How to avoid credential popup, to connect with graph API in the powershell script?

Question

I have written graph API to fetch user detail from the Sharepoint Online

Connect-PnPOnline -Url $SPSiteURL -Credentials $PnPSPOCreds -Scopes "Group.Read.All", "User.Read.All"
$apiUrl = "https://graph.microsoft.com/v1.0/users"

#Get list of Team  
$myPrfoile = (Invoke-RestMethod -Headers @{Authorization = "Bearer $accessToken"} -Uri $apiUrl -Method Get).value

However, due to scopes define in Connect-PnPOnline, its always popup window for Sharepoint online credential. Note: This code will run by window task scheduler.

Answer 1

Did you try this ?

This PowerShell sample demonstrates how to use the Office Dev PnP PowerShell to connect to the Microsoft Graph using Application Permissions. Using application permissions is useful for automated tasks and service scenarios where you don't have an end-user logging in.

Github sample repo

Answer 2

You can use the windows credential manager to store credentials.

Open your control panel, and open the Credential Manager.

Select "Windows Credentials" Then, "Add a Generic credential"

On the "Internet or Network address" line, add a label (I'll use "TestLabel" in this example) instead of a URL. This can be called from your PNP-Powershell Script with :

Get-Credential -Credential:TestLabel

Don't forget to store the Username and Password you need.

https://github.com/SharePoint/PnP-PowerShell/wiki/How-to-use-the-Windows-Credential-Manager-to-ease-authentication-with-PnP-PowerShell

https://cann0nf0dder.wordpress.com/2017/08/12/using-the-windows-credentials-manager-with-pnp-powershell/

Answer 3

In case you are using PnP-Powershell, and connecting to sharepoint online withou any special scopes, you can:

• provide appId & appSecret (needs to register an app in azure)
• provide a credential object:

    $securepass = convertto-securestring $mypassword-asplaintext -force
    $credentials = New-Object -TypeName System.Management.Automation.PSCredential($user, $securepass ) 

• use stored credentials in you windows environment ( you will need to leverage of the Credential-manager module:

Install-Module -Name CredentialManager
Connect-PnPOnline -Url $SPSiteURL -Credentials $(Get-Credential -Credentials:[MyLabel])

In case you are using special scopes, like

Connect-PnPOnline -Url "$mysite" -Scopes @("Group.ReadWrite.All", "User.ReadWrite.All", "Directory.ReadWrite.All") -credentials $($my_cred) 

It doesnt matter if you provide the credentials, you will be always prompted for a login. EDIT: You can apply this workaround, however, you will still need to use the scope command for certain scenarios, therefore, you will get a prompt. Sorry

• Removes the scopes
• Create / register an app in you azure and grant it any api permissions you may need.
• Generate a secret token for such appId
• Go to https://.sharepoint.com/_layouts/15/appinv.aspx
• Use the use the previous AppId in the lookupfield. Set domain to localhost & redirect to http://localhost ( or any other value you may need ). Fill up the "App's Permission Request XML" with the required permissions, some examples here:

    <AppPermissionRequests AllowAppOnlyPolicy="true">
       <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />
     </AppPermissionRequests>

or

<AppPermissionRequests AllowAppOnlyPolicy="true">
       <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="Read"/>
       <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="Write"/>
     </AppPermissionRequests>

• Save the changes, you will be taken to https://-your_site-.sharepoint.com/_layouts/15/appprincipals.aspx, in which you can see your app has been installed.
• Now you will be able to connect to Sharepoint online using the appId & appSecret and succesfully performing opertions like get-pnpsite etc.
• Go to https://-your_site-.sharepoint.com/_layouts/15/appprincipals.aspx a

Answer 4

There is no way to get Graph access token passing a Url parameter to this command. If you check the official documentation you will see that there is no Graph option when passing the URL parameter.

The only way you can use Graph API and automate it is using "AppId" and "AppSecret" parameters with the domain URL. Please, check this sample to get an idea of how to use it or use the following example to get a quick idea:

Connect-PnPOnline -AppId '<id>' -AppSecret '<secret>' -AADDomain 'contoso.onmicrosoft.com'