@pnp/cli-microsoft365 10.0.0-beta.48e9f7d → 10.0.0-beta.558f289

package/dist/Auth.js

@@ -4,7 +4,6 @@ import { CommandError } from './Command.js';
 import { FileTokenStorage } from './auth/FileTokenStorage.js';
 import { msalCachePlugin } from './auth/msalCachePlugin.js';
 import { cli } from './cli/cli.js';
-import config from './config.js';
 import request from './request.js';
 import { settingsNames } from './settingsNames.js';
 import * as accessTokenUtil from './utils/accessToken.js';
@@ -22,10 +21,10 @@ export class Connection {
         this.active = false;
         this.authType = AuthType.DeviceCode;
         this.certificateType = CertificateType.Unknown;
+        // ID of the tenant where the Microsoft Entra app is registered; common if multi-tenant
+        this.tenant = 'common';
         this.cloudType = CloudType.Public;
         this.accessTokens = {};
-        this.appId = config.cliEntraAppId;
-        this.tenant = config.tenant;
         this.cloudType = CloudType.Public;
     }
     deactivate() {
@@ -44,18 +43,18 @@ export class Connection {
         this.thumbprint = undefined;
         this.spoUrl = undefined;
         this.spoTenantId = undefined;
-        this.appId = config.cliEntraAppId;
-        this.tenant = config.tenant;
+        this.appId = cli.getClientId();
+        this.tenant = cli.getTenant();
     }
 }
 export var AuthType;
 (function (AuthType) {
-    AuthType[AuthType["DeviceCode"] = 0] = "DeviceCode";
-    AuthType[AuthType["Password"] = 1] = "Password";
-    AuthType[AuthType["Certificate"] = 2] = "Certificate";
-    AuthType[AuthType["Identity"] = 3] = "Identity";
-    AuthType[AuthType["Browser"] = 4] = "Browser";
-    AuthType[AuthType["Secret"] = 5] = "Secret";
+    AuthType["DeviceCode"] = "deviceCode";
+    AuthType["Password"] = "password";
+    AuthType["Certificate"] = "certificate";
+    AuthType["Identity"] = "identity";
+    AuthType["Browser"] = "browser";
+    AuthType["Secret"] = "secret";
 })(AuthType || (AuthType = {}));
 export var CertificateType;
 (function (CertificateType) {
@@ -118,7 +117,7 @@ export class Auth {
     async restoreAuth() {
         // check if auth has been restored previously
         if (this._connection.active) {
-            return Promise.resolve();
+            return;
         }
         try {
             const connection = await this.getConnectionInfoFromStorage();
@@ -354,7 +353,9 @@ export class Auth {
             await logger.logToStderr(response);
             await logger.logToStderr('');
         }
-        await logger.logToStderr(`🌶️  ${response.message}`);
+        if (response.message) {
+            await logger.logToStderr(`🌶️  ${response.message}`);
+        }
         if (cli.getSettingWithDefaultValue(settingsNames.autoOpenLinksInBrowser, false)) {
             await browserUtil.open(response.verificationUri);
         }
@@ -472,7 +473,7 @@ export class Auth {
             }
             if (userName && process.env.ACC_CLOUD) {
                 // reject for now since the Azure Cloud Shell does not support user-managed identity 
-                return Promise.reject('Azure Cloud Shell does not support user-managed identity. You can execute the command without the --userName option to login with user identity');
+                throw 'Azure Cloud Shell does not support user-managed identity. You can execute the command without the --userName option to login with user identity';
             }
             requestOptions.url = `${process.env.IDENTITY_ENDPOINT}?resource=${encodeURIComponent(resource)}`;
         }
@@ -482,7 +483,7 @@ export class Auth {
             }
             if (userName && process.env.ACC_CLOUD) {
                 // reject for now since the Azure Cloud Shell does not support user-managed identity 
-                return Promise.reject('Azure Cloud Shell does not support user-managed identity. You can execute the command without the --userName option to login with user identity');
+                throw 'Azure Cloud Shell does not support user-managed identity. You can execute the command without the --userName option to login with user identity';
             }
             requestOptions.url = `${process.env.MSI_ENDPOINT}?resource=${encodeURIComponent(resource)}`;
         }
@@ -702,7 +703,7 @@ export class Auth {
         const details = {
             connectionName: connection.name,
             connectedAs: connection.identityName,
-            authType: AuthType[connection.authType],
+            authType: connection.authType,
             appId: connection.appId,
             appTenant: connection.tenant,
             cloudType: CloudType[connection.cloudType]

