How to connect MSOL in powershell using App Password?

%3CLINGO-SUB%20id%3D%22lingo-sub-221843%22%20slang%3D%22en-US%22%3EHow%20to%20connect%20MSOL%20in%20powershell%20using%20App%20Password%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-221843%22%20slang%3D%22en-US%22%3E%3CP%3Ehi%2C%3C%2FP%3E%3CP%3EMy%20global%20administrators%20are%20having%20MFA%20enabled%20account.%20Is%20there%20any%20possibility%20to%26nbsp%3Bauthenticate%20a%20user%26nbsp%3Bin%20MSOL%20using%20app%20password%3F%20or%20any%20other%20ways%20to%20connect-msolservice%26nbsp%3Bfor%20MFA%20account.%3C%2FP%3E%3CP%3E%3CSTRONG%3EIs%20there%20any%20possibilities%20to%20get%20the%20error%20as%20the%20account%20is%20MFA%20enabled%20while%20try%20to%20connect%20msol-service%3F%3C%2FSTRONG%3E.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-221843%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-221857%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20connect%20MSOL%20in%20powershell%20using%20App%20Password%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-221857%22%20slang%3D%22en-US%22%3E%3CP%3EApp%20passwords%20are%20NOT%20supported%2C%20simply%20use%20Connect-MsolService%20without%20any%20parameter%20to%20trigger%20the%20ADAL%20dialog%20and%20complete%20the%202FA%20challenge%20as%20normal.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-221846%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20connect%20MSOL%20in%20powershell%20using%20App%20Password%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-221846%22%20slang%3D%22en-US%22%3EMFA%20should%20work%2C%20My%20account%20is%20MFA%20and%20I%20don't%20have%20issues%20connecting%20to%20powershell.%20Make%20sure%20you%20have%20the%20latest%20powershell%20module%20installed.%20my%20accounts%20are%20connected%20to%20work%20account%20but%20one%20of%20them%20is%20domain%20joined%20not%20azure%20ad%20joined%20and%20still%20can%20connect.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-778875%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20connect%20MSOL%20in%20powershell%20using%20App%20Password%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-778875%22%20slang%3D%22en-US%22%3EBit%20of%20a%20catch-22%20that%20isn't%20it.%20One%20is%20recommended%20to%20turn%20on%20MFA%20except%20it%20makes%20automated%20scripts%20nigh%20on%20impossible%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-779766%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20connect%20MSOL%20in%20powershell%20using%20App%20Password%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-779766%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20have%20bypass%2Fexclusions%20that%20we%20can%20use%20for%20that%2C%20and%20almost%20anything%20you%20can%20do%20with%20the%20MSOL%20module%20is%20already%20possible%20via%20the%20Graph%20anyway.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-781305%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20connect%20MSOL%20in%20powershell%20using%20App%20Password%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-781305%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3Bahh%20yes%2C%20only%20recently%20started%20looking%20at%20Graph.%20To%20be%20honest%2C%20Graph%20is%20a%20bit%20of%20a%20sideways%20step%20or%20maybe%20slightly%20backwards%20compared%20to%20PowerShell%20cmdlets.%20I%20assume%20there%20is%20a%20strong%20case%20for%20using%20HTTP%20calls%20instead%20of%20cmdlets%3F%20It's%20almost%20as%20if%20cmdlets%20have%20fallen%20out%20of%20favour%20which%20is%20weird%20considering%20how%20much%20effort%20has%20gone%20into%20them.%20At%20least%20with%20Graph%2C%20permissions%20are%20under%20control.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-781897%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20connect%20MSOL%20in%20powershell%20using%20App%20Password%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-781897%22%20slang%3D%22en-US%22%3E%3CP%3EREST%20is%20supposedly%20more%20robust%2C%20they%20are%20actually%20working%20on%20redoing%20all%20the%20other%20PowerShell%20modules%20in%20such%20manner%20(Azure%20AD%20PowerShell%20is%20already%20a%20%22wrapper%22%20for%20Graph%20calls).%20But%20yeah%2C%20the%20Graph%20sucks%20when%20it%20comes%20to%20searching%2Ffiltering%20data%2C%20and%20definitely%20lacks%20the%20%22friendliness%22%20of%20PowerShell.%20It's%20a%20tool%20for%20devs%20mostly...%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

hi,

My global administrators are having MFA enabled account. Is there any possibility to authenticate a user in MSOL using app password? or any other ways to connect-msolservice for MFA account.

Is there any possibilities to get the error as the account is MFA enabled while try to connect msol-service?.

6 Replies
Highlighted
MFA should work, My account is MFA and I don't have issues connecting to powershell. Make sure you have the latest powershell module installed. my accounts are connected to work account but one of them is domain joined not azure ad joined and still can connect.
Highlighted

App passwords are NOT supported, simply use Connect-MsolService without any parameter to trigger the ADAL dialog and complete the 2FA challenge as normal.

Highlighted
Bit of a catch-22 that isn't it. One is recommended to turn on MFA except it makes automated scripts nigh on impossible
Highlighted

We have bypass/exclusions that we can use for that, and almost anything you can do with the MSOL module is already possible via the Graph anyway.

Highlighted

@Vasil Michev ahh yes, only recently started looking at Graph. To be honest, Graph is a bit of a sideways step or maybe slightly backwards compared to PowerShell cmdlets. I assume there is a strong case for using HTTP calls instead of cmdlets? It's almost as if cmdlets have fallen out of favour which is weird considering how much effort has gone into them. At least with Graph, permissions are under control.

Highlighted

REST is supposedly more robust, they are actually working on redoing all the other PowerShell modules in such manner (Azure AD PowerShell is already a "wrapper" for Graph calls). But yeah, the Graph sucks when it comes to searching/filtering data, and definitely lacks the "friendliness" of PowerShell. It's a tool for devs mostly...