I am creating a new script. The script is running unattended. The script doing a couple things, the important part here is: setting a new user a license and setting the new user mailbox Address book policy. The address book is an Exchange online task the license is Graph. I am getting an error.

How to reproduce the error:

1. connect to MgGraph, I am using this command

Connect-MgGraph -TenantId $tenantID -AppId $appID -CertificateThumbprint $CertificateThumbPrint -NoWelcome

do some work, Disconnect-MgGraph

2. Connect to Exchange online, in the same script:

Connect-ExchangeOnline -CertificateThumbPrint $CertificateThumbPrint -AppID $appID -Organization $tenantID -CommandName Get-EXOMailbox,Get-mailbox,Set-mailbox -SkipLoadingCmdletHelp -ShowBanner:$false

The command verbose debug output is this:

DEBUG:
using System;
using System.Net;
using System.Management.Automation;
using Microsoft.Win32.SafeHandles;
using System.Security.Cryptography;
using System.Runtime.InteropServices;
using System.Runtime.ConstrainedExecution;
using System.Runtime.Versioning;
using System.Security;

namespace Microsoft.PowerShell.Commands.PowerShellGet
{
public static class Telemetry
{
public static void TraceMessageArtifactsNotFound(string[] artifactsNotFound, string operationName)
{
Microsoft.PowerShell.Telemetry.Internal.TelemetryAPI.TraceMessage(operationName, new { ArtifactsNotFound = artifactsNotFound });
}

public static void TraceMessageNonPSGalleryRegistration(string sourceLocationType, string sourceLocationHash, string installationPolicy, strin
g packageManagementProvider, string publishLocationHash, string scriptSourceLocationHash, string scriptPublishLocationHash, string operationName)
{
Microsoft.PowerShell.Telemetry.Internal.TelemetryAPI.TraceMessage(operationName, new { SourceLocationType = sourceLocationType, SourceLoca
tionHash = sourceLocationHash, InstallationPolicy = installationPolicy, PackageManagementProvider = packageManagementProvider, PublishLocationHash = p
ublishLocationHash, ScriptSourceLocationHash = scriptSourceLocationHash, ScriptPublishLocationHash = scriptPublishLocationHash });
}

}

/// <summary>
/// Used by Ping-Endpoint function to supply webproxy to HttpClient
/// We cannot use System.Net.WebProxy because this is not available on CoreClr
/// </summary>
public class InternalWebProxy : IWebProxy
{
Uri _proxyUri;
ICredentials _credentials;

public InternalWebProxy(Uri uri, ICredentials credentials)
{
Credentials = credentials;
_proxyUri = uri;
}

/// <summary>
/// Credentials used by WebProxy
/// </summary>
public ICredentials Credentials
{
get
{
return _credentials;
}
set
{
_credentials = value;
}
}

public Uri GetProxy(Uri destination)
{
return _proxyUri;
}

public bool IsBypassed(Uri host)
{
return false;
}
}

[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
public struct CERT_CHAIN_POLICY_PARA {
public CERT_CHAIN_POLICY_PARA(int size) {
cbSize = (uint) size;
dwFlags = 0;
pvExtraPolicyPara = IntPtr.Zero;
}
public uint cbSize;
public uint dwFlags;
public IntPtr pvExtraPolicyPara;
}

[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
public struct CERT_CHAIN_POLICY_STATUS {
public CERT_CHAIN_POLICY_STATUS(int size) {
cbSize = (uint) size;
dwError = 0;
lChainIndex = IntPtr.Zero;
lElementIndex = IntPtr.Zero;
pvExtraPolicyStatus = IntPtr.Zero;
}
public uint cbSize;
public uint dwError;
public IntPtr lChainIndex;
public IntPtr lElementIndex;
public IntPtr pvExtraPolicyStatus;
}

// Internal SafeHandleZeroOrMinusOneIsInvalid class to remove the dependency on .Net Framework 4.6.
public abstract class InternalSafeHandleZeroOrMinusOneIsInvalid : SafeHandle
{
protected InternalSafeHandleZeroOrMinusOneIsInvalid(bool ownsHandle)
: base(IntPtr.Zero, ownsHandle)
{
}

public override bool IsInvalid
{
get
{
return handle == IntPtr.Zero || handle == new IntPtr(-1);
}
}
}

