1

I'm able to connect if I do this:

Connect-MgGraph -AccessToken $token 
Remove-MgUserMessage -UserId $email -MessageId $item.id

but I'm getting unauthorized errors when trying to delete an email.

I tried this as well:

Connect-MgGraph -AccessToken $token -Scopes "User.ReadWrite.All"
Remove-MgUserMessage -UserId $email -MessageId $item.id

But then I get this error:

Connect-MgGraph : Parameter set cannot be resolved using the specified named parameters.
At D:\Scripts\GraphAPITest2.ps1:159 char:1
+ Connect-MgGraph -AccessToken $token -Scopes "User.ReadWrite.All"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Connect-MgGraph], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : AmbiguousParameterSet,Microsoft.Graph.PowerShell.Authentication.Cmdlets.ConnectMgGraph

Is not allowed to combine the -AccessToken and the -Scopes parameter? I've been told that I've been given Mail.ReadWrite and ServiceMessageViewpoint.Write privileges.

When using a token, is it supposed to get all the scopes from the token? Or do you still have to tell the PowerShell program that your intent is to do an delete or update, and not just a read?

I've also posted this question about "Variants", but no reply yet: What are "variants" in Azure permissions

NealWalters
  • 17,197
  • 42
  • 141
  • 251

1 Answers1

3

If you connect by using a AccessToken there is no need to specify the scopes, as those are already defined in the token. After you did establish a connection you can verify which permissions the current session has with:

(get-mgcontext).Scopes

Once you authenticate to get the accessToken in the first step ensure that you have:

Scope         = 'https://graph.microsoft.com/.default'

in the body to automatically claim all permissions available to that identity.

Toni
  • 1,738
  • 1
  • 3
  • 11
  • That's great that I can display the scopes. It shows the ones that I need are not there; so back to my Azure guy to get him to do it properly. He said he gave me what I needed. – NealWalters Oct 10 '22 at 20:25
  • Solved - The issue was he was putting the permission under "Delegated" instead of "Application" (as we are using an access token). – NealWalters Oct 11 '22 at 20:22