TokenTactics v2

August 16, 2026 · View on GitHub

  ______      __                 __             __  _                     ___ 
 /_  __/___  / /_____  ____     / /_____ ______/ /_(_)_________   _   __ |__ \
  / / / __ \/ //_/ _ \/ __ \   / __/ __ `/ ___/ __/ / ___/ ___/  | | / / __/ /
 / / / /_/ / ,< /  __/ / / /  / /_/ /_/ / /__/ /_/ / /__(__  )   | |/ / / __/ 
/_/  \____/_/|_|\___/_/ /_/   \__/\__,_/\___/\__/_/\___/____/    |___(_)____/

TokenTactics v2

This is an updated version of TokenTactics originally written by Stephan Borosh @rvrsh3ll & Bobby Cooke @0xBoku.

Azure JSON Web Token ("JWT") Manipulation Toolset

Scenario-based OAuth and workload guides are in docs; the individual command reference is in docs/commands.

Azure access tokens allow you to authenticate to certain endpoints as a user who signs in with a device code. If you are in possesion of a FOCI (Family of Client IDs) capable refresh token you can use it to get access tokens to all known FOCI capable endpoints. Since the refresh-token also contains the information if the user has done multi-factor authentication you can use this. Once you have a user's access token, it may be possible to access certain apps such as Outlook, SharePoint, OneDrive, MSTeams and more.

For instance, if you have a Graph or MSGraph refresh token, you can then connect to Azure and dump users, groups, etc. You could then, depending on conditional access policies, switch to an Azure Core Management token and run AzureHound. Then, get an Outlook access token and read/send emails or MS Teams and read/send teams messages!

For more on Azure token types Microsoft identity platform access tokens

There are some example requests to endpoints in the resources folder. There is also an example phishing template for device code phishing.

You may also use these tokens with AAD Internals as well. We strongly recommended to check this amazing tool out.

Installation and Usage

Import-Module .\TokenTactics.psd1
Get-Help Get-EntraIDTokenFromDeviceCode
Invoke-RefreshToSubstrateToken -Domain "myclient.org"

Testing

The test suite requires PowerShell 7 and Pester 5.7.1. It uses mocked HTTP responses and does not require Entra ID credentials or network access.

Install-Module Pester -RequiredVersion 5.7.1 -Scope CurrentUser
pwsh ./tests/Invoke-Tests.ps1

The same suite runs on Linux, macOS, and Windows for every pull request.

Get refresh token using Device Code flow

Get-EntraIDTokenFromDeviceCode -Client MSGraph

Once the user has logged in, you'll be presented with the JWT and it will be saved in the $response variable. To access the access token use $response.access_token from your PowerShell window to display the token. You may also display the refresh token with $response.refresh_token. Hint: You'll want the refresh token to keep refreshing to new tokens!

Authenticate an application with a TPM-backed certificate

Important

Creating TPM-backed certificates requires Windows, a provisioned TPM, and the Microsoft Platform Crypto Provider.

Create a non-exportable RSA certificate in your current user's personal store and export only its public certificate. The .cer file is DER encoded and can be uploaded under App registrations > Certificates & secrets > Certificates. Configure the application permissions required by the target resource and grant tenant admin consent before requesting a token.

$certificate = New-TPMCertificate `
    -Subject 'CN=EntraID-TPM-Auth' `
    -PublicKeyPath 'C:\Temp\EntraID-TPM-Auth.cer'

$token = Get-EntraIDTokenFromCertificate `
    -TenantId 'contoso.onmicrosoft.com' `
    -ClientId '00000000-0000-0000-0000-000000000000' `
    -CertificateThumbprint $certificate.Thumbprint `
    -Scope 'https://graph.microsoft.com/.default'

Get-EntraIDTokenFromCertificate returns the OAuth token response and also saves it in $response. New-TPMCertificate defaults to Cert:\CurrentUser\My; use -CertStoreLocation Cert:\LocalMachine\My for a service account when the process has the necessary permissions. The TPM private key is deliberately non-exportable; only the public .cer file is written to disk.

DOD/Mil Device Code

Get-EntraIDTokenFromDeviceCode -Client DODMSGraph

Sign-in using a passkey

Important

This feature was introduced in v0.2.20 and required PowerShell 7.0

If you have created a passkey in a third party provider like KeePassXC, Bitwarden, 1Password, or similar you can export the private key material.

Caution

Exporting you private key material is extremely dangerous. Make sure you understand the risk before your move on.

The KeePassXC passkey file format is natively supported and you can point the cmdlet to the file directly. The initial sign-in procedure will only get the required ESTSAUTH cookie and you have to use Get-EntraIDTokenFromESTSCookie to exchange this cookie for a bearer token (access token, refresh token, and id token).

