[Upcoming Change] Delegated Authentication changes

[gavinbarron]

Hi all,

I get to share some news that is going to be incredibly unpopular dons armour

In the future we intend to make changes to the default application used for delegated authentication. These changes are intended to enhance security for those of you using the default appId to sign in.

When we enable these changes all versions prior to v2.36.1 will no longer be able to use delegated authentication except when using WAM.

The good news out of this, we may be able to relax the WAM only constraint that is in place when using the default appId for >= 2.34.0.

I'm posting this hear to gather your feedback and serve as advance notice that you all should upgrade to version 2.37.0 or higher.

If you are using your own custom ClientID when calling Connect-MgGraph, then you will not be impacted by this change.

[md7648]

Sure you've already fucked it by deploying WAM anyway and fucking up connecting via programs running as admin anyway

[gavinbarron]

Thanks for the feedback md7648. We've got a clearly documented workaround for that scenario.
I'm sorry that the Windows team haven't implemented support for "Run As" cases to work properly and will refer them to your eloquent problem description.

[j0eyv]

Gavin Barron (@gavinbarron) is LoginHint in 2.39 here to stay?

[nkasco]

I'd like to spread awareness of quite a bit of apprehension around this issue. A few key themes:

• Awareness of this sort of breaking change really ought to be more visible than a subtle issue post. MS Learn + GitHub README.md are 2 good starting points.
• Delegated auth flows above ~2.33 (honestly maybe even back to 2.25) have left a lot to be desired. Folks are struggling with authentication consistency, double (or indefinite) auth prompts, and forced use of WAM decreasing performance. There are many issues on this, no need to rehash here but definitely emphasizing the underlying theme.
• WAM might be more secure, but it definitely decreases UX. Sometimes it appears hidden in the background, secondary accounts are meh, etc. I understand that this is a dependency and might require resolution elsewhere, but it was a choice to consume it as one.
• Communicate concrete timelines to help teams plan accordingly.

Appreciate you posting this to start the discussion, let us know how else we can help.

[12Knocksinna]

BTW, what's the formal support statement for older versions? Other groups that mandate WAM (like Teams) have a policy of not supporting older versions of their module. What support is available for SDK versions prior to 2.36.1?

[JustinGrote]

So if I'm on Linux I'm going to be completely unable to use the default appid?

[bashtech]

How does this affect authentication from macOS clients? Will this only be enforced on Windows clients?

[12Knocksinna]

FWIW, suggestion made on Reddit:

_The conflicting assembly breaking them usually is a NewtonSoft.Json assembly which seems to generally have good forwards compatibility. I.e. I have created bindingRedirects for PowerShell/powershell platforms (AzureAutomation Hybrid Runbook workers) and it solved the issue, but did introduce the quirk of having to import modules in a certain order.

https://github.com/ITJoeSchmo/Automation/blob/main/PowerShell%2FFunctions%2FAdd-JsonAssemblyRedirect.ps1_