package/dist/AuthServer.js

@@ -26,7 +26,7 @@ export class AuthServer {
                 await this.logger.logToStderr(url);
                 await this.logger.logToStderr('');
             }
-            this.openUrl(url);
+            await this.openUrl(url);
         };
         this.httpRequest = async (request, response) => {
             if (this.debug) {
@@ -80,19 +80,19 @@ export class AuthServer {
     get server() {
         return this.httpServer;
     }
-    openUrl(url) {
-        browserUtil.open(url)
-            .then(async (_) => {
+    async openUrl(url) {
+        try {
+            await browserUtil.open(url);
             await this.logger.logToStderr("To sign in, use the web browser that just has been opened. Please sign-in there.");
-        })
-            .catch(_ => {
+        }
+        catch {
             const errorResponse = {
                 error: "Can't open the default browser",
                 errorDescription: "Was not able to open a browser instance. Try again later or use a different authentication method."
             };
             this.reject(errorResponse);
             this.httpServer.close();
-        });
+        }
     }
 }
 export default new AuthServer();

package/dist/Command.js

@@ -522,7 +522,10 @@ class Command {
             quote: cli.getConfig().get(settingsNames.csvQuote),
             quoted: cli.getSettingWithDefaultValue(settingsNames.csvQuoted, false),
             // eslint-disable-next-line camelcase
-            quoted_empty: cli.getSettingWithDefaultValue(settingsNames.csvQuotedEmpty, false)
+            quoted_empty: cli.getSettingWithDefaultValue(settingsNames.csvQuotedEmpty, false),
+            cast: {
+                boolean: (value) => value ? '1' : '0'
+            }
         });
     }
     getMdOutput(logStatement, command, options) {

package/dist/api.js

@@ -3,7 +3,7 @@ export async function executeCommand(commandName, options, listener) {
     cli.loadAllCommandsInfo();
     await cli.loadCommandFromArgs(commandName.split(' '));
     if (!cli.commandToExecute) {
-        return Promise.reject(`Command not found: ${commandName}`);
+        throw `Command not found: ${commandName}`;
     }
     return cli.executeCommandWithOutput(cli.commandToExecute.command, { options: options ?? {} }, listener);
 }

package/dist/appInsights.js

@@ -6,12 +6,14 @@ process.env.APPLICATION_INSIGHTS_NO_STATSBEAT = 'true';
 import * as appInsights from 'applicationinsights';
 import crypto from 'crypto';
 import fs from 'fs';
+import os from 'os';
 import path from 'path';
 import url from 'url';
 import { app } from './utils/app.js';
 const __dirname = url.fileURLToPath(new URL('.', import.meta.url));
-const config = appInsights.setup('6b908c80-d09f-4cf6-8274-e54349a0149a');
-config.setInternalLogging(false, false);
+appInsights
+    .setup('6b908c80-d09f-4cf6-8274-e54349a0149a')
+    .setInternalLogging(false, false);
 // append -dev to the version number when ran locally
 // to distinguish production and dev version of the CLI
 // in the telemetry
@@ -26,8 +28,8 @@ appInsightsClient.commonProperties = {
 };
 appInsightsClient.config.proxyHttpUrl = process.env.HTTP_PROXY ?? '';
 appInsightsClient.config.proxyHttpsUrl = process.env.HTTPS_PROXY ?? '';
-appInsightsClient.context.tags['ai.cloud.roleInstance'] = crypto.createHash('sha256').update(appInsightsClient.context.tags['ai.cloud.roleInstance']).digest('hex');
-delete appInsightsClient.context.tags['ai.cloud.role'];
+appInsightsClient.context.tags[appInsightsClient.context.keys.cloudRoleInstance] = crypto.createHash('sha256').update(os.hostname()).digest('hex');
+delete appInsightsClient.context.tags[appInsightsClient.context.keys.cloudRole];
 delete appInsightsClient.context.tags['ai.cloud.roleName'];
 export default appInsightsClient;
 //# sourceMappingURL=appInsights.js.map

