After creating an App Registration in Azure Active Directory with permissions like this:
I'm able to connect to Teams using:
$tenantName = ""
$clientId = ""
$clientSecret = ""
$username = ""
$password = ""
$uri = "https://login.microsoftonline.com/$tenantName/oauth2/v2.0/token"
$body = @{
Grant_Type = "password";
Scope = "https://graph.microsoft.com/.default"
Client_Id = $clientId;
Client_Secret = $clientSecret;
Username = $username;
Password = $password;
}
$graphTokenResponse = Invoke-RestMethod -Method POST -Uri $uri -Body $body
$graphToken = $graphTokenResponse.access_token
$body = @{
Grant_Type = "password" # client_credentials
Scope = "48ac35b8-9aa8-4d74-927d-1f4a14a0b239/.default"
Client_Id = $clientId
Client_Secret = $clientSecret
Username = $username
Password = $password
}
$teamsTokenResponse = Invoke-RestMethod -Method POST -Uri $uri -Body $body
$teamsToken = $teamsTokenResponse.access_token
Connect-MicrosoftTeams -AccessTokens @($graphToken, $teamsToken)
Get-CsCallQueue
Disconnect-MicrosoftTeams
But the Get-CsCallQueue call fails with:
MicrosoftTeams PowerShell Module 4.0.0 has been released
https://www.powershellgallery.com/packages/MicrosoftTeams/4.0.0
I've tested it with App Only Authentication (Certificate / ClientSecret). Still does not work
In my Microsoft Case [Case #:28612860] they said that the ETA will be early Q2 2022. I guess we still have to wait.
Regards Andres
Thanks for the link and comments. Still cannot get it working...
#Install-Modules
Install-Module JWTDetails #Not needed - just for debug
Install-Module MSAL.PS -MaximumVersion 4.36.1.2 -acceptlicense -SkipPublisherCheck -force
Install-Module MicrosoftTeams -MaximumVersion 3.0.0 -force
#Import Modules
Import-module -name JWTDetails
Import-Module MSAL.PS -MaximumVersion 4.36.1.2
Import-Module MicrosoftTeams -MaximumVersion 3.0.0
Get-Module
#Clear TokenCache
Clear-MsalTokenCache
#Prep
Add-Type -AssemblyName System.Web
$ImpersonationUPN="Email address removed"
$TenantID="TENANTNAME-OR-TENANTID"
$ApplicationID="REDACTED"
$ImpersonationUPN="Email address removed"
$ClientSecret="REDACTED"
#TeamsAccessToken
$Scope = "48ac35b8-9aa8-4d74-927d-1f4a14a0b239/.default"
$Token = Get-MsalToken -ClientId $ApplicationID -TenantId $TenantId -Scope $Scope -ClientSecret $(ConvertTo-SecureString -String $ClientSecret -AsPlainText -force)
$TeamsAccessToken = $Token.AccessToken
Get-JWTDetails $TeamsAccessToken
#GraphAccessToken
$Scope = "https://graph.microsoft.com/.default"
$Token = Get-MsalToken -ClientId $ApplicationID -TenantId $TenantId -Scope $Scope -ClientSecret $(ConvertTo-SecureString -String $ClientSecret -AsPlainText -force)
$GraphAccessToken = $Token.AccessToken
Get-JWTDetails $GraphAccessToken
#Connect To MS TEAMS
Connect-MicrosoftTeams -AccessTokens @($GraphAccessToken,$TeamsAccessToken) -AccountId $($impersonatedUser.id) -verbose #Error: Parameter set cannot be resolved using the specified named parameters.
Connect-MicrosoftTeams -LogLevel Verbose -LogFilePath %temp%\Connect-MSTeams.log -AccessTokens @($GraphAccessToken,$TeamsAccessToken)
notepad %temp%\Connect-MSTeams.log 
Debug:
2022-04-04T13:55:38.2302931Z,Error ,Connect-MicrosoftTeams.ProcessRecord,
System.NullReferenceException - Object reference not set to an instance of an object.. at Microsoft.TeamsCmdlets.Powershell.Connect.RMProfileClient.GetTokenClaimValue(JsonWebToken webToken, String value)
at Microsoft.TeamsCmdlets.Powershell.Connect.RMProfileClient.ProcessProvidedAccessTokens(AzureAccount account, String tenantId)
at Microsoft.TeamsCmdlets.Powershell.Connect.RMProfileClient.AcquireAccessToken(AzureAccount account, AzureEnvironment environment, String tenantId, SecureString password, AuthenticationFlow authFlow)
at Microsoft.TeamsCmdlets.Powershell.Connect.RMProfileClient.Login(AzureAccount account, AzureEnvironment environment, String tenantId, SecureString password, AuthenticationFlow authFlow)
Hi @sjackson340 ,
the part using a ClientID, ClientSecret, Username & Password worked for me, after changing the AppRegistrations Role Memberships and API Permissions.
Used Parts of the code @Andres Bohren mentioned here (https://techcommunity.microsoft.com/t5/teams-developer/authenticating-with-an-access-token-connect-m... :(
$tenantName = "<REMOVEDNAME>.onmicrosoft.com"
$clientId = "<APPREGISTRATION ID>"
$clientSecret = "<APPREGISTRATIONSECRET>"
$username = "<MYSERVICEUSER>@<REMOVEDNAME>.onmicrosoft.com"
$password = "<MYPWD>"
$uri = "https://login.microsoftonline.com/$tenantName/oauth2/v2.0/token"
$body = @{
Grant_Type = "password";
#Grant_Type = "client_credentials";
Scope = "https://graph.microsoft.com/.default"
Client_Id = $clientId;
Client_Secret = $clientSecret;
Username = $username;
Password = $password;
}
$graphTokenResponse = Invoke-RestMethod -Method POST -Uri $uri -Body $body
$graphToken = $graphTokenResponse.access_token
$body = @{
Grant_Type = "password" # client_credentials
#Grant_Type = "client_credentials"
Scope = "48ac35b8-9aa8-4d74-927d-1f4a14a0b239/.default"
Client_Id = $clientId
Client_Secret = $clientSecret
Username = $username
Password = $password
}
$teamsTokenResponse = Invoke-RestMethod -Method POST -Uri $uri -Body $body
$teamsToken = $teamsTokenResponse.access_token
Connect-MicrosoftTeams -AccessTokens @($graphToken, $teamsToken)
The App Registration itself i've extented with the following Delegated Rights:
and as this step has to be done by Exchange Management (Dokumented by MS here), i've added the Appregistration to the Teams administrators, thinking, this cloud be the right step, as it's also needed for EXO Management. (i'm using the same AppRegistration for EXO Management)
After the connect...
... i was able to create new Teams...
.. and also Query the CSOnlineUser Data...
also the new Set-CSOnlineVoiceUser seems to work - but i've got no tenant numbers in my development tenant right now :)
But i totally agree with @Andres Bohren statement, that this has to work with Application Permissions only in combination using a certificate as authenticator as well! Please guys @microsoft-msteams fix this!
BR
@Vishal170 App-based authentication appears to be working as of MicrosoftTeams PowerShell module 4.7.1-preview. MS Graph cmdlets work fine, however there still appear to be issues with CS cmdlets. I now get the following error when I attempt to run Get-CsOnlineUser:
I get the same error regardless of whether the WinRM service is running on my local PC.