Could not acquire access to file at 'C:\WINDOWS\system32\config\systemprofile\.graph\GraphContext.json'. Please ensure you have access to this file and try again in a few minutes.

[NikCharlebois]

Microsoft365DSC delegates the authentication to the MSCloudLoginAssistn module. When this one tries to call connect-mggraph, if we are already connected it throws the following error:

Could not acquire access to file at 'C:\WINDOWS\system32\config\systemprofile.graph\GraphContext.json'. Please ensure you have access to this file and try again in a few minutes.

[NikCharlebois]

Additional details. When running with DSC, PowerShell runs under nt authority\system. If I use PSExec to run PowerShell as that user and try to connect using Connect-MGGraph, I am able to replicate the above error.

[NikCharlebois]

It appears that manually granting access to the System Account on the /config folder did the trick. Any ways to circumvent having to manually grant permissions for the graph context file to get created?

[peombwa]

Hi @NikCharlebois,

This is an access issue with the default directory ([System.Environment]::GetFolderPath([System.Environment+SpecialFolder]::UserProfile)) that the SDK uses to cache its contents on Windows.

One solution would be for us to change the caching location from [System.Environment+SpecialFolder]::UserProfile to [System.Environment+SpecialFolder]::ApplicationData.

Let me try repro this using PSExec and see if we have a workaround besides manually granting access to the System Account on the config folder.

[NikCharlebois]

Update, I don't get the error if I don't specify the -Environment parameter. We were trying to connect to the Global environment using:

Connect-MGGraph -Environment Global

Removing that parameter fixes the issue. It would still be the case for other sovereign clouds however.

[pl4nty]

I ran into this when running M365 DSC under my user account (%UserProfile%\.graph\GraphContext.json), also resolved by running Connect-MsGraph beforehand.

[ykuijs]

I believe the Connect-MGGraph code does not check if the .graph folder exists. I just tested this locally by reproducing the issue, making sure the .graph folder did not exist, have a Process Monitor running alongside and then run Connect-MGGraph with the "-Environment Global" parameter. I got the same message:

C:\> Connect-MgGraph -AccessToken $AccessToken -Environment Global
Connect-MgGraph : Could not acquire access to file at 'C:\Users\USERID\.graph\GraphContext.json'. Please ensure you have access to this file and try again 
in a few minutes..
At line:1 char:1
+ Connect-MgGraph -AccessToken $AccessToken -Environment Global
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Connect-MgGraph], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.Graph.PowerShell.Authentication.Cmdlets.ConnectMgGraph

And Process Monitor only showed that the GraphContext.json file was accessed directly, without checking if the .graph folder even existed.

Creating the mentioned .graph folder resolved the issue. So when the code creates the folder before trying to access the file, that should resolve the issue.