// Internal SafeX509ChainHandle class to remove the dependency on .Net Framework 4.6.
[SecurityCritical]
public sealed class InternalSafeX509ChainHandle : InternalSafeHandleZeroOrMinusOneIsInvalid {
private InternalSafeX509ChainHandle () : base(true) {}

internal InternalSafeX509ChainHandle (IntPtr handle) : base (true) {
SetHandle(handle);
}

internal static InternalSafeX509ChainHandle InvalidHandle {
get { return new InternalSafeX509ChainHandle(IntPtr.Zero); }
}

[SecurityCritical]
override protected bool ReleaseHandle()
{
CertFreeCertificateChain(handle);
return true;
}

[DllImport(“Crypt32.dll”, SetLastError=true)]

[SuppressUnmanagedCodeSecurity,
ResourceExposure(ResourceScope.None),
ReliabilityContract(Consistency.WillNotCorruptState, Cer.Success)]

private static extern void CertFreeCertificateChain(IntPtr handle);
}

public class Win32Helpers
{
[DllImport(“Crypt32.dll”, CharSet=CharSet.Auto, SetLastError=true)]
public extern static
bool CertVerifyCertificateChainPolicy(
[In] IntPtr pszPolicyOID,
[In] SafeX509ChainHandle pChainContext,
[In] ref CERT_CHAIN_POLICY_PARA pPolicyPara,
[In,Out] ref CERT_CHAIN_POLICY_STATUS pPolicyStatus);

[DllImport(“Crypt32.dll”, CharSet=CharSet.Auto, SetLastError=true)]
public static extern
SafeX509ChainHandle CertDuplicateCertificateChain(
[In] IntPtr pChainContext);

[DllImport(“Crypt32.dll”, CharSet=CharSet.Auto, SetLastError=true)]

[ResourceExposure(ResourceScope.None)]

public static extern
SafeX509ChainHandle CertDuplicateCertificateChain(
[In] SafeX509ChainHandle pChainContext);

public static bool IsMicrosoftCertificate([In] SafeX509ChainHandle pChainContext)
{
//————————————————————————-
// CERT_CHAIN_POLICY_MICROSOFT_ROOT
//
// Checks if the last element of the first simple chain contains a
// Microsoft root public key. If it doesn’t contain a Microsoft root
// public key, dwError is set to CERT_E_UNTRUSTEDROOT.
//
// pPolicyPara is optional. However,
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG can be set in
// the dwFlags in pPolicyPara to also check for the Microsoft Test Roots.
//
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG can be set
// in the dwFlags in pPolicyPara to check for the Microsoft root for
// application signing instead of the Microsoft product root. This flag
// explicitly checks for the application root only and cannot be combined
// with the test root flag.
//
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_DISABLE_FLIGHT_ROOT_FLAG can be set
// in the dwFlags in pPolicyPara to always disable the Flight root.
//
// pvExtraPolicyPara and pvExtraPolicyStatus aren’t used and must be set
// to NULL.
//————————————————————————–
const uint MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG = 0x00010000;
const uint MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG = 0x00020000;
//const uint MICROSOFT_ROOT_CERT_CHAIN_POLICY_DISABLE_FLIGHT_ROOT_FLAG = 0x00040000;

CERT_CHAIN_POLICY_PARA PolicyPara = new CERT_CHAIN_POLICY_PARA(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_PARA)));
CERT_CHAIN_POLICY_STATUS PolicyStatus = new CERT_CHAIN_POLICY_STATUS(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_STATUS)));
int CERT_CHAIN_POLICY_MICROSOFT_ROOT = 7;

PolicyPara.dwFlags = (uint) MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG;
bool isMicrosoftRoot = false;

if(CertVerifyCertificateChainPolicy(new IntPtr(CERT_CHAIN_POLICY_MICROSOFT_ROOT),
pChainContext,
ref PolicyPara,
ref PolicyStatus))
{
isMicrosoftRoot = (PolicyStatus.dwError == 0);
}

