The IMDS service allows retrieving tokens for e.g. the Graph API, assuming your managed identity has permissions for it.

But what if you forgot to assign permissions? If you already requested a token, you’ll have to wait an hour because IMDS caches its responses, and there is no documented way to bypass the IMDS cache.

By digging into some old MS modules, I accidentally discovered an undocumented parameter you can add to our IMDS call, which immediately mints a new token. Imagine my surprise, no idea why this isn’t documented as it is useful in all kinds of rollout or escalation scenario’s!

Anyway, to bypass the cache, add bypass_cache=true to your GET params! Example:

http://169.254.169.254/metadata/identity/oauth2/token?api-version=2019-08-01&resource=$($resource)&bypass_cache=true