WAM authentication issues with non-signed in windows account

[insertacoolnamehere]

Describe the bug

When running an iterative script, that runs cmdlets repeatedly against a large array of users/groups, I am repeatedly prompted to re-auth. The WAM window keeps appearing and asking which account I'm trying to sign in as.

Example Script:
Users = @(Array of 50 users)
ForEach (User in Users)
(
Get-MgUser -UserId $member -Property Id,UserPrincipalName,Department
)

Observations:

• repeat auth windows every 3/4 users iterated
• commands is noticeably slower to complete (3 seconds compared to .1 seconds in non-WAM authenticated session)
• I am signed into windows with a productivity account and authenticating to Graph with a separate administrative account

If I downgrade to Graph 2.33, it reverts back to Browser Signin and scripts run fine/normally with no re-auth/slowness

Expected behavior

Authenticate one time when connecting to Graph. Graph cmdlets run at normal, non-WAM authentication speed.

How to reproduce

update to 2.34+ Graph versions that enforce WAM authentication.

SDK Version

2.34+

Latest version known to work for scenario above?

2.33

Known Workarounds

No response

Debug output

Click to expand log

```

</details>


### Configuration

_No response_

### Other information

_No response_

[ramsessanchez]

@insertacoolnamehere This is due to the security protocols implemented by WAM. At the moment there are no plans to remove WAM enablement, however, it is also possible this may be due to a token cache issue that was recently fixed in 2.37.0.

1. Please try running the script using 2.37.0, if the same happens then the behavior is not a token cache, rather a security implementation by WAM auth flow.
2. The recommended path is to create your own application and pass the app/client id to you graph session. This will allow you to do the following: -DisableWAMForMSGraph $true -ClientId <id> This way you will be able to bypass the enforcement of WAM and continue as you were before. This is the recommended path moving forward. Downgrading to a previous version will not work moving forward as we expect versions <2.36.1 to break in the near future.

[insertacoolnamehere]

The same behaviour occurs with 2.37.0

For large organisations, creating an app for each tech is painful.

Why can't WAM be bypassed going forward?

We have 300k users in our tenant, large iterative scripts to traverse thousands of accounts are used every day - how is WAM able to be mandated when this is a known effect?

[ramsessanchez]

For security purposes, WAM is mandated, in particular, for the public application that is used by default when using Connect-MgGraph as it is hosted on the Microsoft tenant. When using your own application you may chose to bypass WAM, hence the recommended path of creating a custom application within your tenant. While we cannot remove customers from the public application, we can add security checkpoints to ensure security. See docs/authentication.md for more information on steps to create a custom application.