// Also check for the Microsoft root for application signing if the Microsoft product root verification is unsuccessful.
if(!isMicrosoftRoot)
{
// Some Microsoft modules can be signed with Microsoft Application Root instead of Microsoft Product Root,
// So we need to use the MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG for the certificate verification.
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG can not be used
// with MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG,
// so additional CertVerifyCertificateChainPolicy call is required to verify the given certificate is in Microsoft Application Root.
//
CERT_CHAIN_POLICY_PARA PolicyPara2 = new CERT_CHAIN_POLICY_PARA(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_PARA)));
CERT_CHAIN_POLICY_STATUS PolicyStatus2 = new CERT_CHAIN_POLICY_STATUS(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_STATUS)));
PolicyPara2.dwFlags = (uint) MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG;

if(CertVerifyCertificateChainPolicy(new IntPtr(CERT_CHAIN_POLICY_MICROSOFT_ROOT),
pChainContext,
ref PolicyPara2,
ref PolicyStatus2))
{
isMicrosoftRoot = (PolicyStatus2.dwError == 0);
}
}

return isMicrosoftRoot;
}
}
}
IDX12729: Unable to decode the header ‘[PII of type ‘System.String’ is hidden. For more details, see https://aka.ms/IdentityModel/PII.]’ as Base64Url
encoded string.
At C:Program FilesWindowsPowerShellModulesExchangeOnlineManagement3.5.1netFrameworkExchangeOnlineManagement.psm1:762 char:21
+ throw $_.Exception.InnerException;
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [], ArgumentException
+ FullyQualifiedErrorId : IDX12729: Unable to decode the header ‘[PII of type ‘System.String’ is hidden. For more details, see https://aka.ms/Id
entityModel/PII.]’ as Base64Url encoded string.

I tired:

updateing both modules to the latest versionremoveing the  Microsoft.Graph and Microsoft.Graph.Authentication module before connecting to Exchange onlineclearing the token cache file from AppDataLocal.IdentityServicemg.msal.cache

I would like to avoid running two separate script or script isolation like new processes or jobs. Because i need to pass many variables between the two script, input and output.

The app I am using and the cert is okay. If i am running separately it is working, so I can connect Exchange online with it.

Any idea why is this happening? What should i check?

​I am creating a new script. The script is running unattended. The script doing a couple things, the important part here is: setting a new user a license and setting the new user mailbox Address book policy. The address book is an Exchange online task the license is Graph. I am getting an error. How to reproduce the error:1. connect to MgGraph, I am using this commandConnect-MgGraph -TenantId $tenantID -AppId $appID -CertificateThumbprint $CertificateThumbPrint -NoWelcome do some work, Disconnect-MgGraph 2. Connect to Exchange online, in the same script:Connect-ExchangeOnline -CertificateThumbPrint $CertificateThumbPrint -AppID $appID -Organization $tenantID -CommandName Get-EXOMailbox,Get-mailbox,Set-mailbox -SkipLoadingCmdletHelp -ShowBanner:$false The command verbose debug output is this: DEBUG:
using System;
using System.Net;
using System.Management.Automation;
using Microsoft.Win32.SafeHandles;
using System.Security.Cryptography;
using System.Runtime.InteropServices;
using System.Runtime.ConstrainedExecution;
using System.Runtime.Versioning;
using System.Security;

namespace Microsoft.PowerShell.Commands.PowerShellGet
{
public static class Telemetry
{
public static void TraceMessageArtifactsNotFound(string[] artifactsNotFound, string operationName)
{
Microsoft.PowerShell.Telemetry.Internal.TelemetryAPI.TraceMessage(operationName, new { ArtifactsNotFound = artifactsNotFound });
}

public static void TraceMessageNonPSGalleryRegistration(string sourceLocationType, string sourceLocationHash, string installationPolicy, strin
g packageManagementProvider, string publishLocationHash, string scriptSourceLocationHash, string scriptPublishLocationHash, string operationName)
{
Microsoft.PowerShell.Telemetry.Internal.TelemetryAPI.TraceMessage(operationName, new { SourceLocationType = sourceLocationType, SourceLoca
tionHash = sourceLocationHash, InstallationPolicy = installationPolicy, PackageManagementProvider = packageManagementProvider, PublishLocationHash = p
ublishLocationHash, ScriptSourceLocationHash = scriptSourceLocationHash, ScriptPublishLocationHash = scriptPublishLocationHash });
}

