From 773ab129017a04a8af89e62845bdfbd49755c6e3 Mon Sep 17 00:00:00 2001
From: Tomas Kracmar <tomas.kracmar@cqre.net>
Date: Tue, 14 Apr 2026 18:27:40 +0200
Subject: [PATCH] fix(launcher): strip unsupported auth params when calling
 Initialize-IntuneAuth

---
 Scripts/Start-IntuneToolkit.ps1 | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/Scripts/Start-IntuneToolkit.ps1 b/Scripts/Start-IntuneToolkit.ps1
index 3076df9..821db34 100644
--- a/Scripts/Start-IntuneToolkit.ps1
+++ b/Scripts/Start-IntuneToolkit.ps1
@@ -173,8 +173,15 @@ while($true)
 
     Write-Host "`nLaunching $script ...`n" -ForegroundColor Green
 
+    # Clone params and sanitize for scripts that don't accept the full auth set
+    $launchParams = $commonParams.Clone()
+    if($script -eq "Scripts/Initialize-IntuneAuth.ps1")
+    {
+        @("AppId","Secret","Certificate","AuthMode","RedirectUri","Interactive","Mode","WhatIf") | ForEach-Object { $launchParams.Remove($_) }
+    }
+
     # Execute in same process so TUI flows naturally
-    & $scriptPath @commonParams
+    & $scriptPath @launchParams
 
     Write-Host "`nPress any key to return to the menu..." -ForegroundColor DarkGray
     $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")