Connect-MgGraph returns no error for cert issue

[JasBK]

Using Connect-MgGraph if the cert is placed in the machine cert store, only on-screen error is returned and nothing to the error stream.
Reproduce, place cert in local machine cert store vs current user.
Connect to graph using Connect-MgGraph with cert.
Error on-screen is [REDACTED] certificate was not found or has expired.
No error sent to error stream.

Running module 1.24.0

[peombwa]

Error messages are written to the error stream as expected. Please check your environment configuration.

Repro:

$ps = [powershell]::Create()
$ps.AddScript("Import-Module Microsoft.Graph.Authentication -RequiredVersion 1.24.0").Invoke()
$ps.AddScript("Connect-MgGraph -ClientId $env:app_client_id -TenantId $env:app_tenant_id -CertificateThumbprint 'Not_Valid_TumbPrint_Not_Valid_TumbPrint_'").Invoke()
$ps.Streams.Error # Error is written to the error stream as expected.

[JasBK]

Typically in PowerShell if I run something like this, storing the command in a variable it would contain output such as an error.

$ConnectGraph = Connect-MgGraph -ClientId $ClientId -TenantId $TenantId -CertificateThumbprint $CertificateThumbprint

If I run this with everything in place it connects as expected. If the cert is in the wrong location the $ConnectGraph variable is empty. But that is not the typical with POSH in the past for me.

[peombwa]

$ConnectGraph = Connect-MgGraph -ClientId $ClientId -TenantId $TenantId -CertificateThumbprint $CertificateThumbprint

The above example is just assigning the output object of Connect-MgGraph to $ConnectGraph variable. It is not redirecting errors to the variable. The same behavior can be seen with PowerShell's native commands such as $ChildItem = Get-ChildItem -Path "Not a path".

Please use PowerShell's try/catch and -ErrorAction Stop for error handling as stated at https://learn.microsoft.com/en-us/powershell/scripting/learn/deep-dives/everything-about-exceptions?view=powershell-7.3#trycatch:

try {
  Connect-MgGraph -ClientId $ClientId -TenantId $TenantId -CertificateThumbprint $CertificateThumbprint -ErrorAction Stop
}
Catch {
  Write-Error "An error occurred! $($_)"
}

The commands in this module will fail with non-terminating error because we use Write-Error. This gives customers the flexibility to handle errors as they desire.

[jcoehoorn]

This still fails if using the older pre-Core powershell. Certificate errors cause ugly red text on the console, but the script continues running, there's nothing in the error stream, and if placed in a try/catch the catch block does not run.

-ErrorAction Stop does work, but it's feels odd to need to do this.

Also, you can detect it with the automatic $Error variable.