Using multiple Azure AD identities from a single linux login

[oweiler]

In my quest to get rid of all basic auth usage inside my Microsoft 365 tenant, I happened upon this project as a potential solution. Most of my basic auth usage revolves around sending and receiving emails in exchange which this project provides. I'm now looking to extend this functionality to multiple Azure AD identities/exchange mailboxes but use them all within a single linux login. Using basic auth, this was relatively simple: keep protected files with usernames/passwords as resources to curl to get and send mail from/to that mailbox.

With cli-microsoft365, reading about persistent connections, I'm not sure it's that simple? One way I could see doing what I need is to keep a version of .cli-m365-msal.json and .cli-m365-tokens.json for each mailbox/M365 identity I want to manipulate but this has the obvious drawback that I can only perform operations on a single identity at a time.

I looked into the options provided by the m365 login command but they all seem to end up in a place where the .cli-m365-msal.json and .cli-m365-tokens.json point to a single Azure AD identity.

What's the right way to handle multiple Azure AD identities from a single login/user on a linux system?

[waldekmastykarz]

Right now we support only one account at the time, like you noticed. The good news is that theoretically, we could support logging in with multiple accounts and allowing you to switch between them without following the complete login flow. The way it would work, is that you'd login in with all accounts you want to use, and then, before running each command you would do something like m365 account set --account user@domain.com to select the account that you'd want to use. Would this work? If so, we can create an issue with a spec for it. It'll be a new feature that we'd need to add (meaning, it might take a few weeks for us to add it, especially now as many folks are on vacation).

[oweiler]

Yes, requiring m365 account set --account user@domain.com to select the account to use would work perfectly. There should be a way to log out of accounts already logged in but presumably, that could be done by removing or modifying json files if that's too much work for a first pass. In my use case, going through a logout process would be rare.

[waldekmastykarz]

Excellent. I created an issue #3587 so that we can define the spec and start working on it. Thank you for the idea!

[arjunumenon]

Excellent. I created an issue #3578 so that we can define the spec and start working on it. Thank you for the idea!

Hey @waldekmastykarz Weren't you referring to #3587 here 🙂?

[waldekmastykarz]

Yes, I was! Thanks!