Login and use m365 with Graph/SharePoint using managed identity

[alexabramkin]

If I have user created Managed Identity with SharePoint and Graph application roles assigned () - should I be able to login with it to m365 and use it?
What I have tried:

1. Created Managed Identity (mi-id) using az cli... (commands omitted for brevity)
2. Assigned minimum required for o365 approles to it
   m365 aad approleassignment add --displayName "mi-id" --resource "Microsoft Graph" --scope "Sites.Read.All"
   and
   m365 aad approleassignment add --displayName "mi-id" --resource "Office 365 SharePoint Online" --scope "Sites.Manage.All"
3. attempted to login: m365 login using clientid/objectid for the "mi-id" --authType identity --userName <clientid/objectid for the "mi-id"> --debug

What I am trying to do: login with m365 using Managed Identity instead of using client certificate/app registration.

Got the error message in debug output below:
Executing command login with options {"options":{"":["login"],"authType":"identity","t":"identity","userName":"......","debug":true}}
Logging out from Microsoft 365...
DONE
Signing in to Microsoft 365...
No token found for resource https://graph.microsoft.com
Wil try to retrieve access token using identity...
IDENTITY_ENDPOINT and MSI_ENDPOINT env variables not found. Attempt to get Managed Identity token by using the Azure Virtual Machine API...
Wil try to get token using client_id param...
Request:
decompress : true
headers : {"common":{"Accept":"application/json, text/plain, /"},"delete":{},"get":{},"head":{},"post":{"Content-Type":"application/x-www-form-urlencoded"},"put":{"Content-Type":"application/x-www-form-urlencoded"},"patch":{"Content-Type":"application/x-www-form-urlencoded"},"user-agent":"NONISV|SharePointPnP|Office365CLI/3.2.0","accept-encoding":"gzip, deflate","accept":"application/json","Metadata":true}
method : get
responseType: json
url : http://169.254.169.254/metadata/identity/oauth2/token?resource=https%3A%2F%2Fgraph.microsoft.com&api-version=2018-02-01&client_id=...

Request error
Error: TypeError: Cannot convert undefined or null to object
Error:
message: Cannot convert undefined or null to object
stack : TypeError: Cannot convert undefined or null to object
at Function.keys ()
at Function.filterObject (/.../node/v10.21.0/lib/node_modules/@pnp/cli-microsoft365/dist/Utils.js:506:23)
at req.interceptors.response.use (.../.nvm/versions/node/v10.21.0/lib/node_modules/@pnp/cli-microsoft365/dist/request.js:52:54)
at process._tickCallback (internal/process/next_tick.js:68:7)

Error: TypeError: Cannot convert undefined or null to object_

[waldekmastykarz]

Where is CLI for Microsoft 365 running? Is it inside a VM on Azure?

[alexabramkin]

Thank you for prompt reply!

For now on my machine (Mac) in iTerm directly. Are managed identities only intended to work from the Azure VMs? What about from inside of the Azure Function deployed in Docker container?

The stretch here is that I am trying to see if I can use m365 from inside of the Function (with Managed Identity user assigned to the Function). Similar to the Garry Trinder's example here, but due to multi factor auth can not use username and pwd.

[alexabramkin]

@waldekmastykarz just successfully run it in the scenario described above (TypeScript Azure Function under Managed Identity on Docker image). Kinda answering my own question here 🥇 Thank you for a good pointer and excellent cli :) HT

[garrytrinder]

That's great news @alexabramkin glad you were able to unblock yourself.

I must admit that my example has not been worked on for a while and could do with an update.

[waldekmastykarz]

Thank you for the kind words! Glad to hear you got it running! 👏

[appieschot]

@alexabramkin would you mind sharing a short writeup on steps taken? Either I am completely stupid or I am missing some basic things (trying to achieve somewhat similar scenario but running Docker in a Logic App). Seems to be failing with managed identity was well, so was thinking of trying to achieve it with a function first and make sure that it is not the identity part.