Github recently introduced Immutable subject claims for GitHub Actions OIDC tokens. The feature is enabled for all new repos by default, but there has also been some changes in Entra ID. After this rolled out, and Entra ID was updated, creating rules with the old patterns will yield the following message:

Failed to update federated credential. Error detail: The FederatedIdentityCredential.ClaimsMatchingExpression.Value is invalid. Rule exception: Expression configured for issuer ‘https://token.actions.githubusercontent.com‘ either lacks all required claims or contains unallowed claims. paramName: FederatedIdentityCredential.ClaimsMatchingExpression.Value, paramValue: claims[‘sub’] matches ‘repo:xxx@*:pull_request’, objectType: Microsoft.Online.DirectoryServices.Application

Continue reading “Help my Github claims matching expressions are no longer working!” →

Let’s say you have an API with Entra ID authentication for your organization, or for your customers, and you want to allow a nice CLI for your application. You maybe also want to allow both users and service principals to sign in, and maybe you want to be quite agnostic on what kind of runtime environment the module will be used in (local PowerShell, Automation accounts, Github actions etc.). Let me show you how we do this in Fortytwo, so that you can incorporate the same simple methods!

Continue reading “Building a PowerShell module around your Entra ID authenticated API” →

For years, moving security groups from on-premises Active Directory to Microsoft Entra ID has been one of the more frustrating parts of a cloud migration. Organizations either had to recreate groups manually, build custom migration scripts, or accept downtime while replacing existing objects.

Microsoft’s introduction of Group Source of Authority (SOA) conversion changes that. Instead of creating new cloud-native groups, you can transfer management of existing synchronized groups from Active Directory to Entra ID while preserving the group’s identity, memberships, and permissions. This makes it much easier to modernize identity management without breaking existing workloads.

The challenge is scale. Converting a handful of groups through Microsoft Graph or the admin experience is manageable. Converting hundreds—or thousands—of groups quickly becomes repetitive and error-prone.

In this post, I’ll show you how to use PowerShell to perform a bulk conversion of AD-synced groups to Entra ID-managed groups. We’ll automate the process, add error handling and logging, and discuss the prerequisites and limitations you should be aware of before running the script in production.

Continue reading “Mass convert groups from AD to Entra ID using PowerShell” →

Quick blogpost today! Sometimes you need more than the default set of attributes synchronized from Active Directory to Entra ID. Whether it’s employee IDs, location codes, cost centers, or custom application attributes, getting the right data into Entra ID can simplify automation, provisioning, and identity governance.

With Entra ID Cloud Sync, adding custom attributes is straightforward once you know where to look. In this quick guide, I’ll show you how to configure Cloud Sync to bring additional Active Directory attributes into Entra ID.

Continue reading “Adding custom attributes to Entra Cloud Sync from AD” →

Hot off the press – Entra ID now has SCIM support! “This is not new”, some may say, and yes – Entra ID has supported SCIM for outbound provisioning for ages, however, with this new API we can now talk SCIM with Entra ID both for reading and writing data. Let’s check it out!

Continue reading “Diving into the SCIM API available Entra ID” →

In my previous blogpost, we dug into how to create the different object types used by agents, more specifically Agent Identity Blueprints, Agent Identity Blueprint Principals, Agent Identities and Agent Users. Now we will try to authenticate as them, and also see what our logs say, so we can detect usage!

Continue reading “Digging deep into Entra agent identities – #2” →

Just recently, I had a customer that wanted to synchronize photos for their employees from HR to Entra ID. Here is my experience on this issue, as it was surprisingly difficult to do it “properly”.

When I do integrations like this, I want to make them stateless whenever possible, as the complexity is just so much lower with no state to manage at all. After digging around the Graph endpoint documentation and doing some testing, I found that when we upload a new picture, Microsoft is doing some kind of processing of the image data that we upload, removing metadata and saving it as JPEG.

Continue reading “The problem of synchronizing pictures from HR to Entra ID / Microsoft 365” →