Get-MgContext: check the Microsoft Graph PowerShell connection, account, tenant and scopes

Get-MgContext shows who you are signed in as in Microsoft Graph PowerShell and what the token allows:

Get-MgContext
Get-MgContext | Select-Object -ExpandProperty Scopes

The most useful properties are Account (signed-in user), TenantId, ClientId (the app used to sign in), AuthType (Delegated or AppOnly), Scopes (permissions in the token) and ContextScope (CurrentUser or Process).

Not connected: no output

Without a connection Get-MgContext returns $null and writes no error, so it is safe to use as a test. Checked with Microsoft.Graph.Authentication 2.41.2:

Import-Module Microsoft.Graph.Authentication
$ctx = Get-MgContext
'Connected: ' + [bool]$ctx
'Output is null: ' + ($null -eq $ctx)

Connected: False
Output is null: True

if (-not (Get-MgContext)) {
  Connect-MgGraph -Scopes "User.Read.All" -NoWelcome
}

Check for a scope before a call

$needed = 'User.ReadWrite.All'
if ((Get-MgContext).Scopes -notcontains $needed) {
  Connect-MgGraph -Scopes $needed
}

For app-only sessions Scopes lists the application permissions granted to the app.

Properties

Get-MgContext reads the local session only; it does not call Graph and does not tell you whether the signed-in user holds an Entra role.

When to use it

Run Get-MgContext first whenever a Graph cmdlet fails. It answers the three questions behind most Microsoft Graph PowerShell errors without making a network call: am I connected at all, as which account and tenant, and with which permissions. In scripts it is the standard guard before work starts, because it returns $null instead of throwing when there is no session.

Troubleshooting with the context

All context properties

The properties of the context object in Microsoft.Graph.Authentication 2.41.2, read offline:

Import-Module Microsoft.Graph.Authentication
([Microsoft.Graph.PowerShell.Authentication.IAuthContext].GetProperties().Name | Sort-Object) -join ', '

Account, AppName, AuthType, Certificate, CertificateSubjectName, CertificateThumbprint, ClientId, ClientSecret, ContextScope, Environment, HomeAccountId, LoginHint, ManagedIdentityId, PSHostVersion, Scopes, SendCertificateChain, TenantId, TokenCredentialType, WamEnabled

Besides the ones described above, AppName is the display name of the client app, TokenCredentialType shows how the token was obtained (InteractiveBrowser, DeviceCode, ClientCertificate, ClientSecret, ManagedIdentity, ...), and WamEnabled tells whether the Windows Web Account Manager broker was used. Related pages: Connect-MgGraph -Scopes, Authentication needed and Insufficient privileges.

FAQ