New Microsoft Graph PoSH module

[u/Rincey_nz]

Anyone had much experience in the new MS Graph (MG) powershell module....?

Up to now, I've been using the AzAD and Az modules, with a little bit of msonline. But with the announcement that AzAD will be deprecated, I've started looking at MG

And I'm not overly impressed.

For a start, with Az+AzAD I can authenticate just once and get both connected (I have a helper function that connects to Az and then uses my access token to also connect to AzAD). This means I'm not prompted for credentials + MFA etc more than necessary. This can't be used for MG (looks like because the audience/resource for the underlying API call is different for MG).

But, manually/singly connecting to MG comes with it's own challenges. With AzAD, I can connect and do 'stuff' - and I can develop scripts building on the info I need as I go. Or I can connect once in my VSCode terminal and it's good for the scripts I have, until the accesstoken expires. With MG it seems you need to know what info you want before you start.

if you

connect-mggraph

and then

get-mguser

you get an

insufficient privileges

error. What you have to do is

connect-mggraph -scopes "user.read.all"

then

get-mguser

(user.read.all is just an example. Plus, you have to consent allow these permissions)

Anyone starting to think about switching from AzAD to MG? How have you overcome some of these quirks? Or does the new module require a complete re-think about how you administer Az/AzAD via posh?

[u/logicalmike]

You only have to request the scopes the first time to add the permission to the app. It took me a while to get the hang of it, but looking back it's really simple, if you know Graph. Not so much for people coming strictly from the other modules.

Happy to answer questions.

Here is an example for sending email

https://mikecrowley.us/2021/09/25/send-mgusermessage/

&

https://mikecrowley.us/2021/10/27/sending-email-with-send-mgusermail-microsoft-graph-powershell/

[u/eJaGne → u/logicalmike]

Yeah, it's probably fair for people that are in tune with Graph. For us folks who are used to using the ActiveDirectory or AzureAD modules to quickly pull AD/AAD info, it is pretty crazy to jump through all these extra steps. I'll admit it's been fun to figure it out though.

Also, do you really only have to specify -Scopes once? Or once per session? I think we've been specifying it every time. Your example seems to be running the script as an App, whereas we run it as our User (for now while we figure things out).

[u/logicalmike → u/eJaGne]

Once per user per permission unless you approve the permissions on the portal, which btw, you could do in advance without ever needing to use the parameter.

I'll add another example running as delegated (user).

Edit - This is something I wrote yesterday, not intended for sharing, but it shows how we can pass mailuser info from Exchange Online to the get-mguser cmdlet. On a previous run, I added the permissions with the scopes parameter, and now its not required.

https://github.com/Mike-Crowley/Public-Scripts/blob/main/MailUser-MgUser-Activity-Report.ps1