Connect-Graph - Running any command after connected will reprompt for authentication

[o-l-a-v]

In PowerShell 5.1 (not using ISE, because of #247, #289), straight after running Connect-Graph and trying to run any command, Microsoft.Graph asks for reauthentication.

Code to reproduce

PS C:\Users\OlavRønnestadBirkela> Microsoft.Graph.Authentication\Connect-Graph -TenantId '<some_verified_domain>' -Scopes (
>>     'User.Read.All',
>>     'Group.Read.All',
>>     'Policy.Read.All'
>> )
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code <removed> to authenticate.
Welcome To Microsoft Graph!
PS C:\Users\OlavRønnestadBirkela> Microsoft.Graph.Identity.ConditionalAccess\Get-MgIdentityConditionalAccessNamedLocation
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code <removed> to authenticate.

Id                                   CreatedDateTime DisplayName ModifiedDateTime
--                                   --------------- ----------- ----------------
<removed results>


PS C:\Users\OlavRønnestadBirkela>

$PSVersionTable

PS C:\Users\OlavRønnestadBirkela> $PSVersionTable | Format-Table -Force

Name                           Value
----                           -----
PSVersion                      5.1.19041.1
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.19041.1
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Get-Module -Name 'Microsoft.Graph.*'

PS C:\Users\OlavRønnestadBirkela> Get-Module -Name 'Microsoft.Graph.*' | Select-Object -Property 'Name','Version'

Name                                       Version
----                                       -------
Microsoft.Graph.Authentication             0.9.1
Microsoft.Graph.Identity.ConditionalAccess 0.9.1

[o-l-a-v]

FYI, I get asked for reauth every time I run a commandlet. Wtf is this. Do you even test this?

[georgend]

@o-l-a-v Would I be right in assuming your TenantId is a GUID, you have the rights within that tenant to access the specified scopes and they are consented to?

[o-l-a-v]

@o-l-a-v Would I be right in assuming your TenantId is a GUID, you have the rights within that tenant to access the specified scopes and they are consented to?

TenantId is any verified domain within said tenant, using Global Admin in said tenant. Might have used AOBO, but don't remember exactly.

[georgend]

I could not reproduce your error, kindly share the Debug log by passing -Debug to the cmdlet you are calling

Get-MgIdentityConditionalAccessNamedLocation -Debug

[o-l-a-v]

Hi, sorry late reply. Heres two times running Get-MgIdentityConditionalAccessNamedLocation -Debug using PowerShell 7.1 beta 7, using global admin that is member in the tenant in question.

First ran

Connect-Graph -TenantId '<domain_NOT_objectid>' -Scopes (
    'User.Read.All',
    'Group.Read.All',
    'Policy.Read.All'
)

Then Get-MgIdentityConditionalAccessNamedLocation -Debug twice.

Env. info.

PS C:\Windows\System32> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.1.0-preview.7
PSEdition                      Core
GitCommitId                    7.1.0-preview.7
OS                             Microsoft Windows 10.0.19041
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

PS C:\Windows\System32> Get-Module -Name 'Microsoft.*'

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     0.9.1                 Microsoft.Graph.Authentication      {Connect-Graph, Disconnect-Graph, Get-MgContext, Get-MgProfile…}
Script     0.9.1                 Microsoft.Graph.Identity.Condition… {Get-MgIdentityConditionalAccess, Get-MgIdentityConditionalAccessNamedLocation, Get-MgIdentityConditionalAccessPolicy, New-MgIdentityConditionalAccessNamedLocation…}
Manifest   7.0.0.0               Microsoft.PowerShell.Management     {Add-Content, Clear-Content, Clear-Item, Clear-ItemProperty…}
Manifest   7.0.0.0               Microsoft.PowerShell.Security       {ConvertFrom-SecureString, ConvertTo-SecureString, Get-Acl, Get-AuthenticodeSignature…}
Manifest   7.0.0.0               Microsoft.PowerShell.Utility        {Add-Member, Add-Type, Clear-Variable, Compare-Object…}
Manifest   7.0.0.0               Microsoft.WSMan.Management          {Connect-WSMan, Disable-WSManCredSSP, Disconnect-WSMan, Enable-WSManCredSSP…}

PS C:\Windows\System32>

[georgend]

@o-l-a-v Are you running as Administrator (Elevated Shell)?

Please attempt to run the commands using a Non-Admin Windows user account (Non Elevated Shell).

[o-l-a-v]

@finsharp
No, not running as admin. My user account has admin permissions, but I do not run pwsh.exe as admin.

[georgend]

We suspect a Token caching issue where your token cache is in an invalid state, try calling Disconnect-Graph then retry.

[o-l-a-v]

Trying again today with new version of this module.

Module info

PS C:\Windows\System32> Get-Module -Name 'Microsoft.*'

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     1.0.1                 Microsoft.Graph.Authentication      {Connect-MgGraph, Disconnect-MgGraph, Get-MgCo…
Script     0.9.1                 Microsoft.Graph.Identity.Condition… {Get-MgIdentityConditionalAccess, Get-MgIdenti…
Manifest   7.0.0.0               Microsoft.PowerShell.Management     {Add-Content, Clear-Content, Clear-Item, Clear…
Manifest   7.0.0.0               Microsoft.PowerShell.Utility        {Add-Member, Add-Type, Clear-Variable, Compare…

PS C:\Windows\System32>

PowerShell 5.1

PS C:\Users\OlavRønnestadBirkela> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.19041.1
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.19041.1
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1


PS C:\Users\OlavRønnestadBirkela>

PWSH 7.0.2 (MSI)

PS C:\Users\OlavRønnestadBirkela> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.0.2
PSEdition                      Core
GitCommitId                    7.0.2
OS                             Microsoft Windows 10.0.19041
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

PS C:\Users\OlavRønnestadBirkela>

PWSH 7.1.0-rc1 (Microsoft Store)

PS C:\Windows\System32> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.1.0-rc.1
PSEdition                      Core
GitCommitId                    7.1.0-rc.1
OS                             Microsoft Windows 10.0.19041
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

PS C:\Windows\System32>

It seems to work as expected now for all PowerShell versions mentioned. Will come back here if I experience similar problems again.

Only strange but probably on purpose behavior I found is that PowerShell sessions, even Windows PowerShell and different PowerShell Core versions, seems to share some cache. So, if I authenticate in one session, log in with device login etc., if I login in a different PowerShell session to the same tenant I get logged straight in, no prompt for auth.

[georgend]

@o-l-a-v Thank you for the update. I'll close the issue for now.