Authorization Access Token is null, please re-run authentication...

[ArashFarmahini]

getting below message after insert my credential

Authorization Access Token is null, please re-run authentication...

If I mark this line as a comment in the script, I will get below error

Checking for AzureAD module...

Request to https://graph.microsoft.com/Beta/deviceAppManagement/mobileAppCategories failed with HTTP Status 401 Unauthorized
Response content:
{
"error": {
"code": "InvalidAuthenticationToken",
"message": "Bearer access token is empty.",
"innerError": {
"request-id": "f97793aa-6e39-41f4-85b9-96b2cd2c7706",
"date": "2018-06-18T22:17:35"
}
}
}

here is my computer details
Win 2k12 R2 DataCenter, 2.0.1.11 AzureADPreview, 2.0.1.10 AzureAD

I can confirm, all scripts are working fine on Windows 10; I have tested on 2 windows 10 and 2 server 2012. Windows 10 worked fine but not on servers.

any idea?

[davefalkus]

Hi @ArashFarmahini

On the server infrastructure can you log into the console - portal.azure.com or browse to outlook online with the same user your authenticating with on your Windows 10 device test? I'm asking to see if conditional access could be blocking you on the server. Also does Graph Explorer work on the server OS? https://developer.microsoft.com/en-us/graph/graph-explorer

I've also just tested on Server 2012 R2 with the AzureAD module 2.0.1.10 and it works as expected.

Thanks

Dave

[ArashFarmahini]

Hi @davefalkus
Thanks for the response. I can login to portal.azure.com and https://developer.microsoft.com/en-us/graph/graph-explorer.

I also tested below code and got this error but if i run the same code on my workstation i can get AccessToken

$User= “xxxxxxxx@xxxxx.onmicrosoft.com”
$clientId = "4111f370-aaf0-4ee9-a133-2521599c913c" #my native Application ID in Azure
$userUpn = New-Object "System.Net.Mail.MailAddress" -ArgumentList $User
$tenant = $userUpn.Host
$AadModule = Get-Module -Name "AzureAD"
$adal = Join-Path $AadModule.ModuleBase "Microsoft.IdentityModel.Clients.ActiveDirectory.dll"
$adalforms = Join-Path $AadModule.ModuleBase "Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll"
[System.Reflection.Assembly]::LoadFrom($adal) | Out-Null
[System.Reflection.Assembly]::LoadFrom($adalforms) | Out-Null
$redirectUri = "urn:ietf:wg:oauth:2.0:oob"
$resourceAppIdURI = "https://graph.microsoft.com"
$authority = "https://login.microsoftonline.com/$Tenant"
$authContext = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext" -ArgumentList $authority
$platformParameters = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters" -ArgumentList "Auto"
$userId = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.UserIdentifier" -ArgumentList ($User, "OptionalDisplayableId")
$usrCredential = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.UserPasswordCredential" -ArgumentList "xxxxxxxxx@xxxx.onmicrosoft.com", "xxxx"
$authResult = [Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContextIntegratedAuthExtensions]::AcquireTokenAsync($authContext,$resourceAppIdURI,$clientId,$usrCredential).Result

$authResult = $authContext.AcquireTokenAsync($resourceAppIdURI,$clientId,$redirectUri,$platformParameters,$userId)

$authResult

Result :
Id : 1182
Exception : System.AggregateException: One or more errors occurred. --->
Microsoft.IdentityModel.Clients.ActiveDirectory.AdalException: Device Certificate was not
found for Cert Authorities:OU=82dbaca4-3e81-46ca-9c73-0950c1eaca97,CN=MS-Organization-Access,D
C=windows,DC=net
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.AcquireTokenHandlerBase.d__67.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.AcquireTokenHandlerBase.d__64.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.AcquireTokenHandlerBase.d__55.
MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.d__54.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.d__46.MoveNext()
ErrorCode: device_certificate_not_found<---

Status : Faulted
IsCanceled : False
IsCompleted : True
CreationOptions : None
AsyncState :
IsFaulted : True
AsyncWaitHandle : System.Threading.ManualResetEvent
CompletedSynchronously : False

[mikaelmaegaard]

Hi @ArashFarmahini,

I use kind of the same code as you and get the exact same error: Device Certificate was not
found for Cert Authorities:OU=82dbaca4-3e81-46ca-9c73-0950c1eaca97,CN=MS-Organization-Access,D
C=windows,DC=net.

For me it's working on a Client with Windows 10 or Windows Server 2016, but not on Windows Server 2012 R2.

We have one tenant where it's working from Windows Server 2012 R2 and another where it's failing. Am yet to find the difference between the two, but leaning towards conditional access as mentioned by @davefalkus.

[davefalkus]

Hi all,

There has been a stackoverflow article on the exact error which looks like its related to conditional access which I originally thought.

https://stackoverflow.com/questions/49498682/what-is-causing-the-error-device-certificate-was-not-found-for-cert-authorities

Let me know if it doesn't help.

Dave

[ArashFarmahini]

Hi @davefalkus

Thanks again for the response.
Amazingly, the same script without any changes in our environment start working by itself since this morning. Probably an Azure issue that Microsoft fixed in the background.

[davefalkus]

Thanks for following up @ArashFarmahini, I will close the issue.

Thanks
Dave