Connect-MgGraph: Keyset does not exist

I had this little issue today when I tried to schedule the Microsoft Graph script to run as a service account on a certificate. To my surprise, even tho I had all permissions required, I was getting this error message: Connect-MgGraph: Keyset does not exist. Something that didn't show up for my user.

The message indicated my process has difficulty reaching the key of my chosen certificate. Trying to run the scheduled task with the highest privileges didn't change anything. Since Connect-MGGraph doesn't support PFX files, you must upload the certificate to the Local Machine store and refer to it via Thumbprint.

Fixing Connect-MgGraph: Keyset does not exist

When using certificates as a standard user, I usually do it in the following way:

Connect-MgGraph -CertificateThumbprint '9135E5CF311C051A' -ClientId 'a7b8a419' -TenantId '5e94ad53'

The problem is – it only works for certificates in the user store. When you switch to Local Machine Store, Connect-MGGraph no longer sees the certificate, so you need to change to a different connection method.

$Thumbprint = '9135E5CF'
$LocalMachineCert = Get-ChildItem -Path Cert:\LocalMachine -Recurse | Where-Object { $_.Thumbprint -eq $Thumbprint }
Connect-MgGraph -ClientId 'a7b8a419' -TenantId '5e94ad53' -Certificate $LocalMachineCert

This way, we tell Connect-MgGaph to use the LocalMachine Certificate store, but while it worked for me when testing it using my account, things were not so great when trying it as a service account. Fortunately, there's an easy fix for that. We need to allow that particular service account access to private keys for that specific certificate.

Add a missing service account with proper permissions, and you're ready!

Of course, you need to do it on your proper certificate, not the Razer Chroma SDK certificate, as shown in the screenshot.

Przemyslaw Klys

System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.

Published by
Przemyslaw Klys

Recent Posts

Syncing Global Address List (GAL) to personal contacts and between Office 365 tenants with PowerShell

Hey there! Today, I wanted to introduce you to one of the small but excellent…

1 week ago

Active Directory Health Check using Microsoft Entra Connect Health Service

Active Directory (AD) is crucial in managing identities and resources within an organization. Ensuring its…

2 months ago

Seamless HTML Report Creation: Harness the Power of Markdown with PSWriteHTML PowerShell Module

In today's digital age, the ability to create compelling and informative HTML reports and documents…

3 months ago

How to Efficiently Remove Comments from Your PowerShell Script

As part of my daily development, I create lots of code that I subsequently comment…

4 months ago

Unlocking PowerShell Magic: Different Approach to Creating ‘Empty’ PSCustomObjects

Today I saw an article from Christian Ritter, "PowerShell: Creating an "empty" PSCustomObject" on X…

4 months ago

Report Active Directory Accounts that are Synchronized with Azure AD

I was scrolling X (aka Twitter) today and saw this blog post, "PowerShell: Report On-Premises…

4 months ago