Easiest ways to get Access Tokens

Came across this post and wanted to bookmark it for myself. Has three ways of getting Access Tokens without any App Registrations.

The first option is a great, I wasn’t aware of it! So simple.

For the second option I use PowerShell. So Get-AzAccessToken it is for me.

Another option I found is to use the Graph PowerShell service principal that gets registered if you have used the Graph cmdlets. It gets installed the first time the cmdlets are used to connect. It’s appId is “14d82eec-204b-4c2f-b7e8-296a70dab67e” so using a function I wrote as part of a previous post I can do the following to get a token:

Get-MSDeviceToken -TenantId $tenantId -AppId $appId -Scope openid

1	Get-MSDeviceToken -TenantId $tenantId -AppId $appId -Scope openid

This is the function for completeness:

function Get-MSDeviceToken {
    param(
        [Parameter(Mandatory=$true)]
        [string]$TenantId,

        [Parameter(Mandatory=$true)]
        [Alias("ClientId")]
        [string]$AppId,

        [Parameter(Mandatory=$true)]
        [string]$Scope
    )

    $authUrl = "https://login.microsoftonline.com/$tenantId"

    # From https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code
    # Device authorization request
    $authBody = @{ 
        "tenant" = "$TenantId"; 
        "client_id" = "$AppId";
        "scope" = $Scope
    }

    $response = Invoke-RestMethod -Method POST -Uri "$authUrl/oauth2/v2.0/devicecode" -Body $authBody
    Write-Host $response.Message
    Set-Clipboard -Value $response.user_code
    $expiresMins = $response.expires_in / 60
    Write-Host "The code is copied to your clipboard for ease of use. It expires in $expiresMins minutes."

    $waitInterval = $response.interval

    # Authenticating the user
    $authBody2 = @{
        "tenant" = "$tenantId"; 
        "grant_type" = "urn:ietf:params:oauth:grant-type:device_code";
        "client_id" = "$appId";
        "device_code" = $response.device_code
    }

    $authStatus = "waiting"
    $response2 = $null
    while ($authStatus -eq "waiting") {
        # Try to get the access token. if we encounter an error check the reason. 
        # If the reason is we are waiting then sleep for some time. 
        # If the reason is the user has declined or we timed out then quit.  
        try {
            $response2 = Invoke-RestMethod -Method POST -Uri "$authUrl/oauth2/v2.0/token" -Body $authBody2
        } catch {
            switch (($Error[0].ErrorDetails.Message | ConvertFrom-Json).error) {
                "authorization_pending" {
                    Write-Host "Waiting $waitInterval seconds for browser authentication to complete."
                    Start-Sleep -Seconds $waitInterval
                }
                "authorization_declined" {
                    # Note to self: this does not work if I decline in the browser. Not sure what use-case this is supposed to capture. 
                    Write-Host "Quitting as authorization was declined in browser."
                    $authStatus = "failed"
                }
                "expired_token" {
                    Write-Host "Authentication timed out."
                    $authStatus = "failed"
                }
            }
        }

        if ($null -ne $response2) { $authStatus = "success" }
    }

    if ($authStatus -eq "failed") { $null } else { $response2 }
}

function Get-MSDeviceToken {

param(

[Parameter(Mandatory=$true)]

[string]$TenantId,

[Parameter(Mandatory=$true)]

[Alias("ClientId")]

[string]$AppId,

[Parameter(Mandatory=$true)]

[string]$Scope

)

$authUrl = "https://login.microsoftonline.com/$tenantId"

# From https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code

# Device authorization request

$authBody = @{

"tenant" = "$TenantId";

"client_id" = "$AppId";

"scope" = $Scope

}

$response = Invoke-RestMethod -Method POST -Uri "$authUrl/oauth2/v2.0/devicecode" -Body $authBody

Write-Host $response.Message

Set-Clipboard -Value $response.user_code

$expiresMins = $response.expires_in / 60

Write-Host "The code is copied to your clipboard for ease of use. It expires in $expiresMins minutes."

$waitInterval = $response.interval

# Authenticating the user

$authBody2 = @{

"tenant" = "$tenantId";

"grant_type" = "urn:ietf:params:oauth:grant-type:device_code";

"client_id" = "$appId";

"device_code" = $response.device_code

}

$authStatus = "waiting"

$response2 = $null

while ($authStatus -eq "waiting") {

# Try to get the access token. if we encounter an error check the reason.

# If the reason is we are waiting then sleep for some time.

# If the reason is the user has declined or we timed out then quit.

try {

$response2 = Invoke-RestMethod -Method POST -Uri "$authUrl/oauth2/v2.0/token" -Body $authBody2

} catch {

switch (($Error[0].ErrorDetails.Message | ConvertFrom-Json).error) {

"authorization_pending" {

Write-Host "Waiting $waitInterval seconds for browser authentication to complete."

Start-Sleep -Seconds $waitInterval

}

"authorization_declined" {

# Note to self: this does not work if I decline in the browser. Not sure what use-case this is supposed to capture.

Write-Host "Quitting as authorization was declined in browser."

$authStatus = "failed"

}

"expired_token" {

Write-Host "Authentication timed out."

$authStatus = "failed"

}

if ($null -ne $response2) { $authStatus = "success" }

}

if ($authStatus -eq "failed") { $null } else { $response2 }

}