Non-interactive authentication does not work when used from a PowerShell script

[AnatoliB]

The following script fails:

Import-Module Microsoft.Graph.Authentication
Import-Module Microsoft.Graph.Users.User

Connect-Graph -TenantId [REDACTED] -ClientId [REDACTED] -CertificateName [REDACTED] -CertificateThumbprint [REDACTED]

Get-MgUser

Connect-Graph succeeds, but Get-MgUser reports the following error: Authentication needed, call Connect-Graph.

Exactly the same commands executed interactively on a PowerShell console run successfully, so this does not look like a configuration/environment issue. In order to repro:

1. Save this code into a test.ps1 file.
2. IMPORTANT: In a brand new PowerShell session, invoke test.ps1 like this: .\test.ps1 or this: & .\test.ps1. (If you run the Connect-Graph and Get-MgUser commands by invoking these commands one by one in a PowerShell console, or dot-sourcing the same script (. .\test.ps1), these commands succeed and the issue does not repro.)

As a workaround, inserting the following line immediately after Connect-Graph invocation fixes the problem:

$global:GraphAuthConfigId = $GraphAuthConfigId

While debugging this, we noticed that Get-MgUser cannot find the GraphAuthConfigId variable, even though it is definitely initialized by Connect-Graph. We can even print it out from the script scope, and the content looks correct. I suspect the variable is created in a way that makes it invisible in the Get-MgUser function scope, and this is why copying it into the global scope helps. Perhaps this should be fixed in the code that creates the variable.

[AnatoliB]

The variable is initialized at:

msgraph-sdk-powershell/src/Authentication/Authentication/Cmdlets/ConnectGraph.cs

Line 76 in e64d120

SessionState.PSVariable.Set(Constants.GraphAuthConfigId, authConfig);

Perhaps a PSVariable object should be created with a constructor that takes ScopedItemOptions, passing something like ScopedItemOptions.AllScope. I haven't tried this fix, just an idea.

[darrelmiller]

Hey @peombwa could you take a look at this, it is block usage in Azure Functions. Thanks.

[AnatoliB]

Please let us know if you have any ETA on this.