}

/// <summary>
/// Used by Ping-Endpoint function to supply webproxy to HttpClient
/// We cannot use System.Net.WebProxy because this is not available on CoreClr
/// </summary>
public class InternalWebProxy : IWebProxy
{
Uri _proxyUri;
ICredentials _credentials;

public InternalWebProxy(Uri uri, ICredentials credentials)
{
Credentials = credentials;
_proxyUri = uri;
}

/// <summary>
/// Credentials used by WebProxy
/// </summary>
public ICredentials Credentials
{
get
{
return _credentials;
}
set
{
_credentials = value;
}
}

public Uri GetProxy(Uri destination)
{
return _proxyUri;
}

public bool IsBypassed(Uri host)
{
return false;
}
}

[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
public struct CERT_CHAIN_POLICY_PARA {
public CERT_CHAIN_POLICY_PARA(int size) {
cbSize = (uint) size;
dwFlags = 0;
pvExtraPolicyPara = IntPtr.Zero;
}
public uint cbSize;
public uint dwFlags;
public IntPtr pvExtraPolicyPara;
}

[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
public struct CERT_CHAIN_POLICY_STATUS {
public CERT_CHAIN_POLICY_STATUS(int size) {
cbSize = (uint) size;
dwError = 0;
lChainIndex = IntPtr.Zero;
lElementIndex = IntPtr.Zero;
pvExtraPolicyStatus = IntPtr.Zero;
}
public uint cbSize;
public uint dwError;
public IntPtr lChainIndex;
public IntPtr lElementIndex;
public IntPtr pvExtraPolicyStatus;
}

// Internal SafeHandleZeroOrMinusOneIsInvalid class to remove the dependency on .Net Framework 4.6.
public abstract class InternalSafeHandleZeroOrMinusOneIsInvalid : SafeHandle
{
protected InternalSafeHandleZeroOrMinusOneIsInvalid(bool ownsHandle)
: base(IntPtr.Zero, ownsHandle)
{
}

public override bool IsInvalid
{
get
{
return handle == IntPtr.Zero || handle == new IntPtr(-1);
}
}
}

// Internal SafeX509ChainHandle class to remove the dependency on .Net Framework 4.6.
[SecurityCritical]
public sealed class InternalSafeX509ChainHandle : InternalSafeHandleZeroOrMinusOneIsInvalid {
private InternalSafeX509ChainHandle () : base(true) {}

internal InternalSafeX509ChainHandle (IntPtr handle) : base (true) {
SetHandle(handle);
}

internal static InternalSafeX509ChainHandle InvalidHandle {
get { return new InternalSafeX509ChainHandle(IntPtr.Zero); }
}

[SecurityCritical]
override protected bool ReleaseHandle()
{
CertFreeCertificateChain(handle);
return true;
}

[DllImport(“Crypt32.dll”, SetLastError=true)]

[SuppressUnmanagedCodeSecurity,
ResourceExposure(ResourceScope.None),
ReliabilityContract(Consistency.WillNotCorruptState, Cer.Success)]

private static extern void CertFreeCertificateChain(IntPtr handle);
}

public class Win32Helpers
{
[DllImport(“Crypt32.dll”, CharSet=CharSet.Auto, SetLastError=true)]
public extern static
bool CertVerifyCertificateChainPolicy(
[In] IntPtr pszPolicyOID,
[In] SafeX509ChainHandle pChainContext,
[In] ref CERT_CHAIN_POLICY_PARA pPolicyPara,
[In,Out] ref CERT_CHAIN_POLICY_STATUS pPolicyStatus);