package/dist/cli/cli.js

@@ -59,6 +59,12 @@ function getSettingWithDefaultValue(settingName, defaultValue) {
         return configuredValue;
     }
 }
+function getClientId() {
+    return cli.getSettingWithDefaultValue(settingsNames.clientId, process.env.CLIMICROSOFT365_ENTRAAPPID);
+}
+function getTenant() {
+    return cli.getSettingWithDefaultValue(settingsNames.tenantId, process.env.CLIMICROSOFT365_TENANT || 'common');
+}
 async function execute(rawArgs) {
     const start = process.hrtime.bigint();
     // for completion commands we also need information about commands' options
@@ -837,6 +843,11 @@ async function promptForConfirmation(config) {
     await cli.error('');
     return answer;
 }
+async function promptForInput(config) {
+    const answer = await prompt.forInput(config);
+    await cli.error('');
+    return answer;
+}
 async function handleMultipleResultsFound(message, values) {
     const prompt = cli.getSettingWithDefaultValue(settingsNames.prompt, true);
     if (!prompt) {
@@ -871,7 +882,9 @@ export const cli = {
     closeWithError,
     commands,
     commandToExecute,
+    getClientId,
     getConfig,
+    getTenant,
     currentCommandName,
     error,
     execute,
@@ -890,6 +903,7 @@ export const cli = {
     optionsFromArgs,
     printAvailableCommands,
     promptForConfirmation,
+    promptForInput,
     promptForSelection,
     promptForValue,
     shouldTrimOutput,

