Open joe-s-c opened 1 month ago
Turns out this is a fault with WAM login. Disabling this gets it working again. Unfortunately using browser login is not very automation friendly. We have various automations that authenticate with the logged in user on our privileged access workstations, so interactive sign in ensures a smooth experience, hence it'll be good to get this bug resolved.
Description
Prior to AzAccounts 3.0.0, it was possible to connect to Az via GDAP, then request a token to connect to Microsoft.Graph. For example, you could run the following: $UPN = "username@domain.com" $TenantID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" Connect-AzAccount -AccountID $UPN -TenantID $TenantID
Then you could run: Get-AzAdUser This would return a list of users in the tenant.
You could then obtain a token to connect to Microsoft Graph: Connect-MgGraph -AccessToken (Get-AzAccessToken -ResourceTypeName MSGraph -TenantID $TenantID).token Then you can run, for example: Get-MgUser And again this would return a list of users.
In the new version of AzAccounts using Powershell 5.1, it connects but errors when running, for example, Get-AzADUser: Az.MSGraph.internal\Get-AzADUser : User was not found. At C:\Program Files\WindowsPowerShell\Modules\Az.Resources\7.1.0\MSGraph.Autorest\custom\Get-AzADUser.ps1:212 char:9 Az.MSGraph.internal\Get-AzADUser @PSBoundParameters
CategoryInfo : InvalidOperation: ({ ConsistencyLe...= , Expand = }:<>f__AnonymousType5`7) [Get-AzADUse r_List], Exception FullyQualifiedErrorId : Authentication_Unauthorized,Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Cmdlets .GetAzADUser_List
Using Powershell 7.2 returns: Get-AzADUser_List: C:\Program Files\PowerShell\Modules\Az.Resources\7.2.0\MSGraph.Autorest\custom\Get-AzADUser.ps1:212 Line | 212 | Az.MSGraph.internal\Get-AzADUser @PSBoundParameters | User was not found.
Then for Microsoft Graph, running the below will connect ok: Connect-MgGraph -AccessToken ((ConvertTo-SecureString (Get-AzAccessToken -ResourceTypeName MSGraph -TenantID $TenantID).token -AsPlainText -Force)) But requesting any data fails, e.g.: Get-MgUser : User was not found. Status: 403 (Forbidden) ErrorCode: Authentication_Unauthorized Date: 2024-07-11T15:51:38 Headers: Transfer-Encoding : chunked Vary : Accept-Encoding Strict-Transport-Security : max-age=31536000 request-id : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx client-request-id : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"West Europe","Slice":"E","Ring":"5","ScaleUnit":"007","RoleInstance":"AM4PEPF000278F2"}} Cache-Control : no-cache Date : Thu, 11 Jul 2024 15:51:37 GMT At line:1 char:1 Get-MgUser CategoryInfo : InvalidOperation: ({ ConsistencyLe... , Headers = }:<>f__AnonymousType45`9) [Get-MgUser _List], Exception FullyQualifiedErrorId : Authentication_Unauthorized,Microsoft.Graph.PowerShell.Cmdlets.GetMgUser_List
And for Powershell 7.2: Get-MgUser_List: User was not found.
Status: 403 (Forbidden) ErrorCode: Authentication_Unauthorized Date: 2024-07-11T15:45:04
Headers: Cache-Control : no-cache Vary : Accept-Encoding Strict-Transport-Security : max-age=31536000 request-id : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx client-request-id : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"West Europe","Slice":"E","Ring":"5","ScaleUnit":"003","RoleInstance":"AM1PEPF00010596"}} Date : Thu, 11 Jul 2024 15:45:03 GMT
Issue script & Debug output
Environment data
Module versions
Error output