Invalid JWT access token

Question

Hi,

Im trying to setup azure automation to disable and enable a conditional access policy via a runbook, ive installed the two specific modules from powershell gallery, Microsoft.Graph.Authentication & Microsoft.Graph.Identity.SignIns both version 2.30.0, ive read online that I will get the access token error with this version so downgrade to 2.25.0 by manually uploading the modules. I have done this and then i get the error that Update-MgIdentityConditionalAccessPolicy cmdlet isnt a recognised cmdlet, is there a correct way of uploading the modules from a zip.

Please see below script i am trying

#Load required modules

Import-Module Microsoft.Graph.Authentication

Import-Module Microsoft.Graph.Identity.SignIns

Connect to Graph with Managed Identity

Connect-MgGraph -Identity -NoWelcome

Use the policy ID (replace with yours from Get-MgConditionalAccessPolicy)

$policyId = "my policy id number is in there just removed it"

Enable the policy

Update-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $policyId -BodyParameter @{ state = "disabled" }

Write-Output "Policy has been DISABLED."

I dont think its loading the modules correctly from the zip

Any help would be amazing

Thanks

Lewis

Answer 1

Hello Lewis Venables

Thank you for posting your query on Microsoft Q&A platform.

You are trying to automate enabling or disabling a Conditional Access Policy in Azure using a PowerShell runbook and Microsoft Graph SDK, but you are facing two common issues that is

1. Invalid JWT Access Token might be due to using managed identity without assigning the correct Microsoft Graph API application permissions.

The Graph SDK version you are using expects delegated permissions, which are not supported in Azure Automation with managed identity.

2. Cmdlet Not Recognized (Update-MgIdentityConditionalAccessPolicy): This happens when the required module (Microsoft.Graph.Identity.SignIns) is either not installed properly or missing dependencies. You manually uploaded a ZIP file that did not include all required submodules.

• To avoid these, Instead of uploading ZIP modules manually try to use PowerShell to install modules directly from the PowerShell Gallery so that all dependencies are handled in a proper way. Reference: Install Microsoft Graph Module for Azure Automation using PowerShell
• Assign Graph API Permissions to Managed Identity: You must assign application level permissions (not delegated) to your Automation Account’s managed identity
  Reference: https://thesysadminchannel.com/graph-api-using-a-managed-identity-in-an-automation-runbook/
• Once you have installed the Microsoft Graph modules correctly and assigned the necessary permissions to your Azure Automation account's Managed Identity, you can use the Update-MgIdentityConditionalAccessPolicy cmdlet in your runbook script. 1.Imports the required modules. 2.Authenticates using the managed identity. 3.Calls the correct Microsoft Graph cmdlet to update the Conditional Access Policy. Reference: https://learn.microsoft.com/en-us/powershell/microsoftgraph/authentication-commands?view=graph-powershell-1.0 Hope it helps.

Thanks,

Suchitra.