Authentication module cmdlets in Microsoft Graph PowerShell
Článek
Microsoft Graph PowerShell supports two types of authentication: delegated and app-only access. There are a number of cmdlets that can be used to manage the different parameters required during authentication, for example, environment, application ID, and certificate. In this article, we look at the different cmdlets that are associated with authentication.
Use Connect-MgGraph
Invoke Connect-MgGraph before any commands that access Microsoft Graph. This cmdlet gets the access token using the Microsoft Authentication Library.
Delegated access
There are three ways to allow delegated access using Connect-MgGraph:
Use interactive authentication, where you provide the scopes that you require during your session:
Use delegated access with a custom application for Microsoft Graph PowerShell
Follow the steps below to create custom applications that you can use to connect to Microsoft Graph PowerShell. Use this approach if you need to isolate and limit the consent permissions granted for Microsoft Graph PowerShell usage.
To use app-only access, you can load the certificate from either Cert:\CurrentUser\My\ or Cert:\LocalMachine\My\, when -CertificateThumbprint or -CertificateName is specified. Make sure that the certificate you're using is present in either certificate store before calling Connect-MgGraph. For more info, see Use app-only authentication with the Microsoft Graph PowerShell SDK.
To use a certificate stored in your machine's certificate store or another location when connecting to Microsoft Graph, specify the certificate's location.
Use client secret credentials
This type of grant will help when you need interactions in the background without a user to sign in. Support for client secret credentials was added by adding -ClientSecretCredential parameter to Connect-MgGraph. See Get-Credential on how to get or create credentials.
PowerShell
# Define the Application (Client) ID and Secret$ApplicationClientId = '<application(client)ID>'# Application (Client) ID$ApplicationClientSecret = '<secret.value>'# Application Secret Value$TenantId = 'Tenant_Id'# Tenant ID# Convert the Client Secret to a Secure String$SecureClientSecret = ConvertTo-SecureString -String$ApplicationClientSecret -AsPlainText -Force# Create a PSCredential Object Using the Client ID and Secure Client Secret$ClientSecretCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList$ApplicationClientId, $SecureClientSecret# Connect to Microsoft Graph Using the Tenant ID and Client Secret CredentialConnect-MgGraph -TenantId$TenantId -ClientSecretCredential$ClientSecretCredential
Poznámka
It's recommended to use PowerShell 7 and above when using client secret credentials.
Use managed identity
A common challenge when writing automation scripts is the management of secrets, credentials, certificates, and keys used to secure communication between services. Eliminate the need to manage credentials by allowing the module to obtain access tokens for Microsoft Entra resources that are protected by Microsoft Entra ID. The identity is managed by the Microsoft Entra platform and does not require you to provision or rotate any secrets.
System-assigned managed identity: Uses an automatically managed identity on a service instance. The identity is tied to the lifecycle of a service instance.
PowerShell
Connect-MgGraph -Identity
User-assigned managed identity: Uses a user created managed identity as a standalone Microsoft Entra resource.
By default, Connect-MgGraph targets the global public cloud. To target other clouds, see Use Get-MgEnvironment.
Connect to an environment as a different identity
To connect as a different identity other than CurrentUser, specify the -ContextScope parameter with the value Process.
PowerShell
Connect-MgGraph -ContextScopeProcess
Use passwordless authentication
Passwordless authentication is a method of verifying a user’s identity without the use of a password. Passwords are a primary attack vector and passwordless authentication is a strategy to mitigate attacks where bad actors use social engineering, phishing, and spray attacks to compromise passwords.
Microsoft Graph PowerShell supports the following passwordless authentication methods:
Windows Hello for Business
Fast ID Online v2.0 (FIDO2)
Microsoft Authenticator app
Certificate-based authentication (CBA)
Poznámka
FIDO2 security keys option is only supported on PowerShell 7 and above.
Once you're signed in, you'll remain signed in until you invoke Disconnect-MgGraph. Microsoft Graph PowerShell automatically refreshes the access token for you and sign-in persists across PowerShell sessions because Microsoft Graph PowerShell securely caches the token.
Use Disconnect-MgGraph to sign out.
PowerShell
Disconnect-MgGraph
Use Get-MgEnvironment
When you use Connect-MgGraph, you can choose to target other environments. By default, Connect-MgGraph targets the global public cloud.
To get a list of all clouds that you can choose from, run:
PowerShell
Get-MgEnvironment
Output
Name AzureADEndpoint GraphEndpoint Type
---- --------------- ------------- ----
China https://login.chinacloudapi.cn https://microsoftgraph.chinacloudapi.cn Built-in
Global https://login.microsoftonline.com https://graph.microsoft.com Built-in
USGov https://login.microsoftonline.us https://graph.microsoft.us Built-in
USGovDoD https://login.microsoftonline.us https://dod-graph.microsoft.us Built-in
To explicitly target other clouds, for example, US Government and Azure China, use the -Environment parameter.
PowerShell
Connect-MgGraph -Environment USGov
Poznámka
Globally registered apps don't replicate to Azure China. You need to register your own applications in Azure China and use them when connecting to Microsoft Graph.
Use Get-MgContext
Get-MgContext is used to retrieve the details about your current session, which include:
Invoke-MgGraphRequest issues REST API requests to the Graph API. It works for any Graph API if you know the REST URI, method, and optional body parameter. This command is especially useful for accessing APIs for which there isn't an equivalent cmdlet yet.
To retrieve the details of the signed-in user, run:
PowerShell
Invoke-MgGraphRequest -Method GET https://graph.microsoft.com/v1.0/me
Output
Name Value
---- -----
userPrincipalName admin@Contoso.com
preferredLanguage en-US
mobilePhone 425-555-0101
displayName MOD Administrator
givenName MOD
mail admin@contoso.com
@odata.context https://graph.microsoft.com/v1.0/$metadata#users/$entity
id 694bab60-392a-4f64-9430-c1dea2951f50
jobTitle
officeLocation
businessPhones {425-555-0100}
surname Administrator
Next steps
For more information about navigating Microsoft Graph PowerShell, see:
Learn how to authenticate users with Microsoft identity platform, configure permissions, and retrieve user data for your Microsoft Teams app using the Microsoft Graph API.