Hi @[ADM] Thomas Jadot (GCLOUD)
You must be logged in to the calling app with an active user to request an access token for the Graph API. If you don't want it to pop up the login box, then you can try using ROPC flow to perform a silent login, but this will require you to hardcode the user password.
Or you can also call the /users/{id | UPN} API in app-only context to get the properties of the target user.
$tenantID = "tenant.onmicrosoft.com" #your tenantID or tenant root domain
$appID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" #the GUID of your app.
$client_secret = "verylongsecurestring" #client secret for the app
#Prepare token request
$url = 'https://login.microsoftonline.com/' + $tenantId + '/oauth2/v2.0/token'
$body = @{
grant_type = "client_credentials"
client_id = $appID
client_secret = $client_secret
scope = "https://graph.microsoft.com/.default"
}
#Obtain the token
Write-Verbose "Authenticating..."
try { $tokenRequest = Invoke-WebRequest -Method Post -Uri $url -ContentType "application/x-www-form-urlencoded" -Body $body -UseBasicParsing -ErrorAction Stop }
catch { Write-Host "Unable to obtain access token, aborting..."; return }
$token = ($tokenRequest.Content | ConvertFrom-Json).access_token
$authHeader = @{
'Content-Type'='application\json'
'Authorization'="Bearer $token"
}
$URI = 'https://graph.microsoft.com/v1.0/users/{id | UPN}?$select=givenname,surname,department,JobTitle,businessPhones,mobilePhone,preferredLanguage,displayName,mail,OfficeLocation'
Invoke-RestMethod -Uri $URI -Headers $authHeader -Method Get
Hope this helps.
If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.