M365CertAuth

Author(s)

• PowerShell Community

Tags

Microsoft365 Azure Certificate Authentication Exchange SharePoint Graph PowerShell TenantManagement MultiTenant

Functions

Get-CertificateForAuth Show-CertificateAuthHelp Get-StoredTenants Show-StoredTenants Remove-StoredTenant Clear-StoredTenants

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

Version 1.2.20
- Fixed browser sign-in window not opening: disabled WAM (Web Account Manager) broker which fails in embedded/elevated terminals. Interactive auth now opens the system browser directly via Set-MgGraphOption -EnableLoginByWAM $false.
- Menu still shows immediately: Graph modules load only after you choose an option.

Version 1.2.17
- Add new tenant again uses device code flow: interactive browser often fails to open on first Connect-MgGraph in a fresh session (causing a hang). Device code is reliable and the message now clearly states to open https://microsoft.com/devicelogin and enter the code.

Version 1.2.16
- Tenant list now appears immediately: Graph modules load only after you select a tenant or "Add new tenant", so the menu no longer waits on module load
- Add new tenant now uses interactive browser flow so the Microsoft 365 sign-in/consent window opens automatically (no more device code unless you need it)
- Fixed Save-TenantInfo cache update using wrong variable ($finalArray)

Version 1.2.15
- Faster load: Microsoft Graph modules are now loaded on first use (Get-CertificateForAuth) instead of at import, so Import-Module M365CertAuth is much quicker
- Add new tenant: when adding a new tenant, the module now uses device code flow (-UseDeviceCode) and process scope so the correct account/tenant is chosen instead of reusing a cached Graph login

Version 1.2.14
- Fixed: When -TenantId is explicitly provided and cert auth fails, now throws clear error instead of falling back to interactive auth
- Fixed: Tenant ID not found in stored tenants now throws immediately instead of trying interactive setup
- Added detailed error messages with troubleshooting steps for certificate authentication failures
- Prevents broken interactive fallback that could cause Microsoft.Graph module version conflicts

Version 1.2.13
- Fixed nested array bug causing tenants to merge into single entry
- Added automatic flattening of corrupted nested array data
- Simplified JSON serialization to prevent double-wrapping arrays

Version 1.2.12
- Fixed bug where only one tenant was being remembered
- Fixed Where-Object returning $null on empty arrays breaking tenant storage
- Ensured JSON always saves as array format for multiple tenant support

Version 1.2.11
- Switched from DPAPI encryption to plain JSON for tenant storage
- Tenant config data (IDs, domains, thumbprints) is not sensitive - certificate private key is protected by Windows cert store
- Fixes "data may be corrupted or encrypted by different user" errors
- Works seamlessly across roaming profiles, different machines, and user sessions

Version 1.2.10
- Replaced Unicode box-drawing characters with ASCII-safe alternatives for PowerShell 5.1 compatibility
- Fixed encoding issues that caused parser errors on network shares
- All UI elements now use standard ASCII characters (+, -, |, =) for maximum compatibility
- Ensures module works correctly across all PowerShell versions and file systems

Version 1.2.9
- Fixed PowerShell 5.1 compatibility issues with file reading/writing
- Improved encryption/decryption error handling for corrupted data
- Added automatic backup of corrupted tenant storage files
- Fixed file encoding issues that caused "The data is invalid" errors
- Enhanced cross-version compatibility for file operations

Version 1.2.8
- Removed tenant limit - now supports unlimited stored tenants (previously limited to 20)
- Improved tenant selection menu - "Add new tenant" is now option 1 (first position)
- Enhanced UI with beautiful box-drawing characters, improved colors, and better formatting
- Redesigned Show-StoredTenants with structured display using box characters
- Improved Remove-StoredTenant and Clear-StoredTenants with consistent visual styling
- Better visual hierarchy and readability across all tenant management functions