package/dist/config.js

@@ -1,10 +1,66 @@
-import { app } from "./utils/app.js";
-const cliEntraAppId = '31359c7f-bd7e-475c-86db-fdb8c937548e';
+import { app } from './utils/app.js';
 export default {
+    allScopes: [
+        'https://graph.windows.net/Directory.AccessAsUser.All',
+        'https://management.azure.com/user_impersonation',
+        'https://admin.services.crm.dynamics.com/user_impersonation',
+        'https://graph.microsoft.com/AppCatalog.ReadWrite.All',
+        'https://graph.microsoft.com/AuditLog.Read.All',
+        'https://graph.microsoft.com/Bookings.Read.All',
+        'https://graph.microsoft.com/Calendars.Read',
+        'https://graph.microsoft.com/ChannelMember.ReadWrite.All',
+        'https://graph.microsoft.com/ChannelMessage.Read.All',
+        'https://graph.microsoft.com/ChannelMessage.ReadWrite',
+        'https://graph.microsoft.com/ChannelMessage.Send',
+        'https://graph.microsoft.com/ChannelSettings.ReadWrite.All',
+        'https://graph.microsoft.com/Chat.ReadWrite',
+        'https://graph.microsoft.com/Community.ReadWrite.All',
+        'https://graph.microsoft.com/Directory.AccessAsUser.All',
+        'https://graph.microsoft.com/Directory.ReadWrite.All',
+        'https://graph.microsoft.com/ExternalConnection.ReadWrite.All',
+        'https://graph.microsoft.com/ExternalItem.ReadWrite.All',
+        'https://graph.microsoft.com/Group.ReadWrite.All',
+        'https://graph.microsoft.com/IdentityProvider.ReadWrite.All',
+        'https://graph.microsoft.com/InformationProtectionPolicy.Read',
+        'https://graph.microsoft.com/Mail.Read.Shared',
+        'https://graph.microsoft.com/Mail.ReadWrite',
+        'https://graph.microsoft.com/Mail.Send',
+        'https://graph.microsoft.com/Notes.ReadWrite.All',
+        'https://graph.microsoft.com/OnlineMeetingArtifact.Read.All',
+        'https://graph.microsoft.com/OnlineMeetings.ReadWrite',
+        'https://graph.microsoft.com/OnlineMeetingTranscript.Read.All',
+        'https://graph.microsoft.com/PeopleSettings.ReadWrite.All',
+        'https://graph.microsoft.com/Place.Read.All',
+        'https://graph.microsoft.com/Policy.Read.All',
+        'https://graph.microsoft.com/RecordsManagement.ReadWrite.All',
+        'https://graph.microsoft.com/Reports.Read.All',
+        'https://graph.microsoft.com/RoleAssignmentSchedule.ReadWrite.Directory',
+        'https://graph.microsoft.com/RoleEligibilitySchedule.Read.Directory',
+        'https://graph.microsoft.com/SecurityEvents.Read.All',
+        'https://graph.microsoft.com/ServiceHealth.Read.All',
+        'https://graph.microsoft.com/ServiceMessage.Read.All',
+        'https://graph.microsoft.com/ServiceMessageViewpoint.Write',
+        'https://graph.microsoft.com/Sites.Read.All',
+        'https://graph.microsoft.com/Tasks.ReadWrite',
+        'https://graph.microsoft.com/Team.Create',
+        'https://graph.microsoft.com/TeamMember.ReadWrite.All',
+        'https://graph.microsoft.com/TeamsAppInstallation.ReadWriteForUser',
+        'https://graph.microsoft.com/TeamSettings.ReadWrite.All',
+        'https://graph.microsoft.com/TeamsTab.ReadWrite.All',
+        'https://graph.microsoft.com/User.Invite.All',
+        'https://manage.office.com/ActivityFeed.Read',
+        'https://manage.office.com/ServiceHealth.Read',
+        'https://analysis.windows.net/powerbi/api/Dataset.Read.All',
+        'https://api.powerapps.com//User',
+        'https://microsoft.sharepoint-df.com/AllSites.FullControl',
+        'https://microsoft.sharepoint-df.com/TermStore.ReadWrite.All',
+        'https://microsoft.sharepoint-df.com/User.ReadWrite.All'
+    ],
     applicationName: `CLI for Microsoft 365 v${app.packageJson().version}`,
     delimiter: 'm365\$',
-    cliEntraAppId: process.env.CLIMICROSOFT365_ENTRAAPPID || cliEntraAppId,
-    tenant: process.env.CLIMICROSOFT365_TENANT || 'common',
-    configstoreName: 'cli-m365-config'
+    configstoreName: 'cli-m365-config',
+    minimalScopes: [
+        'https://graph.microsoft.com/User.Read'
+    ]
 };
 //# sourceMappingURL=config.js.map

package/dist/m365/base/PowerAutomateCommand.js

@@ -2,7 +2,7 @@ import auth, { CloudType } from '../../Auth.js';
 import Command, { CommandError } from '../../Command.js';
 import { accessToken } from '../../utils/accessToken.js';
 export default class PowerAutomateCommand extends Command {
-    get resource() {
+    static get resource() {
         return 'https://api.flow.microsoft.com';
     }
     async initAction(args, logger) {

package/dist/m365/base/SpoCommand.js

@@ -94,7 +94,7 @@ export default class SpoCommand extends Command {
         catch (error) {
             throw new CommandError(error);
         }
-        if (auth.connection.active && AuthType[auth.connection.authType] === AuthType[AuthType.Secret]) {
+        if (auth.connection.active && auth.connection.authType === AuthType.Secret) {
             throw new CommandError(`SharePoint does not support authentication using client ID and secret. Please use a different login type to use SharePoint commands.`);
         }
         await super.action(logger, args);

