Tenant Governance, GDAP, Powershell Graph and WAM

Question

Tenant Governance, GDAP, Powershell Graph and WAM

MrAzureAD 81

Hey folks,

Newer versions of Powershell Graph use WAM for the sign-in and this can no longer be disabled. I configured tenant governance and delegated access to the governed tenant via GDAP works.

But WAM apparently does not support GDAP. There is an issue on Github about that behaviour: https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3613

The provided workaround (deviceCodeFlow OR older version) is hardly usable.

I found a better workaround: Az module can be used, because WAM can be disabled here. The accesstoken can then be handed over Connect-MgGraph.

This works today, but it is unclear to me if this is really sustainable or if WAM will be deactivated in Az module eventually, too.

Also it would be interesting to understand if GDAP support will be added to WAM / powershell graph sdk.

Greetings,

Tobias

0 comments

1 answer

Your answer

Answer 1

Use a custom Microsoft Graph PowerShell application ID with Set-MgGraphOption -DisableLoginByWAM $true; disabling WAM is now documented for custom client IDs, although this configuration still needs validation against your GDAP relationship and customer-side application consent.

Preferred path: disable WAM directly in Graph PowerShell

The WAM switch has an important condition: it takes effect only when Connect-MgGraph uses a custom ClientId; the default Microsoft Graph PowerShell client continues to use WAM. The setting persists across PowerShell sessions.^1^

Register a public-client application for Graph PowerShell and configure:
- A public-client redirect URI of http://localhost.
- The WAM redirect URI ms-appx-web://Microsoft.AAD.BrokerPlugin/<YOUR_APP_CLIENT_ID>.
- The required delegated Microsoft Graph permissions.^2^
Ensure the partner-managed application is consented in the customer tenant for the delegated Graph permissions you require. GDAP and application consent are separate:
- GDAP assigns the partner user the applicable Microsoft Entra roles.
- OAuth consent authorizes the application’s delegated permissions.
Under GDAP, the customer—or an administrator acting on behalf of the customer—must consent to the partner-managed application’s use in that tenant.^3^
Disable WAM and connect with that application:

$customerTenantId = "<customer-tenant-id>"
$clientId         = "<custom-public-client-app-id>"
$scopes           = @("User.Read.All")

Set-MgGraphOption -DisableLoginByWAM $true

Connect-MgGraph `
    -ClientId $clientId `
    -TenantId $customerTenantId `
    -Scopes $scopes `
    -ContextScope Process

Get-MgContext | Select-Object ClientId, TenantId, AuthType, Scopes

Confirm that ClientId is your custom application and TenantId is the governed customer tenant.

This is a documented method for disabling WAM, but the documentation discusses custom clients generally and sovereign-cloud fallback specifically; it does not explicitly certify the complete GDAP scenario. Test it with one governed tenant before adopting it broadly. There is also conflicting wording in Get-MgGraphOption documentation saying WAM cannot be disabled, whereas the more specific Set-MgGraphOption documentation defines the custom-client exception.^4^

Sustainability of the Az token handoff

Your Az approach uses documented public interfaces:

Az PowerShell supports disabling WAM with Update-AzConfig -EnableLoginByWam $false.^5^
Get-AzAccessToken -ResourceTypeName MSGraph obtains a Graph token.^6^
Connect-MgGraph -AccessToken accepts an externally obtained token, but your script must acquire another token after it expires.^7^

Current cmdlet documentation describes the token as a SecureString:

Update-AzConfig -EnableLoginByWam $false
Connect-AzAccount -Tenant "<customer-tenant-id>"

$token = Get-AzAccessToken -ResourceTypeName MSGraph `
                           -TenantId "<customer-tenant-id>"

Connect-MgGraph -AccessToken $token.Token

There is version-dependent inconsistency between Az.Accounts and Microsoft.Graph.Authentication. If that produces IDX14102: Unable to decode the header, use the documented conversion for affected combinations:^8^

$token = Get-AzAccessToken -ResourceTypeName MSGraph `
                           -TenantId "<customer-tenant-id>"

$plainToken = ConvertFrom-SecureString `
    -SecureString $token.Token -AsPlainText

Connect-MgGraph -AccessToken $plainToken

This is viable today, but there is no published guarantee that Az PowerShell will retain the WAM-disable option indefinitely. Pin and test both module versions if this forms part of an operational tool.

GDAP/WAM product status

Issue #3613 is closed, but no public fixed-version statement or roadmap commitment for GDAP with WAM is identified. Its documented workarounds remain device code, a native account in the customer tenant, or Graph PowerShell 2.25.0.^9^

For an authoritative future-support commitment, open a Microsoft support case and ask whether the custom-client non-WAM path is supported for your GDAP deployment. Also request clarification from the maintainers on issue #3613 or a new linked SDK issue. Release notes can identify a shipped change, but they are not a roadmap commitment.^10^

References