[DllImport(“Crypt32.dll”, CharSet=CharSet.Auto, SetLastError=true)]
public static extern
SafeX509ChainHandle CertDuplicateCertificateChain(
[In] IntPtr pChainContext);

[DllImport(“Crypt32.dll”, CharSet=CharSet.Auto, SetLastError=true)]

[ResourceExposure(ResourceScope.None)]

public static extern
SafeX509ChainHandle CertDuplicateCertificateChain(
[In] SafeX509ChainHandle pChainContext);

public static bool IsMicrosoftCertificate([In] SafeX509ChainHandle pChainContext)
{
//————————————————————————-
// CERT_CHAIN_POLICY_MICROSOFT_ROOT
//
// Checks if the last element of the first simple chain contains a
// Microsoft root public key. If it doesn’t contain a Microsoft root
// public key, dwError is set to CERT_E_UNTRUSTEDROOT.
//
// pPolicyPara is optional. However,
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG can be set in
// the dwFlags in pPolicyPara to also check for the Microsoft Test Roots.
//
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG can be set
// in the dwFlags in pPolicyPara to check for the Microsoft root for
// application signing instead of the Microsoft product root. This flag
// explicitly checks for the application root only and cannot be combined
// with the test root flag.
//
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_DISABLE_FLIGHT_ROOT_FLAG can be set
// in the dwFlags in pPolicyPara to always disable the Flight root.
//
// pvExtraPolicyPara and pvExtraPolicyStatus aren’t used and must be set
// to NULL.
//————————————————————————–
const uint MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG = 0x00010000;
const uint MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG = 0x00020000;
//const uint MICROSOFT_ROOT_CERT_CHAIN_POLICY_DISABLE_FLIGHT_ROOT_FLAG = 0x00040000;

CERT_CHAIN_POLICY_PARA PolicyPara = new CERT_CHAIN_POLICY_PARA(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_PARA)));
CERT_CHAIN_POLICY_STATUS PolicyStatus = new CERT_CHAIN_POLICY_STATUS(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_STATUS)));
int CERT_CHAIN_POLICY_MICROSOFT_ROOT = 7;

PolicyPara.dwFlags = (uint) MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG;
bool isMicrosoftRoot = false;

if(CertVerifyCertificateChainPolicy(new IntPtr(CERT_CHAIN_POLICY_MICROSOFT_ROOT),
pChainContext,
ref PolicyPara,
ref PolicyStatus))
{
isMicrosoftRoot = (PolicyStatus.dwError == 0);
}

// Also check for the Microsoft root for application signing if the Microsoft product root verification is unsuccessful.
if(!isMicrosoftRoot)
{
// Some Microsoft modules can be signed with Microsoft Application Root instead of Microsoft Product Root,
// So we need to use the MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG for the certificate verification.
// MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG can not be used
// with MICROSOFT_ROOT_CERT_CHAIN_POLICY_ENABLE_TEST_ROOT_FLAG,
// so additional CertVerifyCertificateChainPolicy call is required to verify the given certificate is in Microsoft Application Root.
//
CERT_CHAIN_POLICY_PARA PolicyPara2 = new CERT_CHAIN_POLICY_PARA(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_PARA)));
CERT_CHAIN_POLICY_STATUS PolicyStatus2 = new CERT_CHAIN_POLICY_STATUS(Marshal.SizeOf(typeof(CERT_CHAIN_POLICY_STATUS)));
PolicyPara2.dwFlags = (uint) MICROSOFT_ROOT_CERT_CHAIN_POLICY_CHECK_APPLICATION_ROOT_FLAG;

if(CertVerifyCertificateChainPolicy(new IntPtr(CERT_CHAIN_POLICY_MICROSOFT_ROOT),
pChainContext,
ref PolicyPara2,
ref PolicyStatus2))
{
isMicrosoftRoot = (PolicyStatus2.dwError == 0);
}
}

