microsoftgraph / microsoftgraph/msgraph-sdk-powershell

ExchangeOnlineManagement and Microsoft.Graph PowerShell modules are mutually incompatible in the same session due to MSAL/WAM conflicts

Open
#3,576 19 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Needs: Attention :wave: status:waiting-for-technical-design-work type:bug
Dominant language
C#
Stars
898
Forks
230
Avg merge
2d 5h
Merged PRs (30d)
31

Description

Describe the bug

When both ExchangeOnlineManagement and Microsoft Graph PowerShell SDK are loaded in the same PowerShell session, interactive authentication fails consistently. Whichever module loads second fails with MSAL RuntimeBroker NullReferenceException or MissingMethodException. Each module works independently.

Environment

PowerShell: Windows PowerShell 5.1 and PowerShell 7.x (both affected)
ExchangeOnlineManagement: 3.8.x – 3.9.2
Microsoft.Graph PowerShell: 2.26+ (also confirmed with 2.34+)
OS: Windows 10 / 11
Auth: Interactive (WAM enabled by default)

Expected behavior

Both modules should be able to authenticate in the same process, or at minimum fail with a documented, deterministic error.

How to reproduce
Import-Module ExchangeOnlineManagement
Import-Module Microsoft.Graph

Connect-ExchangeOnline   # FAILS if 2nd
# or
Connect-MgGraph          # FAILS if 2nd

Reversing the import order reverses which module fails.

SDK Version

2.36.1

Latest version known to work for scenario above?

<2.26 (I think)

Known Workarounds

The only workaround I've found is to execute commands for one of these modules in a separate Powershell session

Debug output
Click to expand log ```

Import-Module Microsoft.Graph -Debug
VERBOSE: Loading module from path 'C:\Program
Files\WindowsPowerShell\Modules\Microsoft.Graph\2.36.1\Microsoft.Graph.psd1'.

Confirm
Continue with this operation?
[Y] Yes [A] Yes to All [H] Halt Command [S] Suspend [?] Help (default is "Y"): A
VERBOSE: Cannot verify the Microsoft .NET Framework version 4.7.2 because it is not included in the list of permitted
versions.
Import-Module : Function Get-MgGroupThread cannot be created because function capacity 4096 has been exceeded for this
scope.
At line:1 char:2

  • Import-Module Microsoft.Graph -Debug
  •  + CategoryInfo          : InvalidOperation: (Get-MgGroupThread:String) [Import-Module], SessionStateOverflowExcept
    ion
     + FullyQualifiedErrorId : FunctionOverflow,Microsoft.PowerShell.Commands.ImportModuleCommand
    
    

dotnet --info

global.json file:
Not found

Host:
Version: 6.0.36
Architecture: x64
Commit: f1dd57165b

.NET SDKs installed:
No SDKs were found.

.NET runtimes installed:
Microsoft.NETCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Download .NET:
https://aka.ms/dotnet-download

Learn about .NET Runtimes and SDKs:
https://aka.ms/dotnet/runtimes-sdk-info

Import-Module ExchangeOnlineManagement -Debug
VERBOSE: Loading module from path 'C:\Program
Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.9.2\ExchangeOnlineManagement.psd1'.

