Huge permissions overhaul and reduction, a nice case of practice what you preach we finally got around to 🙂
M365Permissions 1.4.9 released!
All posts by JosL
DriftMaester 1.4.0 adds DevOps test integration
Managed Sites.Selected permissions
Of course you did not give your service principal or managed identity Sites.ReadWrite.All right? Right?
Ok, well, if you did, I can imagine, since there is no GUI for it and having to look up site ID’s, MI/SPN’s GUID’s and then executing Graph queries is quite the hassle!
So I added a small feature to SPNRoleMgr that makes this a 100% GUI workflow directly in your browser (no installs, no dependencies!).
/tools was built mainly for myself, but you are more than welcome to use it to make your life easier (and please get rid of sites.readwrite.all!)
Replacing MemberOf in Entra after it is deprecated
Microsoft is phasing out the memberOf option in Entra Dynamic Groups, in November.
https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-rule-member-of
This was in preview, but thousands upon thousands of tenants are of course using this in production. Microsoft thus may delay, but in either case, this called for a replacement. A good plan and Claude to the rescue!
A simple azure runbook you can plug and play into your environment, readme and code are here:
https://github.com/jflieben/assortedFunctionsV2/tree/main/EntraMemberOfSync
It basically completely replaces this functionality in Entra 🙂
Example of output of the runbook:
Bypassing the IMDS cache
The IMDS service allows retrieving tokens for e.g. the Graph API, assuming your managed identity has permissions for it.
But what if you forgot to assign permissions? If you already requested a token, you’ll have to wait an hour because IMDS caches its responses, and there is no documented way to bypass the IMDS cache.
By digging into some old MS modules, I accidentally discovered an undocumented parameter you can add to our IMDS call, which immediately mints a new token. Imagine my surprise, no idea why this isn’t documented as it is useful in all kinds of rollout or escalation scenario’s!
Anyway, to bypass the cache, add bypass_cache=true to your GET params! Example:
http://169.254.169.254/metadata/identity/oauth2/token?api-version=2019-08-01&resource=$($resource)&bypass_cache=true