Get the information of the logged on user in O365 with GRAPH and Powershell.

[ADM] Thomas Jadot (GCLOUD) 21 Reputation points
2024-02-19T12:00:57.0266667+00:00

Hello, I want to get these properties for automatically create the signature in Outlook. I already created the GRAPH application with user.read permission and a client secret. I can get the token via the module MSAL-PS but I receive an authentication popup where I have only to choose the user nothing else (no password). But I'm already logged on with this user. Is it possible to avoid this popup? Pass directly the active user in the request? I'm logged on on a Windows 11 computer azure AD joined. I get the active token with $MSALToken = Get-MsalToken -ClientId $clientId -TenantId $TenantId -Scopes $scope $AuthHeader = @{'Authorization' = $MSALToken.CreateAuthorizationHeader()} I determine the attributes I need with $URI = 'https://graph.microsoft.com/v1.0/me?$select=givenname,surname,department,JobTitle,businessPhones,mobilePhone,preferredLanguage,displayName,mail,OfficeLocation' And I invoke my request with Invoke-RestMethod -Uri $URI -Headers $AuthHeader -Method Get

Windows for business | Windows Server | User experience | PowerShell
Microsoft Security | Microsoft Graph
0 comments No comments

Answer accepted by question author
CarlZhao-MSFT 46,456 Reputation points
2024-02-20T08:40:53.7866667+00:00

Hi @[ADM] Thomas Jadot (GCLOUD)

You must be logged in to the calling app with an active user to request an access token for the Graph API. If you don't want it to pop up the login box, then you can try using ROPC flow to perform a silent login, but this will require you to hardcode the user password.

Or you can also call the /users/{id | UPN} API in app-only context to get the properties of the target user.

$tenantID = "tenant.onmicrosoft.com" #your tenantID or tenant root domain
$appID = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" #the GUID of your app.
$client_secret = "verylongsecurestring" #client secret for the app
#Prepare token request
$url = 'https://login.microsoftonline.com/' + $tenantId + '/oauth2/v2.0/token'
$body = @{
    grant_type = "client_credentials"
    client_id = $appID
    client_secret = $client_secret
    scope = "https://graph.microsoft.com/.default"
}
#Obtain the token
Write-Verbose "Authenticating..."
try { $tokenRequest = Invoke-WebRequest -Method Post -Uri $url -ContentType "application/x-www-form-urlencoded" -Body $body -UseBasicParsing -ErrorAction Stop }
catch { Write-Host "Unable to obtain access token, aborting..."; return }
$token = ($tokenRequest.Content | ConvertFrom-Json).access_token
$authHeader = @{
   'Content-Type'='application\json'
   'Authorization'="Bearer $token"
}
$URI = 'https://graph.microsoft.com/v1.0/users/{id | UPN}?$select=givenname,surname,department,JobTitle,businessPhones,mobilePhone,preferredLanguage,displayName,mail,OfficeLocation'
Invoke-RestMethod -Uri $URI -Headers $authHeader -Method Get

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Was this answer helpful?


0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.