Confirm
Continue with this operation?
[Y] Yes [A] Yes to All [H] Halt Command [S] Suspend [?] Help (default is "Y"): A
VERBOSE: Populating RepositorySourceLocation property for module ExchangeOnlineManagement.
VERBOSE: Loading module from path 'C:\Program
Files\WindowsPowerShell\Modules\ExchangeOnlineManagement\3.9.2.\netFramework\ExchangeOnlineManagement.psm1'.
VERBOSE: Exporting function 'Get-ModuleVersion'.
VERBOSE: Exporting function 'Test-Uri'.
VERBOSE: Exporting function 'Get-OrgNameFromUPN'.
VERBOSE: Exporting function 'Write-Message'.
VERBOSE: Exporting function 'Connect-ExchangeOnline'.
VERBOSE: Exporting function 'Connect-IPPSSession'.
VERBOSE: Exporting function 'Disconnect-ExchangeOnline'.
VERBOSE: Exporting cmdlet 'Get-EXOCasMailbox'.
VERBOSE: Exporting cmdlet 'Get-EXOMailbox'.
VERBOSE: Exporting cmdlet 'Get-EXOMailboxFolderPermission'.
VERBOSE: Exporting cmdlet 'Get-EXOMailboxFolderStatistics'.
VERBOSE: Exporting cmdlet 'Get-EXOMailboxPermission'.
VERBOSE: Exporting cmdlet 'Get-EXOMailboxStatistics'.
VERBOSE: Exporting cmdlet 'Get-EXOMobileDeviceStatistics'.
VERBOSE: Exporting cmdlet 'Get-EXORecipient'.
VERBOSE: Exporting cmdlet 'Get-EXORecipientPermission'.
VERBOSE: Exporting cmdlet 'Set-ExoAppSettings'.
VERBOSE: Exporting cmdlet 'Set-EXOCasMailbox'.
VERBOSE: Exporting cmdlet 'Set-EXOMailbox'.
VERBOSE: Exporting cmdlet 'Add-VivaModuleFeaturePolicy'.
VERBOSE: Exporting cmdlet 'Get-VivaModuleFeature'.
VERBOSE: Exporting cmdlet 'Get-VivaModuleFeatureEnablement'.
VERBOSE: Exporting cmdlet 'Get-VivaModuleFeaturePolicy'.
VERBOSE: Exporting cmdlet 'Remove-VivaModuleFeaturePolicy'.
VERBOSE: Exporting cmdlet 'Update-VivaModuleFeaturePolicy'.
VERBOSE: Exporting cmdlet 'Add-WorkforceInsightsDelegationAccess'.
VERBOSE: Exporting cmdlet 'Get-WorkforceInsightsDelegationAccess'.
VERBOSE: Exporting cmdlet 'Remove-WorkforceInsightsDelegationAccess'.
VERBOSE: Exporting cmdlet 'Get-VivaInsightsSettings'.
VERBOSE: Exporting cmdlet 'Set-VivaInsightsSettings'.
VERBOSE: Exporting cmdlet 'Set-MyAnalyticsFeatureConfig'.
VERBOSE: Exporting cmdlet 'Set-DefaultTenantMyAnalyticsFeatureConfig'.
VERBOSE: Exporting cmdlet 'Get-MyAnalyticsFeatureConfig'.
VERBOSE: Exporting cmdlet 'Get-DefaultTenantMyAnalyticsFeatureConfig'.
VERBOSE: Exporting cmdlet 'Add-VivaOrgInsightsDelegatedRole'.
VERBOSE: Exporting cmdlet 'Get-VivaOrgInsightsDelegatedRole'.
VERBOSE: Exporting cmdlet 'Remove-VivaOrgInsightsDelegatedRole'.
VERBOSE: Exporting cmdlet 'Get-CustomNudge'.
VERBOSE: Exporting cmdlet 'New-CustomNudge'.
VERBOSE: Exporting cmdlet 'Remove-CustomNudge'.
VERBOSE: Exporting cmdlet 'Set-CustomNudge'.
VERBOSE: Exporting cmdlet 'Get-CustomNudgeSettings'.
VERBOSE: Exporting cmdlet 'Set-CustomNudgeSettings'.
VERBOSE: Exporting cmdlet 'Get-CustomNudgeAssignment'.
VERBOSE: Exporting cmdlet 'Remove-CustomNudgeAssignment'.
VERBOSE: Exporting cmdlet 'New-CustomNudgeAssignment'.
VERBOSE: Exporting cmdlet 'Set-CustomNudgeAssignment'.
VERBOSE: Exporting cmdlet 'Get-DefaultTenantBriefingConfig'.
VERBOSE: Exporting cmdlet 'Get-UserBriefingConfig'.
VERBOSE: Exporting cmdlet 'Set-DefaultTenantBriefingConfig'.
VERBOSE: Exporting cmdlet 'Set-UserBriefingConfig'.
VERBOSE: Exporting cmdlet 'Add-EXOClientTelemetryWrapper'.
VERBOSE: Exporting cmdlet 'New-CmdletLogger'.
VERBOSE: Exporting cmdlet 'New-EXOClientTelemetryFilepath'.
VERBOSE: Exporting cmdlet 'Push-EXOTelemetryRecord'.
