Peter Lorenzen

Have you installed Microsoft.Graph.Authentication 2.27.0? Could you run Get-MgUser or Get-MgGroup now?
#PowerShell

April 17 2025 Community Call · PowerShell PowerShell · Discussion #25057 Agenda: 7.6 preview release @SydneyhSmith Docker updates @SydneyhSmith PSGallery updates @SydneyhSmith Docs update @sdwheeler PSSummit recap @psjamessp Upcoming conferences @StevenBucher98 @kilasui...

We finally have some news. PowerShell 7.4 support is schedule for June 15 - github.com/PowerShell/P...

I assume Policy.Read.ApplicationConfiguration is the reason.

The not supported for Delegated (work or school account) confuses me? :-)

learn.microsoft.com/en-us/powers...

Application Administrator or Cloud Application Administrator...

merill.net - After using Update-MgPolicyDefaultAppManagementPolicy on 6 tenants multiple times my conclusion is that the documentation is wrong :-)
You need Security Administrator + Application Administrator for it to work. If you only have Security Administrator you get an 403 error.

Ok. Thanks for answering :-)

Sorry I missed the blue box :-( Thanks for answering!

Thanks, @merill.net - Is the Global Admin role required to update the tenant app management policy, or will some other role suffice?

App Management Policies are now in the Entra ID FREE Tier!! So what are app management policies? How can they be used to secure your tenant?

This doesn't happen everyday folks!!

Entra ID application management policies no longer require a Workload ID Premium license! 👏🎁🍾🥳🎊

This change happened back in October last year and I somehow missed it.

Here's a complete walkthrough 🧵👇

✳️ Bookmark this.

Congrats. Any tips for good prep material?

CC: @alexandair.bsky.social, @jeftek.com

Ok. Thanks for taking time to answer 👍

I get that it is possible to steal tokens so if the role is active for 1 hour and somebody steals the MFA tokens they have one hour with access but that is the same for cloud only account.
We have a lot of discussions around this a the moment, so I would very much like to understand it! :-)

Sorry if I am a little dense :-) Users are in AD. In Entra they have MFA configured. The PIM setting require them to sign-in and use MFA when a role is activated. If they are compromised on-prem only their password is compromised not their MFA method. So how can anybody get around the MFA policy?

Hi Jef,
I am surprised about this. If you on PIM role activation require reauthentication via CA authentication context so users has to do sign-in + MFA every time they activate a privilege Entra role, why is it still a non-no to use synced users?

Starter pack