpected results because you have a DATAVERSE profile connected to the “Test” environment, and a UNIVERSAL profile connected to the “Personal Productivity” environment. It is hard to tell which profile a given command will use if you don’t explicitly specify an environment.<\/p>\n

\ud83d\udd26 Summary<\/h2>\n
    \n
  • Always use UNIVERSAL kind for authentication profiles.<\/li>\n
  • Avoid having different authentication kinds in the same environment.<\/li>\n
  • Use ‘pac auth clear’ if you want to clear all authentication profiles from your computer.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

    Good day developers! Power Platform CLI is a one stop command line interface to interact with Power Platform – aka PAC CLI. We have 3 different kinds of authentication profiles. In the version 1.16 of PAC CLI, we started to deprecate the parameter –kind and since then, UNIVERSAL is the default profile kind. In this […]<\/p>\n","protected":false},"author":125432,"featured_media":902,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[11],"class_list":["post-810","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-powerplatform","tag-cli"],"acf":[],"blog_post_summary":"

    Good day developers! Power Platform CLI is a one stop command line interface to interact with Power Platform – aka PAC CLI. We have 3 different kinds of authentication profiles. In the version 1.16 of PAC CLI, we started to deprecate the parameter –kind and since then, UNIVERSAL is the default profile kind. In this […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/powerplatform\/wp-json\/wp\/v2\/posts\/810","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/powerplatform\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/powerplatform\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powerplatform\/wp-json\/wp\/v2\/users\/125432"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powerplatform\/wp-json\/wp\/v2\/comments?post=810"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/powerplatform\/wp-json\/wp\/v2\/posts\/810\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powerplatform\/wp-json\/wp\/v2\/media\/902"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/powerplatform\/wp-json\/wp\/v2\/media?parent=810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powerplatform\/wp-json\/wp\/v2\/categories?post=810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powerplatform\/wp-json\/wp\/v2\/tags?post=810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}