PowerShell for AzureAD nerds...I summon you!!!!

3,214 Views | 3 Replies | Last: 7 yr ago by AGSPORTSFAN07
AGSPORTSFAN07
How long do you want to ignore this user?
All, I'm a complete PowerShell newb....I need help setting the Access and Refresh tokens to minimums for development testing. I know there's a premium UI in AzureAD that's $9/user but I don't have approval for that. So here's what I've learned so far (and I'm hoping y'all can fill in the blanks).

1) After authing my ISE/PowerShell window to Azure AD using Connect-AzureAD, I have to create the policy.
2) I create the policy using something similar to this:

New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"0.00:35:00","MaxAgeSingleFactor":"00.00:10:00"}}') -DisplayName "AccessTokenPolicies" -IsOrganizationDefault $false -Type "TokenLifetimePolicy"

3) I know that I can change it using Set-AzureADPolicy.

So far it's not working. I'm not seeing the refresh token expiration. So my questions are this:

1) What does the version have to do with? Is it the version of the Azure API we're using for auth? Is it important?
2) Do I need to set -IsOrganizationDefault to $True for it to take?
3) I know I left out some other Token configuations from the definition. Do I need to leave those in?
4) Is it necessary to assign the policy to service principal or native app?

Here's the documentation I've been reading through so far:

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-configurable-token-lifetimes

TIA
PoohAh97
How long do you want to ignore this user?
PoohAh97
How long do you want to ignore this user?


It looks like you found this too:

https://stackoverflow.com/questions/43780451/new-azureadpolicy-error-occurred-while-executing-newpolicy

Do you get the same error message? Or does everything act like it worked but nothing changed?
AGSPORTSFAN07
How long do you want to ignore this user?
Yeah. I'm not getting any errors at all. When I do a Get-AzureADPolicy I can see my policy. It's just not actually doing anything for my authenticated app.
AGSPORTSFAN07
How long do you want to ignore this user?
Ok I figured it out. So this is for anyone who actually may need a solution.

[SOLUTION] After you create the policy, you need to tie the policy to an APPID in order for it to take.

Add-AzureADApplicationPolicy -Id <ObjectId of the Application> -RefObjectId <ObjectId of the Policy>
Refresh
Page 1 of 1
 
×
subscribe Verify your student status
See Subscription Benefits
Trial only available to users who have never subscribed or participated in a previous trial.