{"id":4628,"date":"2026-02-06T10:44:19","date_gmt":"2026-02-06T09:44:19","guid":{"rendered":"https:\/\/lieben.nu\/liebensraum\/?p=4628"},"modified":"2026-02-06T10:55:56","modified_gmt":"2026-02-06T09:55:56","slug":"silent-provisioning-of-fido-key-to-use-for-headless-requests-against-hidden-apis","status":"publish","type":"post","link":"https:\/\/lieben.nu\/liebensraum\/2026\/02\/silent-provisioning-of-fido-key-to-use-for-headless-requests-against-hidden-apis\/","title":{"rendered":"Silent provisioning of Fido key to use for headless requests against hidden API’s"},"content":{"rendered":"\n

So there’s this problem with lots of Microsoft API’s not allowing service principals to call them. I’ve written about this a few times in the past \ud83d\ude42<\/p>\n\n\n\n

These api’s want a user. And a user has to do MFA, right?<\/p>\n\n\n\n

Not with this! <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

When I read Nathan McNulty’s LinkedIn post<\/a> this morning I got a bit hyped and just HAD to get it working. He has a way to use a stored passkey to log in silently to all admin portals\/hidden api’s etc.<\/p>\n\n\n\n

The missing part I wanted to solve, is to actually generate that passkey for a given global admin in the tenant.<\/p>\n\n\n\n

Took a bit of messing around with how to generate the keys using a virtual authenticator, but it works! Here it is:<\/p>\n\n\n\n

https:\/\/github.com\/jflieben\/assortedFunctionsV2\/blob\/main\/New-FidoKey.ps1<\/a><\/p>\n\n\n\n

So basically:<\/p>\n\n\n\n

    \n
  1. register app with client id\/secret and UserAuthenticationMethod.ReadWrite.All<\/li>\n\n\n\n
  2. run New-FidoKey<\/li>\n\n\n\n
  3. use the file it outputs with Nathan’s passkey login function<\/a><\/li>\n<\/ol>\n\n\n\n

    I should also give an honorary mention to Fabian Bader<\/a> for the work he did to get us here!<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    disclaimer: don’t store this stuff where anyone can find it!<\/p>\n\n\n\n

    disclaimer2: you’ll have to set your fido policy to allow not force attestion or key restrictions<\/p>\n","protected":false},"excerpt":{"rendered":"

    So there’s this problem with lots of Microsoft API’s not allowing service principals to call them. I’ve written about this a few times in the past \ud83d\ude42 These api’s want a user. And a user has to do MFA, right? Not with this! When I read Nathan McNulty’s LinkedIn post this morning I got a … Continue reading Silent provisioning of Fido key to use for headless requests against hidden API’s<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[4,13,39,43],"tags":[],"class_list":["post-4628","post","type-post","status-publish","format-standard","hentry","category-automation","category-entraid","category-powershell","category-security"],"_links":{"self":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/4628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/comments?post=4628"}],"version-history":[{"count":3,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/4628\/revisions"}],"predecessor-version":[{"id":4633,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/4628\/revisions\/4633"}],"wp:attachment":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/media?parent=4628"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/categories?post=4628"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/tags?post=4628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}