Get-MsalToken error AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'

user_6916098 0
Viewed 5957

Here is my PowerShell script

$connectionDetails = @{
    'TenantId'    = '****-****'
    'ClientId'    = '****-****'
    'Interactive' = $true
    'Scopes' = '****-****'
    'RedirectUri' = '****-****'
}

$token = Get-MsalToken @connectionDetails

$accessToken = $token.AccessToken

write-output $accessToken

It errors out as follows:

AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'

Why am I getting this error? How can I fix it?

msal azure-active-directory powershell
1 Answers

Please see the differences between public client and confidential client applications.

Confidential client applications are safe to keep application secrets while public clients not.

So the error you encountered means that your app registration is Confidential client application (when you create it, you select Web) which requires you to provide ClientSecret, but you didn't specify it.

enter image description here

So you have 2 options to resolve it.

The first one is providing ClientSecret in your script (don't modify anything on Azure portal):

$connectionDetails = @{
    'TenantId'    = '****-****'
    'ClientId'    = '****-****'
    'ClientSecret'= '****-****'
    'Interactive' = $true
    'Scopes' = '****-****'
    'RedirectUri' = '****-****'
}

The second one is changing your app registration from Confidential client application to Public client app on Azure portal -> your app registration -> manifest. (don't modify your script)

enter image description here

The Get-MsalToken.ps1 also includes the 2 examples:

.EXAMPLE
    PS C:\>Get-MsalToken -ClientId '00000000-0000-0000-0000-000000000000' -TenantId '00000000-0000-0000-0000-000000000000' -Interactive -Scope 'https://graph.microsoft.com/User.Read' -LoginHint user@domain.com
    Force interactive authentication to get AccessToken (with MS Graph permissions User.Read) and IdToken for specific Azure AD tenant and UPN using client id from application registration (public client).

.EXAMPLE
    PS C:\>Get-MsalToken -ClientId '00000000-0000-0000-0000-000000000000' -ClientSecret (ConvertTo-SecureString 'SuperSecretString' -AsPlainText -Force) -TenantId '00000000-0000-0000-0000-000000000000' -Scope 'https://graph.microsoft.com/.default'
    Get AccessToken (with MS Graph permissions .Default) and IdToken for specific Azure AD tenant using client id and secret from application registration (confidential client).
user_105217390
Related