Post

Nathan McNulty
@nathanmcnulty.com

This is awesome! Microsoft is killing off the ability for multi-tenant applications to authenticate in directories where a service principal has not been registered. learn.microsoft.com/... I'd like to automate discovery and remediation for admins, but I need help testing :)

learn.microsoft.comRetire Service Principal-Less Authentication - Microsoft identity platformLearn about the mitigation steps tenant administrators should perform for service principal-less authentication behavior deprecation.

2 reposts14 likes

slibbidy.bsky.social
@slibbidy.bsky.social

{"error":{"code":"BadRequest","message":"Invalid version.","innerError":{"date":"2025-04-05T02:17:16","request-id":"74035b24-02c7-4cfa-9f4b-246d2aa891f1","client-request-id":"74035b24-02c7-4cfa-9f4b-246d2aa891f1"}}}

Nathan McNulty
@nathanmcnulty.com

Gah, Bluesky ate it.. Can you try this? (Remove the spaces before each period) Invoke-MgGraphRequest -Uri "https://graph .microsoft .com/beta/auditLogs/signIns?`$filter=signInEventTypes/any(t: t eq 'servicePrincipal') and servicePrincipalId eq '00000000-0000-0000-0000-000000000000'&`$top=1"

slibbidy.bsky.social
@slibbidy.bsky.social

Invalid token! {"error":{"code":"InvalidAuthenticationToken","message":"Access token is empty.","innerError":{"date":"2025-04-05T02:36:10","request-id":"db0418c8-2055-4054-9e29-0b086ca0b457","client-request-id":"db0418c8-2055-4054-9e29-0b086ca0b457"}}}

Nathan McNulty
@nathanmcnulty.com

They say only look at SP sign-ins in the docs. I got no hits that way but did get some when querying interactive sign-in logs. Planning a PR on the docs to include the Graph API, but I don't have examples in any of my tenants to validate with :( Thanks to anyone that can help!

Tony Redmond
@office365itpros.com

There are a bunch of #Microsoft365 apps that sign in without using a service principal, like Office 365 Exchange Microservices and Office365 Shell WCSS-Server. I cannot imagine that Microsoft will want customers to create enterprise apps in tenants for these apps. I think I shall ask some questions.