Scenario
You are a developer or power user in a company with Microsoft 365 tenant.
You need to connect to Microsoft Graph and then call Microsoft Graph API to consume some MS Graph resources on behalf of authenticated user programmatically with PowerShell – e.g. add/remove documents or list items, search for sites or documents content etc. – whatever available with Graph API.
You do not have tenant admin permissions or any tenant-level admin permissions (SharePoint, Teams, Exchange etc. ). But you can register an Azure App and request tenant admin consent.
Solution
- register an Azure App
- under authentication blade – add platform – “Mobile and Desktop app”
add “http://localhost” (and select …/nativeclient Url ?) - under API permissions blade – add delegated permissions you need
(refer to specific API you’ll use) - install MSAL.PS PowerShell module
- use the following code to get graph access token and call graph API
$AppId = ""
$TenantId = ""
$connectionDetails = @{
'TenantId' = $AppId
'ClientId' = $TenantId
'Interactive' = $true
}
$token = Get-MsalToken @connectionDetails
# or
$token = Get-MsalToken -TenantId $TenantId -ClientId $appId -Interactive
$Headers = @{
'Authorization' = "bearer $($token.AccessToken)"
}
Invoke-RestMethod -Uri 'https://graph.microsoft.com/v1.0/me' -Headers $HeadersYou can find the code sample here: https://github.com/VladilenK/
Did not work:
Az PowerShell module did not work for me:
Connect-AzAccount -Tenant ""
$azAccessToken = Get-AzAccessToken -Resource "https://graph.microsoft.com"
$Headers = @{
'Authorization' = "$($azAccessToken.Type) $($azAccessToken.Token)"
}
Invoke-RestMethod -Uri 'https://graph.microsoft.com/v1.0/me' -Headers $HeadersAs I understand we need somehow let Azure know API permissions we want (e.g. via app registerd)…
PnP did not work for me too:
$url = "https://orgname.sharepoint.com"
Connect-PnPOnline -ClientId "" -Url $url -Interactive
$pnpToken = Get-PnPGraphAccessToken
$Headers = @{
'Authorization' = "bearer $($pnpToken)"
}
Invoke-RestMethod -Uri 'https://graph.microsoft.com/v1.0/me' -Headers $Headers
# did not work as well:
$pnpToken = Get-PnPAppAuthAccessToken
$pnpToken = Get-PnPAccessToken the error message was (maybe I missed something – please let me know):
References