package/dist/m365/cli/commands/cli-consent.js

@@ -4,7 +4,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
 var _CliConsentCommand_instances, _CliConsentCommand_initTelemetry, _CliConsentCommand_initOptions, _CliConsentCommand_initValidators;
-import config from '../../../config.js';
+import { cli } from '../../../cli/cli.js';
 import AnonymousCommand from '../../base/AnonymousCommand.js';
 import commands from '../commands.js';
 class CliConsentCommand extends AnonymousCommand {
@@ -26,7 +26,7 @@ class CliConsentCommand extends AnonymousCommand {
         if (args.options.service === 'VivaEngage') {
             scope = 'https://api.yammer.com/user_impersonation';
         }
-        await logger.log(`To consent permissions for executing ${args.options.service} commands, navigate in your web browser to https://login.microsoftonline.com/${config.tenant}/oauth2/v2.0/authorize?client_id=${config.cliEntraAppId}&response_type=code&scope=${encodeURIComponent(scope)}`);
+        await logger.log(`To consent permissions for executing ${args.options.service} commands, navigate in your web browser to https://login.microsoftonline.com/${cli.getTenant()}/oauth2/v2.0/authorize?client_id=${cli.getClientId()}&response_type=code&scope=${encodeURIComponent(scope)}`);
     }
     async action(logger, args) {
         await this.initAction(args, logger);

package/dist/m365/cli/commands/cli-doctor.js

@@ -1,5 +1,5 @@
 import os from 'os';
-import auth, { AuthType } from '../../../Auth.js';
+import auth from '../../../Auth.js';
 import { cli } from '../../../cli/cli.js';
 import Command from '../../../Command.js';
 import { app } from '../../../utils/app.js';
@@ -31,9 +31,9 @@ class CliDoctorCommand extends Command {
             },
             cliVersion: app.packageJson().version,
             nodeVersion: process.version,
-            cliAadAppId: auth.connection.appId,
-            cliAadAppTenant: validation.isValidGuid(auth.connection.tenant) ? 'single' : auth.connection.tenant,
-            authMode: AuthType[auth.connection.authType],
+            cliEntraAppId: auth.connection.appId,
+            cliEntraAppTenant: validation.isValidGuid(auth.connection.tenant) ? 'single' : auth.connection.tenant,
+            authMode: auth.connection.authType,
             cliEnvironment: process.env.CLIMICROSOFT365_ENV ? process.env.CLIMICROSOFT365_ENV : '',
             cliConfig: cli.getConfig().all,
             roles: roles,