return isMicrosoftRoot;
}
}
}
IDX12729: Unable to decode the header ‘[PII of type ‘System.String’ is hidden. For more details, see https://aka.ms/IdentityModel/PII.]’ as Base64Url
encoded string.
At C:Program FilesWindowsPowerShellModulesExchangeOnlineManagement3.5.1netFrameworkExchangeOnlineManagement.psm1:762 char:21
+ throw $_.Exception.InnerException;
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OperationStopped: (:) [], ArgumentException
+ FullyQualifiedErrorId : IDX12729: Unable to decode the header ‘[PII of type ‘System.String’ is hidden. For more details, see https://aka.ms/Id
entityModel/PII.]’ as Base64Url encoded string.  I tired:updateing both modules to the latest versionremoveing the  Microsoft.Graph and Microsoft.Graph.Authentication module before connecting to Exchange onlineclearing the token cache file from AppDataLocal.IdentityServicemg.msal.cache I would like to avoid running two separate script or script isolation like new processes or jobs. Because i need to pass many variables between the two script, input and output. The app I am using and the cert is okay. If i am running separately it is working, so I can connect Exchange online with it. Any idea why is this happening? What should i check?  Read More

​

Greetings,

I am encountering difficulties while attempting to reinstall Windows 10, and I am concerned about the potential loss of my data and applications. Furthermore, my current hard drive does not offer sufficient storage capacity to create a backup. Despite my efforts to initiate the Windows 10 setup process, it consistently crashes. I have also tried entering safe mode, which allowed me to progress a bit further; however, I was unable to complete the installation due to system limitations. In an attempt to troubleshoot, I disabled all non-Microsoft services and startup programs using ‘msconfig,’ which enabled me to reach 100% completion during the update in normal mode, only for it to crash afterward.

​Greetings, I am encountering difficulties while attempting to reinstall Windows 10, and I am concerned about the potential loss of my data and applications. Furthermore, my current hard drive does not offer sufficient storage capacity to create a backup. Despite my efforts to initiate the Windows 10 setup process, it consistently crashes. I have also tried entering safe mode, which allowed me to progress a bit further; however, I was unable to complete the installation due to system limitations. In an attempt to troubleshoot, I disabled all non-Microsoft services and startup programs using ‘msconfig,’ which enabled me to reach 100% completion during the update in normal mode, only for it to crash afterward.  Read More

​

Context: The token I generated was retrieved by logging in with ‘Login-PowerBI’, followed by “Get-PowerBiAccessToken -asstring” inside of Powershell. This token was then copied and used inside of postman for the authorization. I didn’t use any extra parameters. Since the current usage of a Service Principal is quite limited for the Fabric API, we’re opting to use the personal bearer token.

Scenario: At our company we’re trying to experiment a bit with the MS Fabric API (https://api.fabric.microsoft.com). We’ve been able to use the API to list the workspaces, items, … basically most standard get calls you could imagine. 

We are able to create workspaces via my individual token, but I’m unable to create individual items inside of a workspace. This is due to the fact that I don’t have any individual item level scopes assigned to me for now. My current scopes are: “App.Read.All Capacity.Read.All Capacity.ReadWrite.All Content.Create Dashboard.Read.All Dashboard.ReadWrite.All Dataflow.Read.All Dataflow.ReadWrite.All Dataset.Read.All Dataset.ReadWrite.All Gateway.Read.All Gateway.ReadWrite.All Pipeline.Deploy Pipeline.Read.All Pipeline.ReadWrite.All Report.Read.All Report.ReadWrite.All StorageAccount.Read.All StorageAccount.ReadWrite.All Tenant.Read.All Tenant.ReadWrite.All UserState.ReadWrite.All Workspace.Read.All Workspace.ReadWrite.All”

As you can see, it’s quite normal that I’m only able to create a Workspace. But I want to be able to assign e.g. “Notebook.ReadWrite.All” to my user. How do I do this for an individual user? I’m trying to automate as much as possible using Powershell scripts, but the current scopes are quite limited.

Goal: Using a personal bearer token (not generated through a service principal) to create a notebook item. Endpoint: https://learn.microsoft.com/en-us/rest/api/fabric/core/items/create-item?tabs=HTTP 

Question: Is it possible to do this without the usage of a service principal? I know you can use the copy(PowerBIAccessToken) inside of the dev-tools in your browser, but I want to do it more automatically.

