Paging is a well described core part of graph API and should be part of the Invoke-GraphRequest function. If you're ok with this functionality, I am willing to add it.

Importing the module into a powershell 6.1 session throws an error due to dependency on System.Windows.Forms. Are there any plans or work underway to support pwsh.exe as a host?

thanks for your great work!

BG Christoph

Import-Module : Could not load file or assembly 'System.Windows.Forms, Culture=neutral, PublicKeyToken=null'. Das System kann die angegebene Datei nicht finden.
At line:1 char:1
+ Import-Module psmsgraph
+ ~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : InvalidOperation: (:) [Import-Module], FileNotFoundException
+ FullyQualifiedErrorId : FormatXmlUpdateException,Microsoft.PowerShell.Commands.ImportModuleCommand

Currently, the field 'expires' on my OathAccesstoken object is a few seconds before the current time, while it is actually valid for an hour. This means I cannot use the Expires property to check if I need to update the access token or not.

Looking into the code, in the type definition, I notice the following code
if ($This.Response.expires_on) { (get-date '1970/01/01 -0').AddSeconds($This.Response.expires_on) }
On my local machine (get-date '1970/01/01 -0') translates to Thursday, January 1, 1970 1:00:00 AM. (I'm currently on UTC + 2).

I assume expires_on uses UTC time.

In that case I expect the solution to be like this (if you want your users to use UTC):

if ($This.Response.expires_on) { (get-date '1970/01/01 -0').ToUniversalTime().AddSeconds($This.Response.expires_on) }

I didn't check if this issue also exists for the other datetime fields

Code coverage report:
Covered 0 % of 33 analyzed Commands in Add-AADAppRoleAssignment
Missed commands:

Similar to #31, I am running into the this problem suddenly

PSMSGraph Version: 1.0.26.43

Relevant code:
https://github.com/ReArmedHalo/DUST/blob/develop/DUST/public/Microsoft%20365%20Health%20Check%20Reports/Invoke-Microsoft365HealthCheck.ps1

Building the application in Azure AD: https://github.com/ReArmedHalo/DUST/blob/develop/DUST/private/Microsoft%20365%20Health%20Check/Support/New-DUSTAzureADApiApplication.ps1

Using PSMSGraph to get consent for permissions and an access token: https://github.com/ReArmedHalo/DUST/blob/develop/DUST/private/Microsoft%20365%20Health%20Check/Support/Get-DUSTAzureADApiApplicationConsent.ps1

VERBOSE: Retrieving OAuth Access Token from https://login.microsoftonline.com/common/oauth2/token... VERBOSE: POST https://login.microsoftonline.com/common/oauth2/token with -1-byte payload VERBOSE: received 4142-byte response of content type application/json; charset=utf-8 VERBOSE: Access Token: Guid: <blah> IsExpired 'True'

Everything was working fine about two weeks ago. I then came back in and tried to test a new report I was trying to grab and determined I could no longer get a valid token. I don't remember what that error was but I went through a few iteration of trying other code and ended up back here after a week of troubleshooting.

Code coverage report:
Covered 0 % of 29 analyzed Commands in Get-AADServicePrincipalAppRoleAssignedTo
Missed commands:

Code coverage report:
Covered 0 % of 21 analyzed Commands in Remove-AADAppRoleAssignment
Missed commands:

Code coverage report:
Covered 0 % of 19 analyzed Commands in Export-GraphOauthAccessToken
Missed commands:

Code coverage report:
Covered 93.33 % of 30 analyzed Commands in Get-AADGroupMember
Missed commands:

Code coverage report:
Covered 0 % of 38 analyzed Commands in Update-GraphOauthAccessToken
Missed commands:

Code coverage report:
Covered 0 % of 24 analyzed Commands in Get-AADServicePrinicpalbyDisplayName
Missed commands:

Code coverage report:
Covered 100 % of 12 analyzed Commands in New-GraphOauthAccessToken

I think the default of BaseUrl should default to end with "?" so that it is possible to provide a baseurl with custom added parameters. For instance i want to utilize the optional parameter "prompt=select_account" to force the user to get a prompt asking the user to select an account. At the moment the "?" is added on the line 69;

$Url = "{0}?response_type=code&redirect_uri={1}&client_id={2}" -f @(

So if I would provide the custom parameter in the baseurl it would be:
$BaseURL = ....\authorize?prompt=select_account&
which would result in the following concatinated string:
\authorize?prompt=select_account&?response_type=code&....

