Isolate Microsoft.Graph.Authentication assembly loading

[PrzemyslawKlys]

Changes proposed in this pull request

• Load Microsoft.Graph.Authentication.dll through a named AssemblyLoadContext on PowerShell Core before importing it as a binary module.
• Register a small managed dependency resolver for that load context so async authentication paths can resolve packaged dependencies from worker threads without requiring a PowerShell runspace.
• Keep Windows PowerShell/Desktop behavior unchanged by continuing to import the binary module by path when AssemblyLoadContext is unavailable.
• Preserve the public command and alias exports from the script module wrapper without re-importing the binary module by path.
• Stop adding the authentication assemblies as generated NestedModules, because that causes PowerShell to load the DLLs before the script module can choose the load context.
• Add focused module import tests that verify the root authentication assembly and worker-thread dependency resolution stay outside AssemblyLoadContext.Default on PowerShell Core.

Why

This is intended as a narrow assembly-isolation improvement for Microsoft 365 module interop scenarios where another module has already loaded incompatible authentication dependencies in the same PowerShell process. The existing module initializer resolver can help with dependency resolution after the root binary is loaded, but it cannot prevent the root authentication assembly itself from being loaded into the default context when the manifest/import path loads the DLL first.

By letting the script module load the root binary into a custom context first, the authentication module has a chance to keep its dependency graph isolated while preserving the existing exported cmdlet surface.

Validation

• pwsh -NoProfile -File .\src\Authentication\Authentication\build-module.ps1 -Release
• pwsh -NoProfile -Command 'Invoke-Pester .\src\Authentication\Authentication\test\Microsoft.Graph.Authentication.Tests.ps1 -Output Detailed'
  • 8 tests passed, including dependency resolution from a worker thread into the isolated load context.
• Artifact import smoke test confirmed:
  • Microsoft.Graph.Authentication was not present in AssemblyLoadContext.Default
  • the active context name was Microsoft.Graph.Authentication.<hash>
  • Connect-MgGraph exported successfully
  • Connect-Graph and Invoke-MgRestMethod aliases resolved correctly
• Live Graph auth smoke on Windows PowerShell 7.6.2 with WAM:
  • Connect-MgGraph -Scopes User.Read -NoWelcome succeeded
  • Azure.Identity, Azure.Identity.Broker, Microsoft.Identity.Client, Microsoft.Identity.Client.Broker, and Microsoft.Identity.Client.Extensions.Msal loaded in the Graph authentication ALC rather than default context.
• Live Exchange-first interop smoke:
  • Import-Module ExchangeOnlineManagement; Connect-ExchangeOnline loaded Exchange MSAL/Broker assemblies in default context.
  • Importing the PR-built Microsoft.Graph.Authentication artifact and running Connect-MgGraph -Scopes User.Read -NoWelcome then succeeded.
  • Graph loaded its own MSAL/Broker/Azure.Identity assemblies in the Graph authentication ALC while Exchange assemblies remained in default context.
• git diff --check

Other links

• Related to Implement proper assembly isolation to play nice with vscode-powershell #2978
• Related to Connect-MgGraph fails after Connect-ExchangeOnline #3394
• Related to ExchangeOnlineManagement and Microsoft.Graph PowerShell modules are mutually incompatible in the same session due to MSAL/WAM conflicts #3576
• Internal validation PR: Isolate Graph authentication assembly loading PrzemyslawKlys/msgraph-sdk-powershell#1

[ramsessanchez]

merging to different branch to kick off tests in ADO

[Copilot]

Pull request overview

This pull request updates the Microsoft.Graph.Authentication PowerShell module wrapper to load Microsoft.Graph.Authentication.dll into a named, non-default AssemblyLoadContext on PowerShell Core, enabling better dependency isolation (notably for Microsoft 365 module interop scenarios where incompatible auth dependencies may already be loaded in-process).

Changes:

• Added a custom AssemblyLoadContext-based import path (PowerShell Core only) with a small managed resolving handler for packaged dependencies.
• Updated export logic in the script-module wrapper to preserve cmdlet/alias exports without re-importing the binary module by path.
• Removed build-time generation of authentication DLLs as NestedModules and added focused import tests for ALC isolation + worker-thread dependency resolution.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/Authentication/Authentication/Microsoft.Graph.Authentication.psm1	Loads the authentication binary module via a named ALC on PowerShell Core and re-exports cmdlets/aliases from the imported binary module.
src/Authentication/Authentication/build-module.ps1	Stops adding authentication assemblies as NestedModules to prevent premature default-context loading.
src/Authentication/Authentication/test/Microsoft.Graph.Authentication.Tests.ps1	Adds Pester coverage to validate non-default ALC loading and worker-thread dependency resolution behavior on PowerShell Core.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.