You can have a try convert the powershell task to a task group(Right click on the powershell task, and choose create task group). Then another pipelines in this project can add the task group. You will need to use inline script in the powershell task, so that you donot need to create a .ps1 file in other repo. If you want to output the $bearerToken to the follow tasks, you can use logging command echo "##vso[task.setvariable variable=Token]$bearerToken" in the script. Then you can refer the Token in follow tasks by $(Token)
But you still need to use Variable groups to store the secret and link it to the other pipeline.
Alternatively, you can use azure powershell cli in azure powershell task to get the bearer token for Graph API, since azure powershell task can hold the authentication using service connection. You can create a service connection using the service principal you created.
Then you can get the token for Graph API in the azure powershell task using the secrets configured in the service connection. See below script:
$context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
$graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.microsoft.com").AccessToken
echo "##vso[task.setvariable variable=Token]$graphToken"
The equivalent commands for azure cli task is below:
$graphToken= & az account get-access-token --resource=https://graph.microsoft.com --query accessToken
echo "##vso[task.setvariable variable=Token]$graphToken"
So you can create a service connection. And use azure cli task or azure powershell task to run above inline scripts. And convert the task to task group. Then you can use this task group in other pipeline, and use the token in the other tasks by referring to $(Token)
By using the azure cli task or azure powershell task, you only need to configure the secret in the service connection. You will not need to expose any secret in the task or the scripts.
