Connect-MgGraph : ClientCertificateCredential authentication failed: Retry failed after 4 tries.

Question

Hello,

When I try to execute a simple powershell script which tries to authenticate via Connect-MgGraph:

$Appid="..."
$tenantId="..."
$certthumb="..."
Connect-MgGraph -ClientId $Appid -TenantId $tenantId -CertificateThumbprint $certthumb -NoWelcome
 
Get-MgUser -All | Select-Object DisplayName, UserPrincipalName, @{
    Name='MailboxType';
    Expression={ (Get-MgUserMailboxSetting -UserId $_.UserPrincipalName).UserPurpose }
} | Where-Object { $_.MailboxType -eq 'shared' }

I get the following error message:

Connect-MgGraph : ClientCertificateCredential authentication failed: Retry failed after 4 tries. Retry settings can be adjusted in 
ClientOptions.Retry or by configuring a custom retry policy in ClientOptions.RetryPolicy.
At D:\microsoft exchange online\Script.ps1:5 char:1
+ Connect-MgGraph -ClientId $Appid -TenantId $tenantId -CertificateThum ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Connect-MgGraph], AuthenticationFailedException
    + FullyQualifiedErrorId : Microsoft.Graph.PowerShell.Authentication.Cmdlets.ConnectMgGraph
 
Get-MgUser : Authentication needed. Please call Connect-MgGraph.
At D:\microsoft exchange online\Script.ps1:7 char:1
+ Get-MgUser -All | Select-Object DisplayName, UserPrincipalName, @{
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-MgUser_List], AuthenticationException
    + FullyQualifiedErrorId : Microsoft.Graph.PowerShell.Cmdlets.GetMgUser_List

Answer 1

Hi Tomi Corigliano, 

Thank you for posting your question in the Microsoft Q&A forum. 

Based on the error message and your setup, I’ve done some research and would like to offer a few suggestions. The issue you're encountering "ClientCertificateCredential authentication failed" can stem from several certificate-related causes, such as: 

• The certificate is expired or not valid. 
• The certificate is missing a private key. 
• The certificate is not accessible in the current user context. 

Here are a few steps you can try to troubleshoot: 

1. Run PowerShell as Administrator 

Ensure you're running your PowerShell session with elevated privileges, especially when accessing certificates from the local machine store. 

2. Verify the Certificate Exists and Is Valid 

You can check whether the certificate with the specified thumbprint exists: 

Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq $certthumb } 

If nothing is returned, the certificate might be stored under the CurrentUser context instead. You can try: 

Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq $certthumb } 

Make sure the certificate is present and valid in one of these stores. 

3. Check for Private Key 

Make sure the certificate includes a private key: 

$cert = Get-ChildItem Cert:\LocalMachine\My\$certthumb 
$cert.HasPrivateKey 

If this returns False, the certificate cannot be used for authentication. 

4. Confirm Certificate in Azure App Registration 

Go to Azure AD / Microsoft Entra ID > App registrations, locate your app, and check: 

• The certificate is correctly uploaded. 
• The thumbprint matches the one you're using in the script. 
• The app has the necessary API permissions (e.g., User.Read.All for Get-MgUser). 

If everything checks out and the issue persists, you might also consider testing with a different certificate or using a different authentication method (e.g., client secret or interactive login) to isolate the problem. 

I hope these suggestions help you move forward. If you have any further questions, feel free to ask! 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 2

Been experiencing a similar issue and it turned out to be PowerShell 7.5.3.

connect-MgGraph -NoWelcome -CertificateThumbprint $Script:Cert.Thumbprint -ClientId $Script:AppId -TenantId $Script:Tenant_Name
Connect-MgGraph: ClientCertificateCredential authentication failed: Method not found: '!0 Microsoft.Identity.Client.BaseAbstractApplicationBuilder`1.WithLogging(Microsoft.IdentityModel.Abstractions.IIdentityLogger, Boolean)'

Running the same script in 5.1 connected to Graph using certificate thumbprint without error and processed accounts

The next issue is that there are now modules out there that require PS7.

Answer 3

Try creating a new self-signed certificate and add to the app registration and local cert store of the connecting machine instead and refer to that thumbprint

https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-self-signed-certificate

Answer 4

Has it ever worked? The error indicates the Cert you are referring to is not valid in some way.