Microsoft Graph PowerShell opens a browser instead of Windows (WAM) sign-in when DisableLoginByWAM is True

Symptom

A PowerShell script using the Microsoft Graph PowerShell SDK was meant to sign in without a prompt, using the Windows account on a signed-in PC. Every run opened a browser sign-in instead. Being logged in to Windows made no difference.

What was found

Get-MgGraphOption on that PC showed:

DisableLoginByWAM : True

With this option true the SDK does not use Web Account Manager (WAM), the Windows broker, and falls back to a browser-based interactive sign-in. The session identified this as the reason the Windows sign-in was not used. How the option came to be True on that PC (SDK default for that version, an earlier Set-MgGraphOption, or a configuration file) was not established.

The setting to change

Set-MgGraphOption -DisableLoginByWAM $false

Points recorded with it:

• The option is stored per user, so it changes sign-in for every Graph PowerShell script that user runs, not just the one being worked on.
• The app registration used by the script already had the WAM redirect URI registered; the session expected WAM sign-in to work as a result.
• A tenant's Conditional Access policy can still require a fresh interactive sign-in after a set period, and no script change avoids that.

A separate cause in the same session

A different problem in the same script made every run sign in again: it cleared the token cache at the start and end of each run. The script was changed to keep the (encrypted, per-user) token cache between runs and to clear it only on request through a -SignOut switch. That fix and the WAM setting are independent.

Unverified

• That setting DisableLoginByWAM to $false produced a silent sign-in on that PC. The session could only suggest it ("it should work"); the result of the next run was not seen.
• Whether the setting differs for the Graph SDK versions 1.x and 2.x.