Unable to connect to tenants via GDAP & Az or MG modules in AzAccounts 3.0.0 or later #25514
Labels
bug
This issue requires a change to an existing behavior in the product in order to be resolved.
customer-reported
needs-triage
This is a new issue that needs to be triaged to the appropriate team.
Description
Prior to AzAccounts 3.0.0, it was possible to connect to Az via GDAP, then request a token to connect to Microsoft.Graph.
For example, you could run the following:
$UPN = "username@domain.com"
$TenantID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
Connect-AzAccount -AccountID $UPN -TenantID $TenantID
Then you could run:
Get-AzAdUser
This would return a list of users in the tenant.
You could then obtain a token to connect to Microsoft Graph:
Connect-MgGraph -AccessToken (Get-AzAccessToken -ResourceTypeName MSGraph -TenantID $TenantID).token
Then you can run, for example:
Get-MgUser
And again this would return a list of users.
In the new version of AzAccounts using Powershell 5.1, it connects but errors when running, for example, Get-AzADUser:
Az.MSGraph.internal\Get-AzADUser : User was not found.
At C:\Program Files\WindowsPowerShell\Modules\Az.Resources\7.1.0\MSGraph.Autorest\custom\Get-AzADUser.ps1:212 char:9
Az.MSGraph.internal\Get-AzADUser @PSBoundParameters
CategoryInfo : InvalidOperation: ({ ConsistencyLe...= , Expand = }:<>f__AnonymousType5`7) [Get-AzADUse
r_List], Exception
FullyQualifiedErrorId : Authentication_Unauthorized,Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Cmdlets
.GetAzADUser_List
Using Powershell 7.2 returns:
Get-AzADUser_List: C:\Program Files\PowerShell\Modules\Az.Resources\7.2.0\MSGraph.Autorest\custom\Get-AzADUser.ps1:212
Line |
212 | Az.MSGraph.internal\Get-AzADUser @PSBoundParameters
| User was not found.
Then for Microsoft Graph, running the below will connect ok:
Connect-MgGraph -AccessToken ((ConvertTo-SecureString (Get-AzAccessToken -ResourceTypeName MSGraph -TenantID $TenantID).token -AsPlainText -Force))
But requesting any data fails, e.g.:
Get-MgUser : User was not found.
Status: 403 (Forbidden)
ErrorCode: Authentication_Unauthorized
Date: 2024-07-11T15:51:38
Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
client-request-id : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"West
Europe","Slice":"E","Ring":"5","ScaleUnit":"007","RoleInstance":"AM4PEPF000278F2"}}
Cache-Control : no-cache
Date : Thu, 11 Jul 2024 15:51:37 GMT
At line:1 char:1
Get-MgUser
CategoryInfo : InvalidOperation: ({ ConsistencyLe... , Headers = }:<>f__AnonymousType45`9) [Get-MgUser
_List], Exception
FullyQualifiedErrorId : Authentication_Unauthorized,Microsoft.Graph.PowerShell.Cmdlets.GetMgUser_List
And for Powershell 7.2:
Get-MgUser_List: User was not found.
Status: 403 (Forbidden)
ErrorCode: Authentication_Unauthorized
Date: 2024-07-11T15:45:04
Headers:
Cache-Control : no-cache
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
client-request-id : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"West Europe","Slice":"E","Ring":"5","ScaleUnit":"003","RoleInstance":"AM1PEPF00010596"}}
Date : Thu, 11 Jul 2024 15:45:03 GMT
Issue script & Debug output
Environment data
Module versions
Error output
The text was updated successfully, but these errors were encountered: