msgraphauth

name	msgraphauth
description	How to authenticate with Microsoft Graph CLI (mgc) — login, logout, scopes, and auth strategies. Use this skill whenever the user needs to sign in to Microsoft 365, configure mgc authentication, manage Graph API scopes, or troubleshoot 401 Unauthorized errors with the mgc CLI.

Microsoft Graph CLI — Authentication

Binary

./mgc-cli/mgc

---

Login strategies

# Device-code login (default — opens browser flow)
mgc login

# Interactive browser
mgc login --strategy InteractiveBrowser

# App-only with client certificate
mgc login --strategy ClientCertificate --client-id <id> --tenant-id <tid>

# Login with specific scopes
mgc login --client-id <id> --tenant-id <tid> \
  --scopes Mail.ReadWrite --scopes Mail.Send --scopes Calendars.ReadWrite

Logout

mgc logout

Verify current user

mgc me get

Use --user-id me in all commands to target the currently signed-in user.

---

Required permissions by operation

Operation	Scope
Read mail	Mail.Read
Send mail	Mail.Send
Read & write mail	Mail.ReadWrite
Read calendar	Calendars.Read
Read & write calendar	Calendars.ReadWrite
Read profile	User.Read
Read/write SharePoint files & drives	Sites.ReadWrite.All
Read OneDrive files	Files.Read
Read & write OneDrive files	Files.ReadWrite

Important: SharePoint drive access (sites, document libraries) requires Sites.ReadWrite.All. Without it, mgc sites drive get returns 403 accessDenied even if the user owns the site.

# Login with SharePoint file access
./mgc-cli/mgc login --scopes Sites.ReadWrite.All --strategy InteractiveBrowser

Run -h on any subcommand to see the exact required permissions listed in its help output.

---

Troubleshooting

• 401 Unauthorized → missing scopes; run mgc logout then mgc login --scopes <needed-scope>
• Auth not persisting → macOS keychain may be blocking; re-run mgc login
• --user-id me only works with delegated (user) auth — app-only auth requires an explicit user ID
• Use --debug to inspect the raw HTTP request/response