azurepowershellmicrosoft-graph-apiazure-powershell

Using update-mguser to add / update user's authentication email methods in powershell unattended script

I am attempting to use update-mguser in an unattended powershell script. I can't use New-MgUserAuthenticationEmail or update-MgUserAuthenticationEmail because they don't support application permissions types.

I'm trying to use the Notes complex paremeter properties section of the documentation section here: https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/update-mguser?view=graph-powershell-1.0

I can't seem to get the syntax correct for updating the Entra user object's Authentication EmailMethods properties. I need to pass a hash table but when I do I am getting a 400 error. Below is snippet from Microsoft documentation for update-mguser page referenced above.

AUTHENTICATION : authentication [EmailMethods <IMicrosoftGraphEmailAuthenticationMethod- []>]: The email address registered to a user for authentication. [Id ]: The unique identifier for an entity. Read-only. [EmailAddress ]: The email address registered to this user.

I have tried various hash tables but no luck:

$authenticationMethods = @{
        EmailMethods = @(
            @{
                EmailAddress = "newemail@example.com" 
            }
        )
    }

$authenticationMethods = @{
        EmailMethods = @{
                EmailAddress = "newemail@example.com"  
            }
    }
$authenticationMethods = @{
                EmailAddress = "newemail@example.com" 
    }


    
Update-MgUser -UserId $userId -Authentication $authenticationMethods
Solution

  • I agree with @user2250152, you can now update user's authentication methods with permissions of Application type.

    Initially, I added UserAuthenticationMethod.ReadWrite.All permission of Application type with consent as below:

    enter image description here

    Now. I ran below PowerShell script to connect Microsoft Graph as a service principal and set user's authentication method:

    $tenantID = "tenantId"
$appID = "appId"
$secretValue = "secret"
$ClientSecretPass = ConvertTo-SecureString -String $secretValue -AsPlainText -Force
$ClientSecretCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $appID, $ClientSecretPass

# Connect to Microsoft Graph with Client Secret
Connect-MgGraph -TenantId $TenantId -ClientSecretCredential $ClientSecretCredential

$userId = "userId"
$params = @{
    emailAddress = "devi@M365xxxxxxxx.onmicrosoft.com"
}

New-MgUserAuthenticationEmailMethod -UserId $userId -BodyParameter $params

    Response:

    enter image description here

    To confirm that, I checked the same in Portal where email authentication method added successfully as below:

    enter image description here

    To update this authentication method, I ran below PowerShell script:

    $userId = "userId"
$emailAuthenticationMethodId = "3ddfcfc8-9383-446f-83cc-3ab9be4be18f"

$params = @{
    emailAddress = "devi@contoso.com"
}

Update-MgUserAuthenticationEmailMethod -UserId $userId -EmailAuthenticationMethodId $emailAuthenticationMethodId -BodyParameter $params

    Response:

    enter image description here

    Azure Portal:

    enter image description here

    Regarding this Microsoft article, it's currently showing New-MgUserAuthenticationEmailMethod cmdlet is not supported by Application permissions. We’ve informed our internal team, and they are actively working on updating it. The update should be available within a few days. Thank you for pointing it out!