/flags/teams/connect-microsoftteams-usedeviceauthentication
Connect-MicrosoftTeams -UseDeviceAuthentication: sign in with a device code
- tool
- Microsoft Teams PowerShell
- command
- Connect-MicrosoftTeams
- flag
- -UseDeviceAuthentication
- default
- off (interactive sign-in in a browser or the Windows account broker)
Connect-MicrosoftTeams -UseDeviceAuthentication signs in to Teams PowerShell with the device code flow: the cmdlet prints a URL and a one-time code, you open the URL in a browser on any device, enter the code and sign in (MFA included), and the PowerShell session continues. The reference describes it as "Use device code authentication instead of a browser control." Use it on servers, SSH sessions, containers and remote terminals where no browser window can open.
Connect-MicrosoftTeams -UseDeviceAuthentication
Connect-MicrosoftTeams -UseDeviceAuthentication -TenantId 00000000-0000-0000-0000-000000000000
Get-CsTenant | Select-Object DisplayName, TenantId # confirm the sessionWhere the switch lives
-UseDeviceAuthentication belongs to the UserCredential parameter set, the same set as -AccountId and -TenantId, so it cannot be combined with certificate or access-token parameters.
Sign-in options compared
| Situation | Use |
|---|---|
| Desktop with a browser | Connect-MicrosoftTeams (interactive) |
| No browser on this machine | Connect-MicrosoftTeams -UseDeviceAuthentication |
| Specific tenant (guest admin, partner) | add -TenantId TENANT_ID |
| GCC High, DoD, 21Vianet | add -TeamsEnvironmentName TeamsGCCH, TeamsDOD or TeamsChina |
| Unattended script | app-only: -CertificateThumbprint, -ApplicationId, -TenantId |
Pitfalls
- Someone must be present. The code has to be entered in a browser each time, so the switch cannot be used for scheduled tasks; use app-only authentication there (Connect-MicrosoftTeams).
- Device code phishing. Enter a code only for a sign-in you started yourself.
- Code expiry. The code is valid for a limited time; run the command again if the sign-in times out.
- Session per runspace. The token belongs to the PowerShell session that connected. A new window, a background job or a parallel runspace has no session and fails with Session is not established or You must call Connect-MicrosoftTeams.
- Exchange differs. The Exchange Online equivalent,
-Device, exists only in PowerShell 7 (Connect-ExchangeOnline -Device).
FAQ
Does -UseDeviceAuthentication work in Windows PowerShell 5.1?
Yes. Unlike Connect-ExchangeOnline -Device, the Teams switch exists in the module under Windows PowerShell 5.1 as well, as the check on this page shows.
Can I combine it with -TenantId?
Yes. Both are in the UserCredential parameter set, so Connect-MicrosoftTeams -UseDeviceAuthentication -TenantId TENANT signs in to a specific tenant, for example as a guest administrator.
Why is the device code sign-in blocked in my organization?
Many tenants block the device code flow with Conditional Access because it is abused for phishing. Ask the Entra ID administrator for an allowed method, or use certificate-based app-only authentication for automation.