We finally have some news. PowerShell 7.4 support is schedule for June 15 - github.com/PowerShell/P...

I assume Policy.Read.ApplicationConfiguration is the reason.

The not supported for Delegated (work or school account) confuses me? :-)

learn.microsoft.com/en-us/powers...

Application Administrator or Cloud Application Administrator...

merill.net - After using Update-MgPolicyDefaultAppManagementPolicy on 6 tenants multiple times my conclusion is that the documentation is wrong :-)
You need Security Administrator + Application Administrator for it to work. If you only have Security Administrator you get an 403 error.

Ok. Thanks for answering :-)

Sorry I missed the blue box :-( Thanks for answering!

Thanks, @merill.net - Is the Global Admin role required to update the tenant app management policy, or will some other role suffice?

Congrats. Any tips for good prep material?

CC: @alexandair.bsky.social, @jeftek.com

Ok. Thanks for taking time to answer 👍

I get that it is possible to steal tokens so if the role is active for 1 hour and somebody steals the MFA tokens they have one hour with access but that is the same for cloud only account.
We have a lot of discussions around this a the moment, so I would very much like to understand it! :-)

Sorry if I am a little dense :-) Users are in AD. In Entra they have MFA configured. The PIM setting require them to sign-in and use MFA when a role is activated. If they are compromised on-prem only their password is compromised not their MFA method. So how can anybody get around the MFA policy?

Hi Jef,
I am surprised about this. If you on PIM role activation require reauthentication via CA authentication context so users has to do sign-in + MFA every time they activate a privilege Entra role, why is it still a non-no to use synced users?

Starter pack