Authentication_MissingOrMalformedMessage When Getting A User in an Azure Powershell Function

Question

I am currently writing an Azure Powershell function to reset an AD Users password.
I have a Registered App with the Microsoft Graph User.ReadWrite.All and UserAuthenticationMethod.ReadWrite.All permissions.

I am trying to connect to Azure Active Directory using the app with the following code.

$AzurePassword = ConvertTo-SecureString $ApplicationSecret -AsPlainText -Force
$ADCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $ApplicationId, $AzurePassword
Connect-AzAccount -TenantId $TenantId -Credential $ADCredential -ServicePrincipal
$aadToken = Get-AzAccessToken -Resource "https://graph.windows.net/"
Connect-AzureAD -AadAccessToken $aadToken -AccountId $ApplicationId -TenantId $TenantId

The above code doesn't error, but as soon as I try to retrieve a user I get an error.

$User = Get-AzureADUser -ObjectId $Email

The error...

2021-05-15T14:00:28.385 [Error] ERROR: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedOriginInfo            : localhostException             :Type                           : System.Management.Automation.RemoteExceptionSerializedRemoteException      : Microsoft.Open.AzureAD16.Client.ApiException: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: Completedat Microsoft.Open.AzureAD16.Client.Configuration.<>c.<.cctor>b__47_0(String methodName, IRestResponse response) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Client\Configuration.cs:line 188at Microsoft.Open.AzureAD16.Api.UserApi.GetUserWithHttpInfo(String tenantId, String objectId, String authorization, String cmdletName, String clientRequestId, String apiVersion, Nullable`1 all, Nullable`1 top, String skiptoken, String filter, String orderby) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Api\UserApi.cs:line 2154at Microsoft.Open.AzureAD16.PowerShell.GetUser.ProcessRecord() in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.PowerShell\AzureAD16.PowerShell.AutoGen\API\UserApi.cs:line 258at System.Management.Automation.CommandProcessor.ProcessRecord()SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfoErrorRecord                    :Exception             :Type                           : System.Management.Automation.RemoteExceptionSerializedRemoteException      : Microsoft.Open.AzureAD16.Client.ApiException: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: Completedat Microsoft.Open.AzureAD16.Client.Configuration.<>c.<.cctor>b__47_0(String methodName, IRestResponse response) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Client\Configuration.cs:line 188at Microsoft.Open.AzureAD16.Api.UserApi.GetUserWithHttpInfo(String tenantId, String objectId, String authorization, String cmdletName, String clientRequestId, String apiVersion, Nullable`1 all, Nullable`1 top, String skiptoken, String filter, String orderby) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Api\UserApi.cs:line 2154at Microsoft.Open.AzureAD16.PowerShell.GetUser.ProcessRecord() in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.PowerShell\AzureAD16.PowerShell.AutoGen\API\UserApi.cs:line 258at System.Management.Automation.CommandProcessor.ProcessRecord()SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfoErrorRecord                    :Exception             :Type                           : System.Management.Automation.RemoteExceptionSerializedRemoteException      : Microsoft.Open.AzureAD16.Client.ApiException: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: Completedat Microsoft.Open.AzureAD16.Client.Configuration.<>c.<.cctor>b__47_0(String methodName, IRestResponse response) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Client\Configuration.cs:line 188at Microsoft.Open.AzureAD16.Api.UserApi.GetUserWithHttpInfo(String tenantId, String objectId, String authorization, String cmdletName, String clientRequestId, String apiVersion, Nullable`1 all, Nullable`1 top, String skiptoken, String filter, String orderby) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Api\UserApi.cs:line 2154at Microsoft.Open.AzureAD16.PowerShell.GetUser.ProcessRecord() in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.PowerShell\AzureAD16.PowerShell.AutoGen\API\UserApi.cs:line 258at System.Management.Automation.CommandProcessor.ProcessRecord()SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfoErrorRecord                    :Exception             :Type                           : System.Management.Automation.RemoteExceptionSerializedRemoteException      : Microsoft.Open.AzureAD16.Client.ApiException: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: Completedat Microsoft.Open.AzureAD16.Client.Configuration.<>c.<.cctor>b__47_0(String methodName, IRestResponse response) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Client\Configuration.cs:line 188at Microsoft.Open.AzureAD16.Api.UserApi.GetUserWithHttpInfo(String tenantId, String objectId, String authorization, String cmdletName, String clientRequestId, String apiVersion, Nullable`1 all, Nullable`1 top, String skiptoken, String filter, String orderby) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Api\UserApi.cs:line 2154at Microsoft.Open.AzureAD16.PowerShell.GetUser.ProcessRecord() in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.PowerShell\AzureAD16.PowerShell.AutoGen\API\UserApi.cs:line 258at System.Management.Automation.CommandProcessor.ProcessRecord()SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfoErrorRecord                    :Exception             :Type                           : System.Management.Automation.RemoteExceptionSerializedRemoteException      : Microsoft.Open.AzureAD16.Client.ApiException: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: Completedat Microsoft.Open.AzureAD16.Client.Configuration.