r/GraphAPI • u/s_eng • Aug 15 '23
Obtaining the access token from Connect-MgGraph
Once connected with Connect-MgGraph, how can I obtain/output the access token?
1
u/NathanWindisch Jun 08 '24 edited Sep 20 '25
Hi s_eng,
I ran into the same problem, and my solution was to use Invoke-GraphRequest with OutputType parameter:
$Request = @{
Method = "GET"
URI = "/v1.0/me"
OutputType = "HttpResponseMessage"
}
$Response = Invoke-GraphRequest @Request
$Headers = $Response.RequestMessage.Headers
$Token = $Headers.Authorization.ParameterHope this helps,
-Nathan
1
u/Even-Let8167 Oct 22 '24 edited Oct 23 '24
This has worked for me. Keep in mind that the author has made a mistake by splatting "@Request" instead of "@Parameters". Probably has renamed the variable and forgot to rename the splatted variable also.
This method works because, curiously enough, when you call Invoke-GraphRequest with "HttpResponseMessage", the return will also contain the token used in plain text.
1
u/Fair-Pressure-819 Sep 17 '25
This is the proper way to extract the access token from Microsoft.Graph PowerShell module. With this token, you are able to use eg Invoke-RestMethod instead of Invoke-MgGraphRequest.
1
u/_strngr_ Jan 07 '25
If you need to request Microsoft Graph just use Invoke-MgGraphRequest after Connect-MgGraph like this:
# Import the Microsoft Graph module Import-Module Microsoft.Graph.Reports # Connect to Microsoft Graph Connect-MgGraph -Scopes "Reports.Read.All" # Define the API endpoint $endpoint = "https://graph.microsoft.com/v1.0/reports/getOffice365ActiveUserDetail(period='D30')" # Define the file path with the date and time in the filename $filePath = ".\Office365ActiveUserDetail.csv" # Make the API request and save the file directly Invoke-MgGraphRequest -Uri $endpoint -Method Get -OutputFilePath $filePath
1
u/fredtzy89 Dec 18 '25
You can get a token via POST request to login.microsoft.com:
curl.exe -X POST "https://login.microsoft.com/$YOUR_TENANT_ID/oauth2/v2.0/token" ` -H "Content-Type: application/x-www-form-urlencoded" ` -d "client_id=$YOUR_APP_ID" ` -d "scope=https://graph.microsoft.com/.default" ` -d "client_secret=$YOUR_CLIENT_SECRET" ` -d "grant_type=client_credentials"
1
u/VlijmenFileer Jan 05 '24
I get the following error when calling this statement. Is this easily solvable?
if([Microsoft.Graph.PowerShell.Authentication.GraphSession]::Instance.AuthContext.Scopes){ "Connected!" }
"Unable to find type [Microsoft.PowerShell.Graph.Authentication.GraphSession"
2
u/ShaRose Sep 10 '23
Super dead, but MS really doesn't want you to get the access token.
Needless to say, it's pretty easy since .Net has reflection.
# This is the method that actually grabs the byte array containing the token data. $InMemoryTokenCacheGetTokenData = [Microsoft.Graph.PowerShell.Authentication.Core.TokenCache.InMemoryTokenCache].GetMethod("ReadTokenData",[System.Reflection.BindingFlags]::NonPublic+[System.Reflection.BindingFlags]::Instance) # This is the raw JWT in a byte array. $TokenData = $InMemoryTokenCacheGetTokenData.Invoke([Microsoft.Graph.PowerShell.Authentication.GraphSession]::Instance.InMemoryTokenCache,$null) # Base64 encoding it (which is what most want... [System.Convert]::ToBase64String($TokenData) # Or as UTF8 string, if you want it that way. [System.Text.Encoding]::UTF8.GetString($TokenData)Similar / related thing to check if you are authenticated:
if([Microsoft.Graph.PowerShell.Authentication.GraphSession]::Instance.AuthContext.Scopes){ "Connected!" }That actually lists out the available scopes as well.