package/dist/m365/cli/commands/config/config-set.js

@@ -4,8 +4,10 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
 var _CliConfigSetCommand_instances, _a, _CliConfigSetCommand_initTelemetry, _CliConfigSetCommand_initOptions, _CliConfigSetCommand_initValidators;
+import { AuthType } from "../../../../Auth.js";
 import { cli } from "../../../../cli/cli.js";
 import { settingsNames } from "../../../../settingsNames.js";
+import { validation } from "../../../../utils/validation.js";
 import AnonymousCommand from "../../../base/AnonymousCommand.js";
 import commands from "../../commands.js";
 class CliConfigSetCommand extends AnonymousCommand {
@@ -34,7 +36,6 @@ class CliConfigSetCommand extends AnonymousCommand {
             case settingsNames.printErrorsAsPlainText:
             case settingsNames.prompt:
             case settingsNames.showHelpOnFailure:
-            case settingsNames.showSpinner:
                 value = args.options.value === 'true';
                 break;
             default:
@@ -82,15 +83,22 @@ _a = CliConfigSetCommand, _CliConfigSetCommand_instances = new WeakSet(), _CliCo
             cli.helpModes.indexOf(args.options.value) === -1) {
             return `${args.options.value} is not a valid value for the option ${args.options.key}. Allowed values: ${cli.helpModes.join(', ')}`;
         }
-        const allowedAuthTypes = ['certificate', 'deviceCode', 'password', 'identity', 'browser', 'secret'];
         if (args.options.key === settingsNames.authType &&
-            allowedAuthTypes.indexOf(args.options.value) === -1) {
-            return `${args.options.value} is not a valid value for the option ${args.options.key}. Allowed values: ${allowedAuthTypes.join(', ')}`;
+            !Object.values(AuthType).map(String).includes(args.options.value)) {
+            return `${args.options.value} is not a valid value for the option ${args.options.key}. Allowed values: ${Object.values(AuthType).join(', ')}`;
         }
         if (args.options.key === settingsNames.helpTarget &&
             !cli.helpTargets.includes(args.options.value)) {
             return `${args.options.value} is not a valid value for the option ${args.options.key}. Allowed values: ${cli.helpTargets.join(', ')}`;
         }
+        if (args.options.key === settingsNames.clientId &&
+            !validation.isValidGuid(args.options.value)) {
+            return `${args.options.value} is not a valid value for the option ${args.options.key}. The value has to be a valid GUID.`;
+        }
+        if (args.options.key === settingsNames.tenantId &&
+            !(args.options.value === 'common' || validation.isValidGuid(args.options.value))) {
+            return `${args.options.value} is not a valid value for the option ${args.options.key}. The value has to be a valid GUID or 'common'.`;
+        }
         return true;
     });
 };

package/dist/m365/cli/commands.js

@@ -11,7 +11,6 @@ export default {
     CONFIG_SET: `${prefix} config set`,
     CONSENT: `${prefix} consent`,
     DOCTOR: `${prefix} doctor`,
-    ISSUE: `${prefix} issue`,
-    RECONSENT: `${prefix} reconsent`
+    ISSUE: `${prefix} issue`
 };
 //# sourceMappingURL=commands.js.map