Hopefully this is the right section to ask such things, and thank you in advance for your help!

​Context: The token I generated was retrieved by logging in with ‘Login-PowerBI’, followed by “Get-PowerBiAccessToken -asstring” inside of Powershell. This token was then copied and used inside of postman for the authorization. I didn’t use any extra parameters. Since the current usage of a Service Principal is quite limited for the Fabric API, we’re opting to use the personal bearer token.Scenario: At our company we’re trying to experiment a bit with the MS Fabric API (https://api.fabric.microsoft.com). We’ve been able to use the API to list the workspaces, items, … basically most standard get calls you could imagine.  We are able to create workspaces via my individual token, but I’m unable to create individual items inside of a workspace. This is due to the fact that I don’t have any individual item level scopes assigned to me for now. My current scopes are: “App.Read.All Capacity.Read.All Capacity.ReadWrite.All Content.Create Dashboard.Read.All Dashboard.ReadWrite.All Dataflow.Read.All Dataflow.ReadWrite.All Dataset.Read.All Dataset.ReadWrite.All Gateway.Read.All Gateway.ReadWrite.All Pipeline.Deploy Pipeline.Read.All Pipeline.ReadWrite.All Report.Read.All Report.ReadWrite.All StorageAccount.Read.All StorageAccount.ReadWrite.All Tenant.Read.All Tenant.ReadWrite.All UserState.ReadWrite.All Workspace.Read.All Workspace.ReadWrite.All”As you can see, it’s quite normal that I’m only able to create a Workspace. But I want to be able to assign e.g. “Notebook.ReadWrite.All” to my user. How do I do this for an individual user? I’m trying to automate as much as possible using Powershell scripts, but the current scopes are quite limited.Goal: Using a personal bearer token (not generated through a service principal) to create a notebook item. Endpoint: https://learn.microsoft.com/en-us/rest/api/fabric/core/items/create-item?tabs=HTTP  Question: Is it possible to do this without the usage of a service principal? I know you can use the copy(PowerBIAccessToken) inside of the dev-tools in your browser, but I want to do it more automatically.Hopefully this is the right section to ask such things, and thank you in advance for your help!  Read More

​

Hallo zusammen, ich habe ein Problem und hoffe, jemand kann mir helfen. Ich möchte gerne Videos von YouTube herunterladen, um sie offline zu sehen, aber ich finde keine gute Lösung. Ich habe es bereits mit einigen Online-Downloadern versucht, aber die waren voller Werbung und die Download-Geschwindigkeit war extrem langsam. Hat jemand von euch eine Empfehlung für eine zuverlässige Methode, um YouTube-Videos herunterzuladen? Vielleicht eine App oder ein Programm, das ohne diese Probleme funktioniert? Vielen Dank im Voraus für eure Tipps!

​Hallo zusammen, ich habe ein Problem und hoffe, jemand kann mir helfen. Ich möchte gerne Videos von YouTube herunterladen, um sie offline zu sehen, aber ich finde keine gute Lösung. Ich habe es bereits mit einigen Online-Downloadern versucht, aber die waren voller Werbung und die Download-Geschwindigkeit war extrem langsam. Hat jemand von euch eine Empfehlung für eine zuverlässige Methode, um YouTube-Videos herunterzuladen? Vielleicht eine App oder ein Programm, das ohne diese Probleme funktioniert? Vielen Dank im Voraus für eure Tipps!  Read More

​

Hi,

I’m struggling to audit which emails have been accessed (preview, open, download) by non-owners in Defender -> Email & Collaboration -> Explorer

Global config:
UnifiedAuditLogIngestionEnabled : True
User config:
AuditEnabled : True
AuditAdmin includes “MailItemsAccessed”

Not able to find any email access records by using powershell, Purview or Sentinel (Office 365 data connector is active)

CloudAppEvents | where ActionType == “AdminMailAccess” does not work anymore. I heard that it was working some time ago. 

A bug or a feature? Any ideas on what I’m missing?

