Table of Contents
Access Tokens and the Microsoft Graph PowerShell SDK
An interesting Technical Community post on August 26 covers the topic “Instant revocation of service principal bearer tokens with CAE.” In this context, CAE means continuous access evaluation, the Entra ID capability used by some Microsoft 365 services to evaluate access in near real time instead of when bearer (access) tokens expire. All bearer tokens used with Microsoft Graph are access tokens, but “bearer” describes how the token is presented and accepted, while “access token” describes the token’s purpose. I’ll use access tokens from here on.
CAE monitors for events like password resets and account deletion or disablement and can terminate access when these critical events occur, without waiting for the access token to expire. In other words, CAE means that access is terminated much faster than waiting for an access token to expire in 60 or 90 minutes. First enabled for Exchange Online, SharePoint Online, and Teams in 2022, coverage for CAE now includes components like the Microsoft 365 admin center.
Service Principals
Both Entra ID enterprise and registered apps have service principals. Managed identities used by Azure Automation are a special form of service principal. In all cases, service principals are the security principals used by Entra ID to represent applications and managed identities when permissions are granted to access data.
Those permissions can be very powerful, such as allowing an app access to every mailbox or site in the tenant, so it pays to keep an eye on service principals to ask whether the current set of consented permissions are appropriate and required, especially when Microsoft makes new Graph permissions available.
The report script covered in this article scans every service principal in a tenant to report what permissions are assigned and to highlight high-priority permissions such as Mail.Send (send email on behalf of any mailbox).
CAE-Enabled Tokens
The article explains how to recognize a CAE-enabled access token issued by Entra ID through the presence of the xms-cc claim. Given the number of interactive sessions used by tenant administrators to automate different aspects of Microsoft 365, I decided to take a look at the access tokens issued for the Microsoft Graph Command Line Tools application (AppId 14d82eec-204b-4c2f-b7e8-296a70dab67e). This is the default enterprise application for Graph PowerShell SDK interactive sessions.
I explain how to fetch the access token used for an interactive Graph session in this article and note that any Graph API request will return the token when prompted to do so. The simplest kind of request is to ask the Graph about the signed-in user account:
$Uri = 'https://graph.microsoft.com/v1.0/me' Invoke-MgGraphRequest -Uri $Uri -Method Get
That command returns details of the signed-in account. To see the access token, we need to specify that the output type is the HTTP response message:
$Response = Invoke-MgGraphRequest -Uri $Uri -Method GET -OutputType HttpResponseMessage $AccessToken = $Response.RequestMessage.Headers.Authorization.Parameter
Now copy the output from the $AccessToken variable and paste it into jwt.io to decode the Base64 text into viewable information. As Figure 1 shows, the access token contains the CAE claim.
If the signed-in account is subject to a CAE event, such as an administrator disabling the account, the user will be forced to sign in again. This is interesting because normally Graph sessions automatically renew access tokens, meaning that they are never prompted to reauthenticate once a session starts.
Revoking Access for Risky Service Principals
The article goes on to explain how to revoke access for a service principal that’s deemed to be high risk. Possibly some evidence is available to indicate some misuse of an app. At this point, administrators can run the Confirm-MgRiskyServicePrincipalCompromised cmdlet to mark the app as risky. This action is a CAE action, so Entra ID revokes access for the service principal and users are forced to sign in to the app again. To stop people from signing in to a possibly compromised app, a conditional access policy can block access to service principals marked as risky.
Being able to quickly block access to a risky app through CAE is a valuable feature. It all depends on the right claim being in the access tokens issued to apps by Entra ID. Microsoft protect its apps with CAE. Will others follow?
Make sure that you’re not surprised about changes that appear inside Microsoft 365 applications by subscribing to the Office 365 for IT Pros eBook. Our monthly updates make sure that our subscribers stay informed.