package/dist/m365/commands/login.js

@@ -3,14 +3,13 @@ import { z } from 'zod';
 import auth, { AuthType, CloudType } from '../../Auth.js';
 import Command, { CommandError, globalOptionsZod } from '../../Command.js';
 import { cli } from '../../cli/cli.js';
-import config from '../../config.js';
 import { settingsNames } from '../../settingsNames.js';
 import { zod } from '../../utils/zod.js';
 import commands from './commands.js';
 const options = globalOptionsZod
     .extend({
-    authType: zod.alias('t', z.enum(['certificate', 'deviceCode', 'password', 'identity', 'browser', 'secret']).optional()),
-    cloud: z.nativeEnum(CloudType).optional().default(CloudType.Public),
+    authType: zod.alias('t', zod.coercedEnum(AuthType).optional()),
+    cloud: zod.coercedEnum(CloudType).optional().default(CloudType.Public),
     userName: zod.alias('u', z.string().optional()),
     password: zod.alias('p', z.string().optional()),
     certificateFile: zod.alias('c', z.string().optional()
@@ -22,7 +21,8 @@ const options = globalOptionsZod
     appId: z.string().optional(),
     tenant: z.string().optional(),
     secret: zod.alias('s', z.string().optional()),
-    connectionName: z.string().optional()
+    connectionName: z.string().optional(),
+    ensure: z.boolean().optional()
 })
     .strict();
 class LoginCommand extends Command {
@@ -37,6 +37,9 @@ class LoginCommand extends Command {
     }
     getRefinedSchema(schema) {
         return schema
+            .refine(options => typeof options.appId !== 'undefined' || cli.getConfig().get(settingsNames.clientId), {
+            message: `appId is required. TIP: use the "m365 setup" command to configure the default appId`
+        })
             .refine(options => options.authType !== 'password' || options.userName, {
             message: 'Username is required when using password authentication',
             path: ['userName']
@@ -49,74 +52,32 @@ class LoginCommand extends Command {
             message: 'Specify either certificateFile or certificateBase64Encoded, but not both.',
             path: ['certificateBase64Encoded']
         })
-            .refine(options => options.authType !== 'certificate' || options.certificateFile || options.certificateBase64Encoded, {
+            .refine(options => options.authType !== 'certificate' ||
+            options.certificateFile ||
+            options.certificateBase64Encoded ||
+            cli.getConfig().get(settingsNames.clientCertificateFile) ||
+            cli.getConfig().get(settingsNames.clientCertificateBase64Encoded), {
             message: 'Specify either certificateFile or certificateBase64Encoded',
             path: ['certificateFile']
         })
-            .refine(options => options.authType !== 'secret' || options.secret, {
+            .refine(options => options.authType !== 'secret' ||
+            options.secret ||
+            cli.getConfig().get(settingsNames.clientSecret), {
             message: 'Secret is required when using secret authentication',
             path: ['secret']
         });
     }
     async commandAction(logger, args) {
-        // disconnect before re-connecting
         if (this.debug) {
             await logger.logToStderr(`Logging out from Microsoft 365...`);
         }
-        const deactivate = () => auth.connection.deactivate();
-        const login = async () => {
-            if (this.verbose) {
-                await logger.logToStderr(`Signing in to Microsoft 365...`);
-            }
-            const authType = args.options.authType || cli.getSettingWithDefaultValue(settingsNames.authType, 'deviceCode');
-            auth.connection.appId = args.options.appId || config.cliEntraAppId;
-            auth.connection.tenant = args.options.tenant || config.tenant;
-            auth.connection.name = args.options.connectionName;
-            switch (authType) {
-                case 'password':
-                    auth.connection.authType = AuthType.Password;
-                    auth.connection.userName = args.options.userName;
-                    auth.connection.password = args.options.password;
-                    break;
-                case 'certificate':
-                    auth.connection.authType = AuthType.Certificate;
-                    auth.connection.certificate = args.options.certificateBase64Encoded ? args.options.certificateBase64Encoded : fs.readFileSync(args.options.certificateFile, 'base64');
-                    auth.connection.thumbprint = args.options.thumbprint;
-                    auth.connection.password = args.options.password;
-                    break;
-                case 'identity':
-                    auth.connection.authType = AuthType.Identity;
-                    auth.connection.userName = args.options.userName;
-                    break;
-                case 'browser':
-                    auth.connection.authType = AuthType.Browser;
-                    break;
-                case 'secret':
-                    auth.connection.authType = AuthType.Secret;
-                    auth.connection.secret = args.options.secret;
-                    break;
-            }
-            auth.connection.cloudType = args.options.cloud;
-            try {
-                await auth.ensureAccessToken(auth.defaultResource, logger, this.debug);
-                auth.connection.active = true;
-            }
-            catch (error) {
-                if (this.debug) {
-                    await logger.logToStderr('Error:');
-                    await logger.logToStderr(error);
-                    await logger.logToStderr('');
-                }
-                throw new CommandError(error.message);
-            }
-            const details = auth.getConnectionDetails(auth.connection);
