Microsoft Graph PowerShell supports two types of authentication: delegated and app-only access.
There are a number of cmdlets that can be used to manage the different parameters required during
authentication, for example, environment, application ID, and certificate.
This cmdlet gets the access token using the Microsoft Authentication Library.
Examples
Example 1: Delegated access: Using interactive authentication, where you provide the scopes that you require during your session
Uses a user created managed identity as a standalone Azure resource.
Example 11: Connecting to an environment or cloud
PS C:\> Get-MgEnvironment
Name AzureADEndpoint GraphEndpoint Type
---- --------------- ------------- ----
China https://login.chinacloudapi.cn https://microsoftgraph.chinacloudapi.cn Built-in
Global https://login.microsoftonline.com https://graph.microsoft.com Built-in
USGov https://login.microsoftonline.us https://graph.microsoft.us Built-in
USGovDoD https://login.microsoftonline.us https://dod-graph.microsoft.us Built-in
PS C:\> Connect-MgGraph -Environment USGov
When you use Connect-MgGraph, you can choose to target other environments.
By default, Connect-MgGraph targets the global public cloud.
Example 12: Connecting to an environment as a different identity
PS C:\> Connect-MgGraph -ContextScope Process
To connect as a different identity other than CurrentUser, specify the -ContextScope parameter with the value Process.
Parameters
-AccessToken
Specifies a bearer token for Microsoft Graph service.
Access tokens do timeout and you'll have to handle their refresh.
Parameter properties
Type:
SecureString
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
AccessTokenParameterSet
Position:
1
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-Certificate
An X.509 certificate supplied during invocation.
Parameter properties
Type:
X509Certificate2
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
AppCertificateParameterSet
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-CertificateSubjectName
The subject distinguished name of a certificate.
The Certificate will be retrieved from the current user's certificate store.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
CertificateSubject, CertificateName
Parameter sets
AppCertificateParameterSet
Position:
2
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-CertificateThumbprint
The thumbprint of your certificate.
The Certificate will be retrieved from the current user's certificate store.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
AppCertificateParameterSet
Position:
3
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-ClientId
The client id of your application.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
AppId, ApplicationId
Parameter sets
UserParameterSet
Position:
1
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
IdentityParameterSet
Position:
1
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-ClientSecretCredential
The PSCredential object provides the application ID and client secret for service principal credentials.
For more information about the PSCredential object, type Get-Help Get-Credential.
Parameter properties
Type:
PSCredential
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
SecretCredential, Credential
Parameter sets
AppSecretCredentialParameterSet
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-ClientTimeout
Sets the HTTP client timeout in seconds.
Parameter properties
Type:
Double
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-ContextScope
Determines the scope of authentication context.
This accepts `Process` for the current process, or `CurrentUser` for all sessions started by user.
Parameter properties
Type:
ContextScope
Default value:
None
Accepted values:
Process, CurrentUser
Supports wildcards:
False
DontShow:
False
Parameter sets
UserParameterSet
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
AppCertificateParameterSet
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
IdentityParameterSet
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
AppSecretCredentialParameterSet
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
EnvironmentVariableParameterSet
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-Environment
The name of the national cloud environment to connect to.
By default global cloud is used.
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
about_CommonParameters.