VERBOSE: Exporting cmdlet 'Clear-ActiveToken'.
VERBOSE: Exporting cmdlet 'Get-ConnectionContext'.
VERBOSE: Exporting cmdlet 'Get-ConnectionInformation'.
VERBOSE: Exporting cmdlet 'Get-EXOBanner'.
VERBOSE: Exporting cmdlet 'Get-HelpFiles'.
VERBOSE: Exporting cmdlet 'New-EXOModule'.
VERBOSE: Exporting cmdlet 'New-ExoPSSession'.
VERBOSE: Exporting cmdlet 'Test-ActiveToken'.
VERBOSE: Importing cmdlet 'Add-VivaModuleFeaturePolicy'.
VERBOSE: Importing cmdlet 'Add-VivaOrgInsightsDelegatedRole'.
VERBOSE: Importing cmdlet 'Get-ConnectionInformation'.
VERBOSE: Importing cmdlet 'Get-DefaultTenantBriefingConfig'.
VERBOSE: Importing cmdlet 'Get-DefaultTenantMyAnalyticsFeatureConfig'.
VERBOSE: Importing cmdlet 'Get-EXOCasMailbox'.
VERBOSE: Importing cmdlet 'Get-EXOMailbox'.
VERBOSE: Importing cmdlet 'Get-EXOMailboxFolderPermission'.
VERBOSE: Importing cmdlet 'Get-EXOMailboxFolderStatistics'.
VERBOSE: Importing cmdlet 'Get-EXOMailboxPermission'.
VERBOSE: Importing cmdlet 'Get-EXOMailboxStatistics'.
VERBOSE: Importing cmdlet 'Get-EXOMobileDeviceStatistics'.
VERBOSE: Importing cmdlet 'Get-EXORecipient'.
VERBOSE: Importing cmdlet 'Get-EXORecipientPermission'.
VERBOSE: Importing cmdlet 'Get-MyAnalyticsFeatureConfig'.
VERBOSE: Importing cmdlet 'Get-UserBriefingConfig'.
VERBOSE: Importing cmdlet 'Get-VivaInsightsSettings'.
VERBOSE: Importing cmdlet 'Get-VivaModuleFeature'.
VERBOSE: Importing cmdlet 'Get-VivaModuleFeatureEnablement'.
VERBOSE: Importing cmdlet 'Get-VivaModuleFeaturePolicy'.
VERBOSE: Importing cmdlet 'Get-VivaOrgInsightsDelegatedRole'.
VERBOSE: Importing cmdlet 'Remove-VivaModuleFeaturePolicy'.
VERBOSE: Importing cmdlet 'Remove-VivaOrgInsightsDelegatedRole'.
VERBOSE: Importing cmdlet 'Set-DefaultTenantBriefingConfig'.
VERBOSE: Importing cmdlet 'Set-DefaultTenantMyAnalyticsFeatureConfig'.
VERBOSE: Importing cmdlet 'Set-MyAnalyticsFeatureConfig'.
VERBOSE: Importing cmdlet 'Set-UserBriefingConfig'.
VERBOSE: Importing cmdlet 'Set-VivaInsightsSettings'.
VERBOSE: Importing cmdlet 'Update-VivaModuleFeaturePolicy'.
VERBOSE: Importing function 'Connect-ExchangeOnline'.
VERBOSE: Importing function 'Connect-IPPSSession'.
VERBOSE: Importing function 'Disconnect-ExchangeOnline'.

</details>


### Configuration

-OS: Windows 11
-Architecture: x64
-Not specific to this configuration. Tested on Windows Server 2019 x64 as well.
-$PSVersionTable:
Name                           Value
----                           -----
PSVersion                      5.1.26100.7920
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.26100.7920
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

### Other information

This appears to be a regression that was previously mitigated in ExO module 3.6.0.
Multiple community reports confirm load-order dependency and incompatibility.
See related issues: #3254, #3331

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the load-order issue with Import-Module ExchangeOnlineManagement and Import-Module Microsoft.Graph, then test Connect-ExchangeOnline and Connect-MgGraph with WAM enabled on the listed PowerShell versions. Review the related issues #3254 and #3331 and the existing discussion to determine the intended compatibility behavior. Done means both modules authenticate in one process, or the conflict produces a documented deterministic error.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
authentication
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.