-            if (this.debug) {
-                details.accessToken = JSON.stringify(auth.connection.accessTokens, null, 2);
-            }
-            await logger.log(details);
-        };
-        deactivate();
-        await login();
+        if (this.shouldLogin(args.options)) {
+            auth.connection.deactivate();
+            await this.login(logger, args);
+        }
+        else {
+            await this.ensureAccessToken(logger);
+        }
     }
     async action(logger, args) {
         try {
@@ -128,6 +89,117 @@ class LoginCommand extends Command {
         await this.initAction(args, logger);
         await this.commandAction(logger, args);
     }
+    shouldLogin(options) {
+        if (!auth.connection.active) {
+            return true;
+        }
+        if (!options.ensure) {
+            return true;
+        }
+        const authType = options.authType || cli.getSettingWithDefaultValue(settingsNames.authType, 'deviceCode');
+        if (authType !== auth.connection.authType) {
+            return true;
+        }
+        if (options.cloud !== auth.connection.cloudType) {
+            return true;
+        }
+        if (options.appId && options.appId !== auth.connection.appId) {
+            return true;
+        }
+        if (options.tenant && options.tenant !== auth.connection.tenant) {
+            return true;
+        }
+        if (authType === AuthType.Password && (options.password && options.userName !== auth.connection.userName)) {
+            return true;
+        }
+        if (authType === AuthType.Certificate && (options.certificateFile && (auth.connection.certificate !== fs.readFileSync(options.certificateFile, 'base64')))) {
+            return true;
+        }
+        if (authType === AuthType.Identity && (options.userName && options.userName !== auth.connection.userName)) {
+            return true;
+        }
+        if (authType === AuthType.Secret && (options.secret && options.secret !== auth.connection.secret)) {
+            return true;
+        }
+        const now = new Date();
+        const accessToken = auth.connection.accessTokens[auth.defaultResource];
+        const expiresOn = accessToken && accessToken.expiresOn ?
+            // if expiresOn is serialized from the service file, it's set as a string
+            // if it's coming from MSAL, it's a Date
+            typeof accessToken.expiresOn === 'string' ? new Date(accessToken.expiresOn) : accessToken.expiresOn
+            : new Date(0);
+        if (expiresOn < now) {
+            return true;
+        }
+        return false;
+    }
+    async ensureAccessToken(logger) {
+        try {
+            await auth.ensureAccessToken(auth.defaultResource, logger, this.debug);
+            auth.connection.active = true;
+        }
+        catch (error) {
+            if (this.debug) {
+                await logger.logToStderr('Error:');
+                await logger.logToStderr(error);
+                await logger.logToStderr('');
+            }
+            throw new CommandError(error.message);
+        }
+    }
+    getCertificate(options) {
+        // command args take precedence over settings
+        if (options.certificateFile) {
+            return fs.readFileSync(options.certificateFile).toString('base64');
+        }
+        if (options.certificateBase64Encoded) {
+            return options.certificateBase64Encoded;
+        }
+        return cli.getConfig().get(settingsNames.clientCertificateFile) ||
+            cli.getConfig().get(settingsNames.clientCertificateBase64Encoded);
+    }
+    ;
+    async login(logger, args) {
+        if (this.verbose) {
+            await logger.logToStderr(`Signing in to Microsoft 365...`);
+        }
+        const authType = args.options.authType || cli.getSettingWithDefaultValue(settingsNames.authType, 'deviceCode');
+        auth.connection.appId = args.options.appId || cli.getClientId();
+        auth.connection.tenant = args.options.tenant || cli.getTenant();
+        auth.connection.name = args.options.connectionName;
+        switch (authType) {
+            case 'password':
+                auth.connection.authType = AuthType.Password;
+                auth.connection.userName = args.options.userName;
+                auth.connection.password = args.options.password;
+                break;
+            case 'certificate':
+                auth.connection.authType = AuthType.Certificate;
+                auth.connection.certificate = this.getCertificate(args.options);
+                auth.connection.thumbprint = args.options.thumbprint;
+                auth.connection.password = args.options.password ?? cli.getConfig().get(settingsNames.clientCertificatePassword);
+                break;
+            case 'identity':
+                auth.connection.authType = AuthType.Identity;
+                auth.connection.userName = args.options.userName;
+                break;
+            case 'browser':
+                auth.connection.authType = AuthType.Browser;
+                break;
+            case 'secret':
+                auth.connection.authType = AuthType.Secret;
+                auth.connection.secret = args.options.secret || cli.getConfig().get(settingsNames.clientSecret);
+                break;
+        }
+        auth.connection.cloudType = args.options.cloud;
+        await this.ensureAccessToken(logger);
+        const details = auth.getConnectionDetails(auth.connection);
+        if (this.debug) {
+            details.accessToken = JSON.stringify(auth.connection.accessTokens, null, 2);
+        }
+        await logger.log(details);
+    }
+    ;
 }
 export default new LoginCommand();
 //# sourceMappingURL=login.js.map