Skip to content

m365.md

Latest commit

 

History

History
45 lines (34 loc) · 2.04 KB

m365.md

File metadata and controls

45 lines (34 loc) · 2.04 KB
Raw

Microsoft 365 CLI

CLI for Microsoft 365 (m365) provides command-line access to Microsoft 365 over the Graph API.

It is work-only: the package installs only on ewn hosts, gated by {{ if eq .hosttype "ewn" }} in the install-pnpm-globals script. See pnpm-globals.md for the install mechanism — including the @azure/logger global-pnpmfile.cjs patch the CLI needs under pnpm's isolated node_modules.

Microsoft 365 CLI Sign-In

Since v10 the CLI ships no default Entra app registration, so sign-in is a one-time manual step per machine against a self-registered app:

m365 login --appId <your-ewn-app-id> --tenant ewn.com --authType browser

The CLI caches the token afterward, so this is not needed every session.

  • <your-ewn-app-id> — the Application (client) ID of the Entra app registered in the ewn tenant (see below). The client ID is not a secret, but is kept out of this public repo; find it in the Entra admin center under App registrations.
  • --authType browser — required. Device-code flow is rejected by Conditional Access with invalid_grant; interactive browser auth runs on the trusted device and satisfies the policy.

Microsoft 365 CLI App Registration

A single-tenant registration configured as a public client ("Allow public client flows" enabled) with redirect URIs http://localhost and https://login.microsoftonline.com/common/oauth2/nativeclient.

Grant it whatever delegated Microsoft Graph scopes the commands you use require, consenting to each as needed — the CLI's command set is large, so the permission set grows with usage rather than being fixed up front.

A self-registered app is necessary because the CLI removed its bundled multi-tenant app in v10, and the well-known first-party app IDs don't fit: the Azure CLI app (04b07795-8ddb-461a-bbee-02f9e1bf7b46) has a fixed, non-extensible Graph scope set, and the Microsoft Graph Command Line Tools app (14d82eec-895b-4f00-a41c-3a2535ac2c53) isn't provisioned to sign into.