CLI for m365 - "Error: No access token found."

[isaac-ja]

Successfully installed - npm install -g @pnp/cli-microsoft365@11.7.0
Successfully logged to CLI for m365 using authtype browser and appid + tenantid
Error description: On executing the command "m365 pp environment list --asAdmin --output json"
Getting the error "Error: No access token found."
Opened a Microsoft ticket and they redirected me to open a new issue here. Request your assistance to troubleshoot the error.

[milanholemans]

Hi @isaac-ja, do you have any more information about the permissions you are using?
What output do you get when running m365 cli doctor?

[isaac-ja]

Hi @isaac-ja, do you have any more information about the permissions you are using? What output do you get when running m365 cli doctor?

m365 cli doctor
{
"os": {
"platform": "win32",
"version": "Windows 11 Enterprise",
"release": "10.0.22631"
},
"cliVersion": "11.8.0",
"nodeVersion": "v20.20.1",
"cliEntraAppId": "2051a7fb-3d31-46f6-9f2f-e30016932823",
"cliEntraAppTenant": "single",
"authMode": "browser",
"cliEnvironment": "",
"cliConfig": {},
"roles": [],
"scopes": {}
}

[milanholemans]

Do you have any permissions configured on your app registration?

[isaac-ja]

Do you have any permissions configured on your app registration?

Redirect URL:
Added Redirect URI
a. Mobile and desktop applications platform
https://login.microsoftonline.com/common/oauth2/nativeclient
b. Mobile and desktop applications platform
https://localhost
c. Mobile and desktop applications platform
http://localhost

API Permissions required:
Microsoft Graph -> User.Read.All ; Delegated
Azure Service Management -> user_impersonation ; Delegated
PowerApps Service -> User ; Delegated
Dynamics CRM (1)-> user_impersonation ; Delegated

Authentication Settings:
Authentication(Preview)->Settings-> enabled "Allow public client flows"

[milanholemans]

The weird thing is that you have no access token stored at all which is very odd. At least there should be a Microsoft Graph access token.
Have you tried:

m365 logout
m365 login --debug

To get a view about what's happening. Normally while logging in, a MS Graph access token is fetched.

[isaac-ja]

C:\Users\xx>m365 logout

C:\Users\xx>m365 login --debug
Error: appId: appId is required. TIP: use the "m365 setup" command to configure the default appId.
Run 'm365 login -h' for help.

Note: Masked the appid & tenantid
C:\Users\xx>m365 login --appId XXXXXXX --tenant XXXXX --authType browser --debug
Executing command login with options {"options":{"output":"json","debug":true,"verbose":false,"authType":"browser","cloud":"Public","appId":"XXXXXX","tenant":"XXXX}}
Logging out from Microsoft 365...
Signing in to Microsoft 365...
No token found for resource https://graph.microsoft.com.
[Tue, 02 Jun 2026 13:15:00 GMT] : [] : @azure/msal-node@5.1.5 : Info - getTokenCache called
Retrieving new access token using interactive browser session...
Redirect URL:
https://login.microsoftonline.com/XXXX/oauth2/authorize?response_type=code&client_id=XXXX&redirect_uri=http://localhost:53438&state=bd6ced3b750fc&resource=https://graph.microsoft.com&prompt=select_account

To sign in, use the web browser that just has been opened. Please sign-in there.
Response:
/?code=1.ATg
......

The service returned the code '1.A
......
[Tue, 02 Jun 2026 13:15:08 GMT] : [] : @azure/msal-node@5.1.5 : Info - acquireTokenByCode called
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Verbose - initializeRequestScopes called
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Verbose - createAuthority called
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Verbose - Attempting to get cloud discovery metadata from authority configuration
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Verbose - Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Verbose - Found cloud discovery metadata from hardcoded values.
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Verbose - Attempting to get endpoint metadata from authority configuration
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Verbose - Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Verbose - buildOauthClientConfiguration called
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Verbose - Replacing tenant domain name '941f20cc-2d05-4aa8-ae7c-e7885052d35b' with id '{tenantid}'
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Info - Building oauth client configuration with the following authority: https://login.microsoftonline.com/941f20cc-2d05-4aa8-ae7c-e7885052d35b/oauth2/v2.0/token.
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Verbose - Auth code client created
[Tue, 02 Jun 2026 13:15:08 GMT] : [9fffe786-4683-4117-8c77-410e7b0ebc39] : @azure/msal-node@5.1.5 : Verbose - Replacing tenant domain name '941f20cc-2d05-4aa8-ae7c-e7885052d35b' with id '{tenantid}'
Request:
{
"url": "https://login.microsoftonline.com/XXXX/oauth2/v2.0/token?client-request-id=XXXX",
"method": "post",
"headers": {
"Accept": "application/json, text/plain, /",
"Content-Type": "application/x-www-form-urlencoded;charset=utf-8",
"user-agent": "NONISV|SharePointPnP|CLIMicrosoft365/11.8.0",
"accept-encoding": "gzip, deflate",
"X-ClientService-ClientTag": "M365CLI:11.8.0"
},
"responseType": "text",
"decompress": true,
"data": "client_id=XXXX&redirect_uri=http%3A%2F%2Flocalhost%3A53438&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default%20openid%20profile%20offline_access&code=1.ATgAzCAflAUtqEqufOeIUFLTW_unUSAxPfZGny_jABaTKCMAABE4AA.BQABBAIAAAADAOz_BQD0_0V2b1N0c0FydGlmYWN0cwIAA

Also, I am getting a different error now for the command - C:\Users\xx>m365 pp environment list. For the same command, earlier I was getting "Error: No access token found."

C:\Users\xx>m365 pp environment list
Error: Client network socket disconnected before secure TLS connection was established

I cannot share all the response of the debug output.
Please let me know if you need specific data from the debug output.

[milanholemans]

Have you tried using --authType deviceCode instead while logging in? Does that work?