Access and Tokens

Tokens

Token	Used for	Lifetime	Obtained via	Can be revoked?
Access Token	Calling Azure APIs, like Microsoft Graph or Azure Resource Manager.	1h	Authorization Code flow (OAuth 2.0) Client Credentials flow (for apps) Device Code flow (CLI scenarios)	No
Refresh Token	Getting new access tokens without re-authenticating	1h		No
ID Token	Identifying the user (OpenID Connect)	Not limited, must be used once in 90 days		Yes

Authenticate

Microsoft Graph PowerShell

• Install Microsoft Graph

Install-Module Microsoft.Graph

• Login with credentials

Connect-MgGraph -Scopes "User.Read.All", "Group.ReadWrite.All"
Connect-MgGraph -Scopes "AuditLog.Read.All"

• Login with access token

Connect-MgGraph -AccessToken $AccessToken

• Login with device code flow

Connect-MgGraph -Scopes "User.Read.All", "Group.ReadWrite.All" -UseDeviceAuthentication

• Get user auth details

Get-MgContext

• Query permissions needed

Find-MgGraphCommand -command Get-MgUser | Select -First 1 -ExpandProperty Permissions

Device Code

The below example will authenticate to PowerShell (Application ID 1950a258-227b-4e31-a9cf-717495945fc2)

Microsoft Applications ID

Below list for some application IDs built in microsoft

Name	Application ID
Microsoft Azure PowerShell	1950a258-227b-4e31-a9cf-717495945fc2
Microsoft Azure CLI	04b07795-8ddb-461a-bbee-02f9e1bf7b46
Portal Azure	c44b4083-3bb0-49c1-b47d-974e53cbdf3c
Microsoft Office	d3590ed6-52b3-4102-aeff-aad2292ab01c

$body = @{
    "client_id" =     "1950a258-227b-4e31-a9cf-717495945fc2"
    "resource" =      "https://graph.microsoft.com"
}
$UserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
$Headers=@{}
$Headers["User-Agent"] = $UserAgent
$authResponse = Invoke-RestMethod `
    -UseBasicParsing `
    -Method Post `
    -Uri "https://login.microsoftonline.com/common/oauth2/devicecode?api-version=1.0" `
    -Headers $Headers `
    -Body $body
$authResponse

Go to device login microsoft.com/devicelogin and input the device code.

$body=@{
    "client_id" =  "1950a258-227b-4e31-a9cf-717495945fc2"
    "grant_type" = "urn:ietf:params:oauth:grant-type:device_code"
    "code" =       $authResponse.device_code
}
$Tokens = Invoke-RestMethod `
    -UseBasicParsing `
    -Method Post `
    -Uri "https://login.microsoftonline.com/Common/oauth2/token?api-version=1.0" `
    -Headers $Headers `
    -Body $body
$Tokens