<>c.<.cctor>b__47_0(String methodName, IRestResponse response) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Client\Configuration.cs:line 188at Microsoft.Open.AzureAD16.Api.UserApi.GetUserWithHttpInfo(String tenantId, String objectId, String authorization, String cmdletName, String clientRequestId, String apiVersion, Nullable`1 all, Nullable`1 top, String skiptoken, String filter, String orderby) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Api\UserApi.cs:line 2154at Microsoft.Open.AzureAD16.PowerShell.GetUser.ProcessRecord() in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.PowerShell\AzureAD16.PowerShell.AutoGen\API\UserApi.cs:line 258at System.Management.Automation.CommandProcessor.ProcessRecord()SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfoErrorRecord                    : …Message                        : Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedHResult                        : -2146233087CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiExceptionFullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUserMessage                        : Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedHResult                        : -2146233087CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiExceptionFullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUserMessage                        : Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedHResult                        : -2146233087CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiExceptionFullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUserMessage                        : Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedHResult                        : -2146233087CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiExceptionFullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUserMessage                        : Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedHResult                        : -2146233087CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiExceptionFullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUserMicrosoft.Azure.WebJobs.Script.Workers.Rpc.RpcException : Result: ERROR: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedOriginInfo            : localhostException             :Type                           : System.Management.Automation.RemoteExceptionSerializedRemoteException      : Microsoft.Open.AzureAD16.Client.ApiException: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: Completedat Microsoft.Open.AzureAD16.Client.Configuration.<>c.<.cctor>b__47_0(String methodName, IRestResponse response) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Client\Configuration.cs:line 188at Microsoft.Open.AzureAD16.Api.UserApi.GetUserWithHttpInfo(String tenantId, String objectId, String authorization, String cmdletName, String clientRequestId, String apiVersion, Nullable`1 all, Nullable`1 top, String skiptoken, String filter, String orderby) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Api\UserApi.cs:line 2154at Microsoft.Open.AzureAD16.PowerShell.GetUser.ProcessRecord() in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.PowerShell\AzureAD16.PowerShell.AutoGen\API\UserApi.cs:line 258at System.Management.Automation.CommandProcessor.ProcessRecord()SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfoErrorRecord                    :Exception             :Type                           : System.Management.Automation.RemoteExceptionSerializedRemoteException      : Microsoft.Open.AzureAD16.Client.ApiException: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: Completedat Microsoft.Open.AzureAD16.Client.Configuration.<>c.<.cctor>b__47_0(String methodName, IRestResponse response) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Client\Configuration.cs:line 188at Microsoft.Open.AzureAD16.Api.UserApi.GetUserWithHttpInfo(String tenantId, String objectId, String authorization, String cmdletName, String clientRequestId, String apiVersion, Nullable`1 all, Nullable`1 top, String skiptoken, String filter, String orderby) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Api\UserApi.cs:line 2154at Microsoft.Open.AzureAD16.PowerShell.GetUser.ProcessRecord() in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.PowerShell\AzureAD16.PowerShell.AutoGen\API\UserApi.cs:line 258at System.Management.Automation.CommandProcessor.ProcessRecord()SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfoErrorRecord                    :Exception             :Type                           : System.Management.Automation.RemoteExceptionSerializedRemoteException      : Microsoft.Open.AzureAD16.Client.ApiException: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: Completedat Microsoft.Open.AzureAD16.Client.Configuration.<>c.