If the "?" is appended to the default baseurl and removed from the string-formater it would be possible to override the first parameter.

So if I then provide the same BaseUrl the resulting URL would instead be correct;
$BaseURL = ....\authorize?prompt=select_account&
\authorize?prompt=select_account&response_type=code&....

Thanks!

Code coverage report:
Covered 66.67 % of 60 analyzed Commands in Get-GraphOauthAccessToken
Missed commands:

Code coverage report:
Covered 0 % of 23 analyzed Commands in Get-AADUserByID
Missed commands:

I am attempting to use the daemon methodology for making WebAPI calls to Azure Graph.

However, when setting -ForcePrompt to none, I get AADSTS50059 error: No tenant-identifying information found in either the request or implied by any provided credentials.

I believe this may have something to do with using the "common" URI and not supplying the tenant information.

I believe if a $tenantId variable is added to the objects, it will solve this issue. Other code will probably be needed around the IF looking for the ForcePrompt, ie: If ForcePrompt = none, insert tenantId in to BaseUrl.

I am not familiar with github and pull requests, otherwise, I would implement this and push the code here for a merge.

Please let me know if this is on the right track? I'm going to test it now.

Thank you for your hard work on this!!!

I noticed the other day that Invoke-graphrequest always calls Update-GraphOauthAccessToken. This surprises me, because if you call Invoke-graphrequest more than once per hour you're inefficient. The type of code I'd want to use (and actually implemented) is something like this:
While($true){ $GraphAccessToken = Import-GraphOAuthAccessToken -Path $PSScriptRoot'\AccessToken.XML' if($GraphAccessToken.IsExpired) { $GraphAccessToken | Update-GraphOAuthAccessToken } Invoke-GraphRequest }
However, the if clause is useless and in fact reduces the performance, because it performs an action that is already performed later on anyway. At the very least I'd expect this same if clause before the token is refreshed....
Is there a reason why you refresh the token before every call?

Code coverage report:
Covered 91.67 % of 24 analyzed Commands in Get-AADGroupByDisplayName
Missed commands:

Code coverage report:
Covered 0 % of 66 analyzed Commands in Invoke-GraphRequest
Missed commands:

Code coverage report:
Covered 0 % of 23 analyzed Commands in Get-AADUserByUserPrincipalName
Missed commands:

Code coverage report:
Covered 0 % of 53 analyzed Commands in Get-GraphOauthAuthorizationCode
Missed commands:

Code coverage report:
Covered 0 % of 29 analyzed Commands in Get-AADUserAppRoleAssignment
Missed commands:

Hi!

Not sure if this is in fact a bug or whatnot, but the scopes that I have set on the Azure App portal are not being granted to the GraphAccessToken.

The only permissions that are received are:
{Mail.ReadWrite, Mail.Send, offline_access, User.Read}

Is this the expected behaviour? Is there some way to control this?

Thanks!

Code coverage report:
Covered 0 % of 19 analyzed Commands in Export-GraphApplication
Missed commands:

Code coverage report:
Covered 64.71 % of 17 analyzed Commands in Import-GraphApplication
Missed commands:

You use $Global:MSGraphAPICurrentUri in that function, can you use $Script: scope instead? I think that should be global to all the scripts in your module (but I have not tested it).

Get-GraphOauthAccessToken : The remote server returned an error: (400) Bad Request.
At line:19 char:33
+ ... $AuthCode | Get-GraphOauthAccessToken -Resource 'https://graph.micros ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WebException
    + FullyQualifiedErrorId : System.Net.WebException,Get-GraphOauthAccessToken

Here is my code:

Import-Module -name 'PSMSGraph'
#In the credential prompt, provide your application's Client ID as the username and Client Secret as the password
$ClientCredential = Get-Credential
$GraphAppParams = @{
    Name = 'PowerShell Module'
    ClientCredential = $ClientCredential
    RedirectUri = 'https://localhost/'
    Tenant = 'mytenant.onmicrosoft.com'