​Hi, I’m struggling to audit which emails have been accessed (preview, open, download) by non-owners in Defender -> Email & Collaboration -> Explorer Global config:UnifiedAuditLogIngestionEnabled : TrueUser config:AuditEnabled : TrueAuditAdmin includes “MailItemsAccessed”Not able to find any email access records by using powershell, Purview or Sentinel (Office 365 data connector is active) CloudAppEvents | where ActionType == “AdminMailAccess” does not work anymore. I heard that it was working some time ago.  A bug or a feature? Any ideas on what I’m missing?  Read More

​

Introduction

In the world of modern software development, efficiency, security, and scalability are paramount. Leveraging template workflows and reusable workflows in CI/CD pipelines can significantly enhance these aspects. This blog explores the security and scalability benefits of using template and reusable workflows in both GitHub Actions and Azure DevOps.

Understanding Template and Reusable Workflows

GitHub Actions

GitHub Actions allows you to automate your workflows for various tasks, including CI/CD. One powerful feature is the ability to reuse workflows across multiple repositories. This not only ensures consistency but also streamlines the setup process. For more details, you can visit the official GitHub documentation on reusable workflows.

Azure DevOps

Similarly, Azure DevOps offers the ability to use templates in your pipelines. This feature allows you to define common logic once and reuse it across multiple pipelines, promoting DRY (Don’t Repeat Yourself) principles. More information can be found in the Azure DevOps documentation on templates.

Security Benefits

Consistent Security Policies

By using templates and reusable workflows, you can enforce consistent security policies across all your projects. This ensures that critical security steps, such as code scanning, dependency checks, and secret management, are always included in your workflows.

Reduced Human Error

Manual setup of workflows across multiple repositories increases the risk of human error. Templates and reusable workflows minimize this risk by providing a single source of truth, reducing the chances of missing or misconfiguring security steps.

Scalability Benefits

Streamlined Onboarding

Templates and reusable workflows make it easier to onboard new projects and teams. By providing a standardized set of workflows, new repositories can quickly adopt best practices without reinventing the wheel.

Easier Maintenance

Maintaining a single set of templates or reusable workflows is significantly easier than managing individual workflows for each repository. The templates can be stored in a separate repository dedicated to templates, allowing consistent build, test, scan, and deployment steps. Updates to the workflow can be made in one place and propagated across all projects, ensuring that improvements and fixes are consistently applied.

Practical Examples

GitHub Actions

Consider a scenario where you need to perform a security scan on your codebase. By defining a reusable workflow that includes this step, you can ensure that all your repositories benefit from the same security checks. 

# .github/workflows/reusable-security-scan.yml
name: Reusable Security Scan

on: [push]

jobs:
security_scan:
runs-on: ubuntu-latest
steps:
– name: Checkout code
uses: actions/checkout@v2
– name: Run security scan
run: |
npm install
npm audit

This workflow can then be reused in multiple repositories:

# .github/workflows/main.yml
name: Main Workflow

on: [push]

jobs:
call-security-scan:
uses: ./.github/workflows/reusable-security-scan.yml

Azure DevOps

In Azure DevOps, you can create a template for running unit tests and use it across multiple pipelines:

# templates/unit-tests.yml
parameters:
– name: testFiles
type: string
default: ‘**/*.test.js’

steps:
– task: Npm@1
inputs:
command: ‘install’
– script: npm test $(testFiles)
displayName: ‘Run unit tests’

This template can be included in various pipelines:

# azure-pipelines.yml
trigger:
– main

jobs:
– template: templates/unit-tests.yml
parameters:
testFiles: ‘src/**/*.test.js’

Conclusion

Using reusable workflows in GitHub Actions and template pipelines in Azure DevOps not only enhances security and scalability but also simplifies the management of CI/CD pipelines. By centralizing your workflow logic, you can ensure consistency, reduce errors, and streamline the onboarding process for new projects and teams.

For more information, check out the official documentation for GitHub Actions reusable workflows and Azure DevOps pipeline templates.

Happy coding!

​Microsoft Tech Community – Latest Blogs –Read More