Authenticating with an access token Connect-MicrosoftTeams

This error is most likely caused by the module trying to find the "UPN" value of the token, which is the user name of the respective account. Since the authorization flow takes place within the context of a user, the token has a UPN, which allows this flow to work. There is no user context or UPN involved with the client credentials, which leads to the credentials not working.

The Teams PowerShell module for Microsoft Teams has been released as a preview version (2.1.0) which supports modern authentication and is fully functional. The likelihood is that this version will be pushed through to general availability quite soon as a result of this fast process.
If you would like more information, please take a look at this link.

PhoneMe007 

MicrosoftTeams PowerShell Module 4.0.0 has been released 

https://www.powershellgallery.com/packages/MicrosoftTeams/4.0.0
I've tested it with App Only Authentication (Certificate / ClientSecret). Still does not work

In my Microsoft Case [Case #:28612860] they said that the ETA will be early Q2 2022. I guess we still have to wait.

Regards Andres

Update: Still no improvement on the App Only (Unattended) front in the latest MicrosoftTeams 3.0.0. module. The only reported working method is by using Delegate permissions as stated in the Docs under 'AccessTokens' parameter directions.

If someone has an ETA on setting CS policies in an unattended (or dare I say DSC manner), please post here

I'm trying to setup something similar in Softerra Adaxes, but I'm not getting very far

$clientId = ""  
$clientSecret = ""  
$tenantName = "tenant.onmicrosoft.com"
$tenantNameshort = ""
$tenantIdCode = ""
  
$graphResource = "https://graph.microsoft.com/"  
$graphtokenBody = @{  
   Grant_Type    = "client_credentials"  
   Scope         = "https://graph.microsoft.com/.default"  
   Client_Id     = $clientId  
   Client_Secret = $clientSecret  
}   
$graphTokenResponse = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantName/oauth2/v2.0/token" -Method POST -Body $graphtokenBody


$teamsResource = "https://api.interfaces.records.teams.microsoft.com"  
$teamstokenBody = @{  
   Grant_Type    = "client_credentials"  
   Scope         = "48ac35b8-9aa8-4d74-927d-1f4a14a0b239/.default"  
   Client_Id     = $clientId  
   Client_Secret = $clientSecret
  
}   
$TeamsTokenResponse = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantName/oauth2/v2.0/token" -Method POST -Body $teamstokenBody

Connect-MicrosoftTeams -TenantId $tenantId -AccessTokens @($graphTokenResponse.access_token,$TeamsTokenResponse.access_token)

I get this error:

Connect-MicrosoftTeams : Not supported tenant type.
At C:\scripts\connect-teams.ps1:27 char:1
+ Connect-MicrosoftTeams -TenantId $tenantId -AccessTokens @($graphToke ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : AuthenticationError: (:) [Connect-MicrosoftTeams], ArgumentException
    + FullyQualifiedErrorId : Connect-MicrosoftTeams,Microsoft.TeamsCmdlets.Powershell.Connect.ConnectMicrosoftTeams

If I try something along the lines of 

Connect-MicrosoftTeams -TenantId $tenantId -ClientId $clientId -Certificatethumbprint $certificateThumbprint 

 I get the following:

Connecting to remote server api.interfaces.records.teams.microsoft.com failed with the following error message : The WinRM client cannot process the request....

PhoneMe007 

I am pretty sure that this is the same problem that I am having. 

This is what I am doing.

For my test added a new user to my tenant with the global admin role and is configured it to use MFA. This is the only user that in the tenant that is configured this way.
In AzureAD I then added a new App Registration which was allocated the Application (client) ID of "71045f16-xxxx-xxxx-xxxx-xxxx".
To this App Registration I added a new secret that was assigned the Secret ID "314e6c61-xxxx-xxxx-xxxx-xxxxxxxxxxxxx" and the value "YDjZy--xx~xxxxxxxxxxxxxxx.xx.xxxxx".
I also added Policy.Read.All API Permission.

I then ran the following script which acquires the access_token that is used in the Connect-MicrosoftTeams command.

$clientId = "71045f16-xxxx-xxxx-xxxx-xxxx"  
$clientSecret = "YDjZy--xx~xxxxxxxxxxxxxxx.xx.xxxxx"  
$tenantName = "mydomain.onmicrosoft.com"  
$resource = "https://graph.microsoft.com/"  
$tokenBody = @{  
   Grant_Type    = "client_credentials"  
   Scope         = "https://graph.microsoft.com/.default"  
   Client_Id     = $clientId  
   Client_Secret = $clientSecret  
}   
$tokenResponse = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantName/oauth2/v2.0/token" -Method POST -Body $tokenBody  
Import-Module MicrosoftTeams
Connect-MicrosoftTeams -AadAccessToken $tokenResponse.access_token -AccountId mfaadmin@mydomain.net

Whatever command I try to run fails with the following error:

Get-CsCloudMeetingPolicy
   Get-CsOnlineSession : Run Connect-MicrosoftTeams before running cmdlets.
   At C:\Program Files\WindowsPowerShell\Modules\MicrosoftTeams\2.3.1\net472\SfBORemotePowershellModule.psm1:63 char:22
   +     $remoteSession = & (Get-CsOnlineSessionCommand)
   +                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   + CategoryInfo          : NotSpecified: (:) [Get-CsOnlineSession], UnauthorizedAccessException
   + FullyQualifiedErrorId : UnauthorizedAccessException,Microsoft.Teams.ConfigApi.Cmdlets.GetCsOnlineSession
 ``Invoke-Command : Cannot validate argument on parameter 'Session'. The argument is null or empty. Provide an argument
   that is not null or empty, and then try the command again.
  At C:\Program Files\WindowsPowerShell\Modules\MicrosoftTeams\2.3.1\net472\SfBORemotePowershellModule.psm1:2975 char:38
 + ...    -Session (Get-PSImplicitRemotingSession -CommandName 'Get-CsCloudM ...
 +                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 + CategoryInfo          : InvalidData: (:) [Invoke-Command], ParentContainsErrorRecordException
 + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.InvokeCommandCommand

When I run the Connect-MicrosoftTeams command with the standard credentials parameters, I am able to call all the powershell commands (that I tested with).
Is this the same issue, or should I open a separate thread?

Sridevi-MSFT  

Can you please suggest an alternative method if new "Connect-MicrosoftTeams" does not work using -AadAccessToken for executing Get-CsTenant or SFB commands?

We are blocked and not sure when the fix of 3.0.x will come ? Please help.