Error: Authentication needed, call Connect-Graph

[michaeltheyeti]

Executing the following within an HTTP Triggered Azure Function App

The astericks are just placeholders.

Connect-Graph -CertificateThumbprint ****** -ClientId ******* -TenantId *******

Get-MgContext

Send-MgUserMail -UserId ******** -BodyParameter ********

Disconnect-Graph

The code works in the ISE but not in the Azure Function App

Here is the majority error I'm receiving:
2021-01-28T05:31:11.086 [Error] ERROR: Authentication needed, call Connect-Graph.Exception :Type : System.Security.Authentication.AuthenticationExceptionTargetSite :Name : GetGraphHttpClientDeclaringType : Microsoft.Graph.PowerShell.Authentication.Helpers.HttpHelpersMemberType : MethodModule : Microsoft.Graph.Authentication.dllStackTrace :at Microsoft.Graph.PowerShell.Authentication.Helpers.HttpHelpers.GetGraphHttpClient(IAuthContext authContext)at Microsoft.Graph.PowerShell.Module.BeforeCreatePipeline(InvocationInfo invocationInfo, HttpPipeline& pipeline)at Microsoft.Graph.PowerShell.Module.CreatePipeline(InvocationInfo invocationInfo, String parameterSetName)at Microsoft.Graph.PowerShell.Cmdlets.SendMgUserMail_Send.ProcessRecordAsync()Message : Authentication needed, call Connect-Graph.Source : Microsoft.Graph.AuthenticationHResult : -2146233087CategoryInfo : NotSpecified: (:) [Send-MgUserMail_Send], AuthenticationExceptionFullyQualifiedErrorId : Microsoft.Graph.PowerShell.Cmdlets.SendMgUserMail_SendInvocationInfo :MyCommand : Send-MgUserMail_SendScriptLineNumber : 139OffsetInLine : 13HistoryId : 1ScriptName : D:\home\site\wwwroot\CycleAppService\run.ps1Line : PositionMessage : At D:\home\site\wwwroot\CycleAppService\run.ps1:139 char:13+ Send-MgUserMail -UserId 'c1f70acf-2564-4d6c-ab76-6c1e6dca …+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~PSScriptRoot : D:\home\site\wwwroot\CycleAppServicePSCommandPath : D:\home\site\wwwroot\CycleAppService\run.ps1InvocationName : Send-MgUserMailCommandOrigin : InternalScriptStackTrace : at Send-MgUserMail, D:\home\data\ManagedDependencies\210128051629338.r\Microsoft.Graph.Users.Actions\1.2.0\exports\v1.0\ProxyCmdletDefinitions.ps1: line 17071at , D:\home\site\wwwroot\CycleAppService\run.ps1: line 139PipelineIterationInfo :Microsoft.Azure.WebJobs.Script.Workers.Rpc.RpcException : Result: ERROR: Authentication needed, call Connect-Graph.Exception :Type : System.Security.Authentication.AuthenticationExceptionTargetSite :Name : GetGraphHttpClientDeclaringType : Microsoft.Graph.PowerShell.Authentication.Helpers.HttpHelpersMemberType : MethodModule : Microsoft.Graph.Authentication.dllStackTrace :at Microsoft.Graph.PowerShell.Authentication.Helpers.HttpHelpers.GetGraphHttpClient(IAuthContext authContext)at Microsoft.Graph.PowerShell.Module.BeforeCreatePipeline(InvocationInfo invocationInfo, HttpPipeline& pipeline)at Microsoft.Graph.PowerShell.Module.CreatePipeline(InvocationInfo invocationInfo, String parameterSetName)at Microsoft.Graph.PowerShell.Cmdlets.SendMgUserMail_Send.ProcessRecordAsync()Message : Authentication needed, call Connect-Graph.Source : Microsoft.Graph.AuthenticationHResult : -2146233087CategoryInfo : NotSpecified: (:) [Send-MgUserMail_Send], AuthenticationExceptionFullyQualifiedErrorId : Microsoft.Graph.PowerShell.Cmdlets.SendMgUserMail_SendInvocationInfo :MyCommand : Send-MgUserMail_SendScriptLineNumber : 139OffsetInLine : 13HistoryId : 1ScriptName : D:\home\site\wwwroot\CycleAppService\run.ps1Line

It appears that whatever fix was put in place for 'Authentication needed, call Connect-Graph' isn't working yet.
AB#7835

[jhoneill]

One question. The help for the thumbprint parameter says "The Certificate will be retrieved from the current user's certificate store." So when you run something as a function app, does it have access to a user-cert-store containing this cert and (I assume) the related private key ?

[michaeltheyeti]

I'm assuming that the functionality would work similarly to the way Connect-AzAccount works within the same application. The cert and the secret are both on the same app registration in dev. Connect-AzAccount is able to authenticate using a client secret, but Connect-MgGraph cannot.

[PsychoData]

Connect-AzAccount uses a Managed Identity to auth without interaction or an OAuth grant which rely on application settings/secret s
Connect-AzAccount w/ Managed Identity

The -CertificateThumbprint can only work off certs in the CurrentUser\My location. It can't even (currently) read certs installed to the machine by thumbprint (even if a user would theoretically be able to read it)

To confirm whether your Azure Function can see the Certificate, see if this returns anything while running in the Azure Hosted Function

Get-ChildItem -Path "Cert:\CurrentUser\My\$CertificateThumbprint"

[PsychoData]

If the cert if in your Cert:\LocalMachine\My\$ThumbPrint you could still load a certificate object directly like below

Load from Cert:\LocalMachine\My store

$cert = Get-Item Cert:\LocalMachine\My\$ThumbPrint
Connect-MgGraph -ClientId $ClientID -TenantId $TenantID -Certificate $cert  -Verbose -ForceRefresh

or Load Cert from File (Relying on Get-PFXCertificate -Password which is not in Powershell 5.1, but should be in the PowerShell core that runs in Azure Functions)

Once you have done the above Connect-MgGraph -Certificate $cert you have it stored in the Get-MgContext and it should stick through the remainder of the session

[michaeltheyeti]

I found a simpler solution for now utilizing the following from the Az PowerShell module and handing the token to the MS Graph module:

Connect-AzAccount -ServicePrincipal -Credential $credentials -Tenant $env:msaltokentenantid
$token = Get-AzAccessToken -TenantId $env:msaltokentenantid -ResourceUrl 'https://graph.microsoft.com'
Connect-Graph -AccessToken $token.Token

I'll try to figure out the cert a little bit later using the tips provided. The method I show allows for the use of a plain client_secret when connecting to Azure in order to get the AzContext. In

Cheers.