Post

This is awesome! Microsoft is killing off the ability for multi-tenant applications to authenticate in directories where a service principal has not been registered. learn.microsoft.com/... I'd like to automate discovery and remediation for admins, but I need help testing :)

Anyone able to test this? #Remove the space after https (Invoke-MgGraphRequest -Uri "https ://graph.microsoft.com/...?`$filter=signInEventTypes/any(t: t eq 'servicePrincipal') and servicePrincipalId eq '00000000-0000-0000-0000-000000000000'&`$top=1").value

They say only look at SP sign-ins in the docs. I got no hits that way but did get some when querying interactive sign-in logs. Planning a PR on the docs to include the Graph API, but I don't have examples in any of my tenants to validate with :( Thanks to anyone that can help!

There are a bunch of #Microsoft365 apps that sign in without using a service principal, like Office 365 Exchange Microservices and Office365 Shell WCSS-Server. I cannot imagine that Microsoft will want customers to create enterprise apps in tenants for these apps. I think I shall ask some questions.