www.youtube.com
MSAL Authentication: Auth ain't hard (But it isn't easy either) by Ben Reader
Excerpt
And I don't think you need to avoid MEL, but {ts:208} there are some problems with how it's implemented in PowerShell that I personally believe could be solved and {ts:214} need to be solved by the big guys. Uh, because this is such an important uh this is such an … You've got to set up {ts:286} all these things, you know, configure a billion different resources and you just don't. It's it's it's two steps. The {ts:297} problem is kind of with PowerShell, kind of with how it's been implemented. So, as I said, most … {ts:367} after the other in the same profile, things get weird. They fail, but sometimes they fail silently. So it just {ts:375} doesn't work and it continues to use whatever the previous version of that library was that you were using. In the {ts:381} scenario of the a modules and the MS graph modules, they they are maintained by different teams. they cannot keep up … It's a very bad idea. Functionally {ts:637} that works though. You can get a token. Don't write in VB. It's very bad. That's what it stands {ts:646} for. Okay. So because we don't have a native module that uh abstracts the ML library in a sort of a unified way that … {ts:999} what is happening which is why I don't like it. You know, abstraction is good to a point. If it makes it so that you {ts:1006} can't actually tell what's happening, I think it's detrimental uh for us at the end of the day because as I said, if … {ts:1988} application so that you can retrieve it and that's where credential leakage comes into play and that's why I don't {ts:1992} really like this solution. This can be swapped out for certificate- based authentication as well. Um but you know {ts:1998} the same thing applies there is the potential that that could be leaked as well.
Related Pain Points
Credential leakage risks in token acquisition flows
9MSAL's interactive authentication and client secret flows create opportunities for credential leakage, particularly when credentials are retrieved and stored in application state. Even certificate-based authentication alternatives carry similar risks of credential exposure.
Assembly Load Context (ALC) conflicts with multiple MSAL versions in PowerShell modules
8PowerShell modules like AZ and MS Graph each include their own versions of MSAL, causing assembly load context conflicts when users load multiple modules in the same session. This results in silent failures or misleading error messages as the runtime continues using whichever MSAL version was loaded first, rather than the expected version.
Unnecessary abstractions and over-engineering
5C# developers create overly generic or abstract code anticipating future requirements, leading to unmaintainable solutions. This introduces state ownership issues, implicit workflows, and feature creep that obstructs rather than assists code clarity and testability.