microsoft / EntraExporter

PowerShell module to export a local copy of an Entra (Azure AD) tenant configuration.
https://aka.ms/EntraExporter
MIT License
568 stars 89 forks source link

Expiring AccessToken during export #41

Closed jskirzynski-3s closed 1 year ago

jskirzynski-3s commented 1 year ago

Hi,

I try to export Users from AAD using this command: Export-AzureAD -Type Users -Path ./dump but after some time AccessToken expiring and I get the below error:

Export-AzureAD: /home/user/.local/share/powershell/Modules/AzureADExporter/1.0.957478/Export-AzureAD.ps1:140
Line |
 140 |  …             Export-AzureAD -Path $itemOutputFileName -Type $Type -Exp …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | GET https://graph.microsoft.com/beta/users/3e153173-****-****-****-a8e385cba89f/authentication/phoneMethods HTTP/1.1 401 Unauthorized Transfer-Encoding: chunked Vary: Accept-Encoding Strict-Transport-Security:
     | max-age=31536000 request-id: 44369f81-****-****-****-e9dd0946da6c client-request-id: 44369f81-****-****-****-e9dd0946da6c x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"West
     | Europe","Slice":"E","Ring":"5","ScaleUnit":"003","RoleInstance":"AM1PEPF0*******"}} WWW-Authenticate: Bearer realm="", authorization_uri="https://login.microsoftonline.com/common/oauth2/authorize",
     | client_id="00000003-0000-0000-c000-000000000000" Date: Fri, 20 Jan 2023 13:29:42 GMT Content-Type: application/json Content-Encoding: gzip  {"error":{"code":"InvalidAuthenticationToken","message":"Access token has expired
     | or is not yet valid.","innerError":{"date":"2023-01-20T13:29:43","request-id":"44369f81-****-****-****-e9dd0946da6c","client-request-id":"44369f81-****-****-****-e9dd0946da6c"}}}
    3e153173-****-****-****-a8e385cba89f Authentication/EmailMethods

How to handle this case without rewriting your script? I cannot see any options in the documentation.

Best regards

merill commented 1 year ago

How are you connecting to Microsoft Graph? As long as you are not using the -AccessToken parameter in Connect-MgGraph your token should be renewed automatically.