}
$GraphApp = New-GraphApplication @GraphAppParams
# This will prompt you to log in with your O365/Azure credentials. 
# This is required at least once to authorize the application to act on behalf of your account
# The username and password is not passed back to or stored by PowerShell.
$AuthCode = $GraphApp | Get-GraphOauthAuthorizationCode
Write-Host $AuthCode
# see the following help for what resource to use. 
# get-help Get-GraphOauthAccessToken -Parameter Resource
$GraphAccessToken = $AuthCode | Get-GraphOauthAccessToken -Resource 'https://graph.microsoft.com'
$GraphAccessToken | Export-GraphOAuthAccessToken -Path 'c:\Temp\AccessToken.XML'

I've setup my app using the documentation found here:

http://thelazyadministrator.com/2018/03/20/connect-to-the-microsoft-graph-api-with-powershell/

Unsure why it's failing with bad request.

Code coverage report:
Covered 0 % of 26 analyzed Commands in Get-AADUserAll
Missed commands:

Code coverage report:
Covered 91.3 % of 23 analyzed Commands in Get-AADGroupByID
Missed commands:

Code coverage report:
Covered 83.72 % of 43 analyzed Commands in Import-GraphOauthAccessToken
Missed commands:

While writing this I kept digging deeper to find a solution, and I think I've got it, so I'd like to explain my thought process :)

I upgraded to PowerShell 7 today, and Update-GraphOauthAccessToken broke. After using Export-GraphOauthAccessToken and Import-GraphOauthAccessToken to export & import an access token, if you then try to update the token with Update-GraphOauthAccessToken, it fails with the error:

Update-GraphOauthAccessToken: Failed to refresh token: The format of value '' is invalid.
In PowerShell 5.1, this works fine.

I tracked the error down to the WebSession header in the Invoke-Webrequest call (line 102 of Update-GraphOauthAccessToken.ps1). Omitting that header fixed the issue. But since the header works fine in PowerShell 5.1, I looked into it a bit further.

I compared the Session property of an original access token and an imported token, and it seems the Session property loses the content of the UserAgent subproperty on serializing/deserializing.

Manually adding the user agent back fixed the issue. Next, I checked the XML that's saved to disk, and the user agent is present there, so the issue has to be with Import-GraphOauthAccessToken.ps1. I think I located a bug at line 110, which reads

$Session.UserAgent = $Application.UserAgent

If I'm not mistaken, this should be

$Session.UserAgent = $InObject.Session.UserAgent

This will properly deserialize the UserAgent property and keep Invoke-WebRequest happy :)

Code coverage report:
Covered 0 % of 23 analyzed Commands in Get-AADServicePrinicpalbyId
Missed commands:

Code coverage report:
Covered 100 % of 9 analyzed Commands in New-GraphApplication

I've re-created the app and tried all these steps as a regular user and admin in our tenant and on two different Win 10 workstations.

https://apps.dev.microsoft.com
Redirect URLs: 'https://localhost/'
Delegated Permissions: 'Mail.ReadWrite' and 'User.Read'
Application Permissions: 'Mail.ReadWrite (Admin Only)' and 'User.Read.All (Admin Only)'

My PowerShell:
$AppID = 'AzureAppGUID'
$AppSecret = ConvertTo-SecureString -String 'AzureAppPassword' -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ($AppID,$AppSecret)
$AppParams = @{
Name = 'MSGraph'
ClientCredential = $Credential
RedirectUri = 'https://localhost/'
Tenant = 'tenant.onmicrosoft.com'
}
$App = New-GraphApplication @AppParams
$AuthCode = Get-GraphOauthAuthorizationCode -Application $App
$AccessToken = Get-GraphOauthAccessToken -AuthenticationCode $AuthCode

Everything runs fine, but $AccessToken is expired when I create it and I can't use it for anything. Example:
GUID : TokenGUID
RequestedDate : 10/3/2018 4:24:50 PM
LastRequestDate : 10/3/2018 4:24:50 PM
IsExpired : True
Expires : 10/3/2018 4:24:51 PM
NotBefore : 10/3/2018 3:19:51 PM
Scope : {Mail.ReadWrite, User.Read}
Resource : https://graph.microsoft.com
IsRefreshable : True
Application : Guid: AppGUID Name: MSGraph

Interacting with the token by exporting it to a file, importing it from a file, and refreshing has no effect on the expiration.