microsoftgraph / microsoftgraph/msgraph-sdk-powershell
Double Authentication for Delegated Permission Use on 2.26 or Newer
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 898
- Forks
- 230
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 31
Description
Describe the bug
When using Connect-MgGraph simply with the default Graph PowerShell Enterprise App on any version 2.26 or newer, specifically, when using with delegated permissions there seems to be an intermittent double auth prompt. I can't repro this at will, but I've confirmed it in both my corporate environment, personal PC environment, and corroborated with members of the PowerShell community via discord who also confirmed they've seen it as well.
Expected behavior
Single auth prompt should be persistent for the length of the PowerShell process session unless Disconnect-MgGraph is otherwise called.
How to reproduce
- Connect-MgGraph (no other parameters are required to repro since this is delegated permission use with auth code flow on the default Graph PowerShell enterprise app)
- Auth like normal using an account that has access and proper AAD role for delegated permission use (such as Directory.ReadWrite.All)
- After successful auth, run a subsequent cmdlet from the module (e.g. Get-MgDevice)
- Intermittently, it will prompt for auth again
SDK Version
2.26
Latest version known to work for scenario above?
2.25
Known Workarounds
Deal with double authentication prompts.
Debug output
No response
Configuration
No response
Other information
Don't quote me on whether this started with 2.25 or 2.26, it was right at the turn of the new year. It definitely never occurred on 2.24
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing delegated auth behavior between SDK versions 2.25 and 2.26, using Connect-MgGraph followed by Get-MgDevice with the default Graph PowerShell Enterprise App. Investigate the intermittent second prompt during the same PowerShell process and verify that authentication remains available until Disconnect-MgGraph is called.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100