PowerShell Graph Authentication with Least Privilege

Choose the identity model

Use delegated authentication for interactive operator workflows and application permissions for unattended jobs. Do not grant a broad application role simply because it makes the first prototype easier.

Scope and protect access

Grant only the Graph permissions required by the query or mutation. Record consent, rotate credentials through the platform’s secret store, and keep client secrets out of source control and transcripts.

Connect-MgGraph -TenantId $TenantId -ClientId $ClientId -CertificateThumbprint $Thumbprint -NoWelcome
Get-MgContext | Select-Object TenantId, ClientId, Scopes

Make identity observable

Every scheduled report should record tenant, application identity, start time, and request outcome. This gives security and operations a shared trail when permissions or tenant configuration changes.

Operational checklist

• Choose delegated or application access intentionally.
• Use the smallest practical permission set.
• Store secrets and certificates outside scripts.
• Log identity context without exposing credentials.

Related technical articles