microsoftgraph / microsoftgraph/msgraph-sdk-powershell

Double Authentication for Delegated Permission Use on 2.26 or Newer

Open
#3,319 5 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Service issue Status: Needs Investigation type:bug
Dominant language
C#
Stars
898
Forks
230
Avg merge
2d 5h
Merged PRs (30d)
31

Description

Describe the bug

When using Connect-MgGraph simply with the default Graph PowerShell Enterprise App on any version 2.26 or newer, specifically, when using with delegated permissions there seems to be an intermittent double auth prompt. I can't repro this at will, but I've confirmed it in both my corporate environment, personal PC environment, and corroborated with members of the PowerShell community via discord who also confirmed they've seen it as well.

Expected behavior

Single auth prompt should be persistent for the length of the PowerShell process session unless Disconnect-MgGraph is otherwise called.

How to reproduce
  1. Connect-MgGraph (no other parameters are required to repro since this is delegated permission use with auth code flow on the default Graph PowerShell enterprise app)
  2. Auth like normal using an account that has access and proper AAD role for delegated permission use (such as Directory.ReadWrite.All)
  3. After successful auth, run a subsequent cmdlet from the module (e.g. Get-MgDevice)
  4. Intermittently, it will prompt for auth again
SDK Version

2.26

Latest version known to work for scenario above?

2.25

Known Workarounds

Deal with double authentication prompts.

Debug output

No response

Configuration

No response

Other information

Don't quote me on whether this started with 2.25 or 2.26, it was right at the turn of the new year. It definitely never occurred on 2.24

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing delegated auth behavior between SDK versions 2.25 and 2.26, using Connect-MgGraph followed by Get-MgDevice with the default Graph PowerShell Enterprise App. Investigate the intermittent second prompt during the same PowerShell process and verify that authentication remains available until Disconnect-MgGraph is called.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.