microsoftgraph / microsoftgraph/msgraph-sdk-powershell
Get-MgContext: include directory role values from wids claim?
Open
Nobody has claimed this yet.
Request: Feature
- Dominant language
- C#
- Stars
- 898
- Forks
- 230
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 31
Description
Get-MgContext should include directory role ids from wids claim and resolve to role displayName if possible.

In the example below,
- "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3" equates to "Authentication Admin" role
- "0997a1d0-0d1d-4acb-b408-d5ca73121e90" equates to default service principal permissions?
{
"aud": "https://graph.microsoft.com",
"iss": "https://sts.windows.net/cc7d0b33-84c6-4368-a879-2e47139b7b1f/",
"iat": 1675198725,
"nbf": 1675198725,
"exp": 1675202625,
"aio": "E2YAgrYTLMzdKWLhDslMgbOV0wE=",
"app_displayname": "PowerShell Client (Confidential)",
"appid": "c3b902b3-0b1c-4338-8d49-b436597cbc52",
"appidacr": "2",
"idp": "https://sts.windows.net/cc7d0b33-84c6-4368-a879-2e47139b7b1f/",
"idtyp": "app",
"oid": "bdfa0a62-3d10-4d36-abad-3d432a3552a2",
"rh": "0.ASgAMwt9zMaEaEOoeS5HE5t7HwMAAAAAAAAAwAAAAAAAAAAoAAA.",
"sub": "bdfa0a62-3d10-4d36-abad-3d432a3552a2",
"tenant_region_scope": "NA",
"tid": "cc7d0b33-84c6-4368-a879-2e47139b7b1f",
"uti": "k7opWtDqiEiZBfk_rzEFAA",
"ver": "1.0",
"wids": [
"9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
"0997a1d0-0d1d-4acb-b408-d5ca73121e90"
],
"xms_tcdt": 1525889780
}
"b79fbf4d-3ef9-4689-8143-76b194e85509" is default user permissions?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the Get-MgContext entry point and inspect how the access-token claims are read, focusing on the wids claim shown in the example. Determine how its directory role IDs can be included and resolved to role display names when possible; done means Get-MgContext exposes those values without losing unresolved IDs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- authentication, cli
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100