I have written graph API to fetch user detail from the Sharepoint Online

Connect-PnPOnline -Url $SPSiteURL -Credentials $PnPSPOCreds -Scopes "Group.Read.All", "User.Read.All"
$apiUrl = "https://graph.microsoft.com/v1.0/users"

#Get list of Team  
$myPrfoile = (Invoke-RestMethod -Headers @{Authorization = "Bearer $accessToken"} -Uri $apiUrl -Method Get).value

However, due to scopes define in Connect-PnPOnline, its always popup window for Sharepoint online credential. Note: This code will run by window task scheduler.

  • check my updated answer, it will take you to the solution ;)
    – Alberto S.
    Nov 8, 2019 at 12:30

4 Answers 4


Did you try this ?

This PowerShell sample demonstrates how to use the Office Dev PnP PowerShell to connect to the Microsoft Graph using Application Permissions. Using application permissions is useful for automated tasks and service scenarios where you don't have an end-user logging in.

Github sample repo


You can use the windows credential manager to store credentials.

Open your control panel, and open the Credential Manager.

Select "Windows Credentials" Then, "Add a Generic credential"

On the "Internet or Network address" line, add a label (I'll use "TestLabel" in this example) instead of a URL. This can be called from your PNP-Powershell Script with :

Get-Credential -Credential:TestLabel

Don't forget to store the Username and Password you need.



  • I am trying to use the same method with "Connect-SPOService" without success. Any suggestion ? thanks
    – Alberto S.
    Feb 26, 2019 at 9:44
  • Just found out that using the method "Get-StoredCredential" will solve the problem I described before. I will add it as an aswer
    – Alberto S.
    Feb 26, 2019 at 10:51

In case you are using PnP-Powershell, and connecting to sharepoint online withou any special scopes, you can:

  • provide appId & appSecret (needs to register an app in azure)
  • provide a credential object:
    $securepass = convertto-securestring $mypassword-asplaintext -force
    $credentials = New-Object -TypeName System.Management.Automation.PSCredential($user, $securepass ) 
  • use stored credentials in you windows environment ( you will need to leverage of the Credential-manager module:
Install-Module -Name CredentialManager
Connect-PnPOnline -Url $SPSiteURL -Credentials $(Get-Credential -Credentials:[MyLabel])

In case you are using special scopes, like

Connect-PnPOnline -Url "$mysite" -Scopes @("Group.ReadWrite.All", "User.ReadWrite.All", "Directory.ReadWrite.All") -credentials $($my_cred) 

It doesnt matter if you provide the credentials, you will be always prompted for a login. EDIT: You can apply this workaround, however, you will still need to use the scope command for certain scenarios, therefore, you will get a prompt. Sorry

  • Removes the scopes
  • Create / register an app in you azure and grant it any api permissions you may need.
  • Generate a secret token for such appId
  • Go to https://.sharepoint.com/_layouts/15/appinv.aspx
  • Use the use the previous AppId in the lookupfield. Set domain to localhost & redirect to http://localhost ( or any other value you may need ). Fill up the "App's Permission Request XML" with the required permissions, some examples here:
    <AppPermissionRequests AllowAppOnlyPolicy="true">
       <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />


<AppPermissionRequests AllowAppOnlyPolicy="true">
       <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="Read"/>
       <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="Write"/>

There is no way to get Graph access token passing a Url parameter to this command. If you check the official documentation you will see that there is no Graph option when passing the URL parameter.

The only way you can use Graph API and automate it is using "AppId" and "AppSecret" parameters with the domain URL. Please, check this sample to get an idea of how to use it or use the following example to get a quick idea:

Connect-PnPOnline -AppId '<id>' -AppSecret '<secret>' -AADDomain 'contoso.onmicrosoft.com'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.