Supported way to get the token #3806

Activity

1. Stephan van Rooij (svrooij)

   added

   status:waiting-for-triageAn issue that is yet to be reviewed or assignedAn issue that is yet to be reviewed or assigned

   type:featureNew experience requestNew experience request

   on Sep 30, 2026
2. svrooij commented on Sep 30, 2026

   

   Stephan van Rooij (svrooij)

   on Sep 30, 2026

   ContributorAuthor

   More actions

   Mike Crowley (@Mike-Crowley) something like this ☝️

   ❤️React with ❤️1Reacted by Mike Crowley
3. Mike-Crowley commented on Sep 30, 2026

   

   Mike Crowley (Mike-Crowley)

   on Sep 30, 2026

   More actions

   +1, thanks for the ping. SecureString sounds right: Connect-MgGraph -AccessToken already takes one, so tokens could move between sessions without unwrapping. One thought on -Scope: a different scope is a new request through the credential (and possibly a prompt), not a cache read, so it may be worth keeping separate from cached-or-fresh. Confirmed the GraphSession trick now fails on 2.41.0 with "Unable to find type", which makes your case.
4. ld0614 commented on Oct 6, 2026

   

   Leo D'Arcy (ld0614)

   on Oct 6, 2026

   More actions

   Az CLI and PowerShell modules already have this capability and it's really useful. While it's possible to use Get-AzAccessToken it would be useful if this was embedded into the graph module rather than having to install a second module set + additional Auth, just for this command
5. Mike-Crowley commented on Oct 14, 2026

   

   Mike Crowley (Mike-Crowley)

   on Oct 14, 2026

   Last edited by Mike-Crowley

   More actions

   Quick data point while this is open: on 2.41.1 and 2.41.2 (PS 7.6.7) the GraphSession type literal still fails, and the request-header route works as an interim. I tested with a fabricated token passed to Connect-MgGraph -AccessToken, so Graph returned 401, but the outgoing request carried the session token:

   $params = @{
       Uri                = 'v1.0/me'
       OutputType         = 'HttpResponseMessage'
       SkipHttpErrorCheck = $true   # app-only sessions get an error from /me, but the request still carries the token
   }
   $token = (Invoke-MgGraphRequest @params).RequestMessage.Headers.Authorization.Parameter

   That leaves a plain string in a variable, which is the logging risk a SecureString-returning Get-MgAccessToken would avoid, so I still think the command is worth adding.

   🤖 Drafted and posted by Claude (Claude Code) on behalf of Mike Crowley (@Mike-Crowley).
6. Mike-Crowley commented on Oct 19, 2026

   

   Mike Crowley (Mike-Crowley)

   on Oct 19, 2026

   More actions

   For history: this is the same ask as #2023 (open since May 2023, 23 comments). The main objection there was that an exposed token invites reuse against other APIs and then fails under Conditional Access or CAE; a SecureString return plus a doc note that the token is bound to the current Graph session answers most of it. The HttpResponseMessage header route was also first posted there, in April 2024.

   🤖 Claude Mythos 5.1 (max effort) via Claude Code