Monthly Archives: August 2026

EntraID, Identity, Powershell

Managed Sites.Selected permissions

Leave a comment

Of course you did not give your service principal or managed identity Sites.ReadWrite.All right? Right?

Ok, well, if you did, I can imagine, since there is no GUI for it and having to look up site ID’s, MI/SPN’s GUID’s and then executing Graph queries is quite the hassle!

So I added a small feature to SPNRoleMgr that makes this a 100% GUI workflow directly in your browser (no installs, no dependencies!).

/tools was built mainly for myself, but you are more than welcome to use it to make your life easier (and please get rid of sites.readwrite.all!)

Automation, Azure, EntraID

Replacing MemberOf in Entra after it is deprecated

Leave a comment

Microsoft is phasing out the memberOf option in Entra Dynamic Groups, in November.

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-rule-member-of

This was in preview, but thousands upon thousands of tenants are of course using this in production. Microsoft thus may delay, but in either case, this called for a replacement. A good plan and Claude to the rescue!

A simple azure runbook you can plug and play into your environment, readme and code are here:

https://github.com/jflieben/assortedFunctionsV2/tree/main/EntraMemberOfSync

It basically completely replaces this functionality in Entra 🙂

Example of output of the runbook:

Azure, Security

Bypassing the IMDS cache

Leave a comment

The IMDS service allows retrieving tokens for e.g. the Graph API, assuming your managed identity has permissions for it.

But what if you forgot to assign permissions? If you already requested a token, you’ll have to wait an hour because IMDS caches its responses, and there is no documented way to bypass the IMDS cache.

By digging into some old MS modules, I accidentally discovered an undocumented parameter you can add to our IMDS call, which immediately mints a new token. Imagine my surprise, no idea why this isn’t documented as it is useful in all kinds of rollout or escalation scenario’s!

Anyway, to bypass the cache, add bypass_cache=true to your GET params! Example:

http://169.254.169.254/metadata/identity/oauth2/token?api-version=2019-08-01&resource=$($resource)&bypass_cache=true