<.cctor>b__47_0(String methodName, IRestResponse response) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Client\Configuration.cs:line 188at Microsoft.Open.AzureAD16.Api.UserApi.GetUserWithHttpInfo(String tenantId, String objectId, String authorization, String cmdletName, String clientRequestId, String apiVersion, Nullable`1 all, Nullable`1 top, String skiptoken, String filter, String orderby) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Api\UserApi.cs:line 2154at Microsoft.Open.AzureAD16.PowerShell.GetUser.ProcessRecord() in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.PowerShell\AzureAD16.PowerShell.AutoGen\API\UserApi.cs:line 258at System.Management.Automation.CommandProcessor.ProcessRecord()SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfoErrorRecord                    :Exception             :Type                           : System.Management.Automation.RemoteExceptionSerializedRemoteException      : Microsoft.Open.AzureAD16.Client.ApiException: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: Completedat Microsoft.Open.AzureAD16.Client.Configuration.<>c.<.cctor>b__47_0(String methodName, IRestResponse response) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Client\Configuration.cs:line 188at Microsoft.Open.AzureAD16.Api.UserApi.GetUserWithHttpInfo(String tenantId, String objectId, String authorization, String cmdletName, String clientRequestId, String apiVersion, Nullable`1 all, Nullable`1 top, String skiptoken, String filter, String orderby) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Api\UserApi.cs:line 2154at Microsoft.Open.AzureAD16.PowerShell.GetUser.ProcessRecord() in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.PowerShell\AzureAD16.PowerShell.AutoGen\API\UserApi.cs:line 258at System.Management.Automation.CommandProcessor.ProcessRecord()SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfoErrorRecord                    :Exception             :Type                           : System.Management.Automation.RemoteExceptionSerializedRemoteException      : Microsoft.Open.AzureAD16.Client.ApiException: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: Completedat Microsoft.Open.AzureAD16.Client.Configuration.<>c.<.cctor>b__47_0(String methodName, IRestResponse response) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Client\Configuration.cs:line 188at Microsoft.Open.AzureAD16.Api.UserApi.GetUserWithHttpInfo(String tenantId, String objectId, String authorization, String cmdletName, String clientRequestId, String apiVersion, Nullable`1 all, Nullable`1 top, String skiptoken, String filter, String orderby) in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.Client\Api\UserApi.cs:line 2154at Microsoft.Open.AzureAD16.PowerShell.GetUser.ProcessRecord() in X:\bt\1205398\repo\src\dev\PowerShell.V2\AzureAD16.PowerShell\AzureAD16.PowerShell.AutoGen\API\UserApi.cs:line 258at System.Management.Automation.CommandProcessor.ProcessRecord()SerializedRemoteInvocationInfo : System.Management.Automation.InvocationInfoErrorRecord                    : …Message                        : Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedHResult                        : -2146233087CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiExceptionFullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUserMessage                        : Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedHResult                        : -2146233087CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiExceptionFullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUserMessage                        : Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedHResult                        : -2146233087CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiExceptionFullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUserMessage                        : Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedHResult                        : -2146233087CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiExceptionFullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUserMessage                        : Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedHResult                        : -2146233087CategoryInfo          : NotSpecified: (:) [Get-AzureADUser], ApiExceptionFullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetUserException: Error occurred while executing GetUserCode: Authentication_MissingOrMalformedMessage: Access Token missing or malformed.HttpStatusCode: UnauthorizedHttpStatusDescription: UnauthorizedHttpResponseStatus: CompletedStack:

Using https://jwt.io/ I can see that the access token has the expected appid, tid and aud (https://graph.windows.net/).

I have followed the docs on connecting to AD, I am not to sure why I am getting the error, any help would be appreciated.

Regards,
Richard Tasker

Answer 1

Mostly the root cause of the issue is the token audience. Active Directory Graph service is tenant based and has a different token audience (5% scenario). All other Azure services are subscription based and have the standard token audience (95% scenario). The token that is acquired will work for other Azure Services like webapps, compute, ResourceManager, etc. but not for Graph. Hence you get the above message.

You may also check the permission levels of the account that you are using to connect to the Azure AD Tenant. Try using the credentials for a Global Admin account of the Tenant.