Version 1.2.7
- Fixed critical issue where -TenantId parameter was not looking up stored tenant information
- When using -TenantId with a stored tenant, now properly uses certificate authentication without interactive prompts
- Improved tenant lookup logic to search stored tenants when TenantId is explicitly provided
- Enhanced error handling to preserve TenantId during certificate authentication fallback scenarios

Version 1.2.6
- Added cross-platform compatibility for PowerShell 7 and Windows PowerShell 5.1
- Fixed certificate export issues in PowerShell 7 by using .NET Export() method
- Replaced Export-PfxCertificate cmdlet with version-aware implementation
- Eliminated "Could not export certificate with private key" warning in PowerShell 7
- Maintained backward compatibility with Windows PowerShell 5.1

Version 1.2.5
- Fixed critical null reference error in SharePoint tenant detection
- Implemented proper SharePoint tenant URL detection using Get-MgSite root query
- Replaced unreliable domain pattern matching with direct Microsoft Graph API calls
- Improved error handling and removed complex fallback methods
- Enhanced SharePoint tenant name extraction for accurate admin URL generation

Version 1.2.4
- Fixed tenant storage array conversion issues
- Improved multi-tenant support (up to 20 tenants)
- Enhanced tenant selection menu with count display
- Streamlined authentication flow
- Clean session management to prevent wrong tenant operations

Version 1.2.3
- Removed fallback encryption methods for cleaner, more secure implementation
- Simplified encryption logic with proper assembly loading
- Enhanced help examples to use module-provided values (no more hardcoded placeholders)
- Improved connection examples with actual tenant properties

Version 1.2.2
- Fixed compatibility issue with System.Security.Cryptography.ProtectedData
- Added proper assembly loading for encryption support
- Updated help examples to use actual module-provided values instead of placeholders
- Enhanced connection examples with real tenant information

Version 1.2.1
- Enhanced help documentation with detailed tenant management workflow
- Improved function descriptions and usage examples
- Updated manifest to indicate Microsoft Graph dependencies
- Refined tenant management command documentation

Version 1.2.0
- Added tenant management with secure encrypted storage
- Automatic tenant selection menu for multi-tenant environments
- Certificate-based authentication bypass for stored tenants
- New functions: Get-StoredTenants, Show-StoredTenants, Remove-StoredTenant, Clear-StoredTenants
- Enhanced certificate validation and expiry handling for stored connections
- Supports up to 20 stored tenants with automatic cleanup
- Improved user experience with minimal login prompts

Version 1.1.2
- Removed emojis and glyphs from output for better compatibility across terminals
- Improved console output formatting with standard text characters

Version 1.1.1
- Added SharePointTenantName property for correct SharePoint URL detection
- Enhanced domain detection logic for multi-tenant scenarios

Version 1.1.0
- Added tenant information to return object (TenantName, PrimaryDomain, InitialDomain)
- Enhanced module to provide all necessary tenant context for consuming scripts
- Eliminates need for scripts to call Get-MgDomain themselves

Version 1.0.4
- Code cleanup and optimization
- Removed unnecessary validation checks that caused false warnings
- Streamlined module structure

Version 1.0.3
- Documentation cleanup and version update

Version 1.0.2
- Improved role assignment approach for better compatibility
- Added service principal propagation delay for better reliability
- Made Global Administrator role assignment optional with graceful failure handling
- Enhanced error handling to use warnings instead of hard failures

Version 1.0.1
- Fixed Exchange Online App-Only authentication by adding Exchange Administrator role assignment
- Enhanced role validation for existing app registrations
- Improved error handling for directory role assignments

Version 1.0.0
- Initial release
- Automated certificate creation and management
- App registration with comprehensive permissions
- Support for Exchange Online, SharePoint, Microsoft Graph, Teams, Azure, and Security & Compliance
- Enterprise-grade certificate validation and duplicate detection
- Automatic expired certificate cleanup
- Built-in help system with connection examples