# Retrieve the ESTSAUTH cookie value
Invoke-EntraIDPasskeyLogin -Verbose -KeyFilePath "C:\Users\Fabian\Microsoft.passkey"
# Exchange the ESTSAUTH cookie for bearer tokens
Get-EntraIDTokenFromESTSCookie -CookieValue $Global:ESTSAUTH

If you have an unsupported file format you can specify the required values manually and achieve the same goal.

Invoke-EntraIDPasskeyLogin -Verbose -UserPrincipalName "myUserName@example.com" -UserHandle "XYZ" -CredentialId "9e9c8297-0cde-4726-8852-16c141e15bd3" -PrivateKey $PrivateKey
Get-EntraIDTokenFromESTSCookie -CookieValue $Global:ESTSAUTH

Split passkey flow (e.g. Windows Hello for Business)

The passkey sign-in is also available as separate cmdlets, which allows the assertion to be signed on a different machine than the one running the login flow — for example with a Windows Hello for Business credential (based on ROADtools by Dirk-jan Mollema, MIT licensed).

# 1. Retrieve structured FIDO2 flow state (also saves $global:Fido2FlowState and
#    the web session as $global:Fido2WebSession)
$flow = Get-EntraIDFido2Challenge -UserPrincipalName "user@contoso.com" -Client MSGraph

# 2. Create a signed assertion with the Windows Hello for Business key (Windows only)
#    The object ID is derived from the certificate's user SID; pass -UserId to override it.
#    The assertion is returned as a JSON string, e.g. for transfer via clipboard:
#    Get-WindowsHelloFidoAssertion -Challenge $flow.Challenge | Set-Clipboard
$assertion = Get-WindowsHelloFidoAssertion -Challenge $flow.Challenge -UserId "00000000-0000-0000-0000-000000000002"

# 3. Complete the sign-in. Returns an access token and refresh token by default.
Invoke-EntraIDPasskeyAssertionLogin -FlowState $flow -Assertion $assertion

# Alternatively, return the ESTSAUTH cookie value instead of tokens
Invoke-EntraIDPasskeyAssertionLogin -Assertion $assertion -OutputType ESTSAUTHCookie

The challenge cmdlet builds the authorization URL from the same client names used by the refresh-token cmdlets, such as MSGraph, Graph, MSTeams, AzureManagement, SharePoint, and DeviceRegistration. OAuth options include -Tenant, -Authority, -RedirectUrl, -Scope, -Resource, -UseV1Endpoint, -UseCAE, -UseCodeVerifier, and -CodeVerifier. When -RedirectUrl is omitted, the helper selects the preferred registered redirect URI for the effective client ID using its maintained first-party client mapping; an explicit value overrides it. Use -AuthUrl when a complete custom authorization URL is required. Unknown/custom client IDs must provide -RedirectUrl because a generic native redirect may not be registered for that app.

If you need the FIDO2 user handle of a user (e.g. for the software-based passkey flow), you can calculate it from the tenant ID and the user's object ID:

New-EntraIDUserHandle -TenantId "00000000-0000-0000-0000-000000000001" -UserId "00000000-0000-0000-0000-000000000002"

Use the returned UserHandle or UserHandleBase64Url property in an assertion. The legacy UserHandleBase64 property remains padded standard Base64 for compatibility.

If you have obtained an sccauth cookie from an authenticated session to security.microsoft.com (e.g., via Evilginx or browser DevTools), you can use it to retrieve Entra ID access tokens for a broad set of resources through the Microsoft Defender XDR portal.

# Retrieve a Microsoft Graph token using the sccauth cookie
Get-EntraIDTokenFromSCCAUTHCookie -SCCAuth "your_sccauth_value" -ResourceName MicrosoftGraph

# Provide an XSRF token explicitly to skip the bootstrapping request
Get-EntraIDTokenFromSCCAUTHCookie -SCCAuth "your_sccauth_value" -XSRF "your_xsrf_value" -ResourceName Azure

# Use a custom resource URL
Get-EntraIDTokenFromSCCAUTHCookie -SCCAuth "your_sccauth_value" -Resource "https://management.core.windows.net/"

Supported -ResourceName values: Azure, LogAnalytics, MATP, MCAS, MicrosoftGraph, MicrosoftOffice, Purview, PurviewACC, ThreatIntelligencePortal.

Get-EntraIDTokenFromESTSCookie -ESTSAuthCookie "0.AbcApTk..."

This module uses authorization code flow to obtain an access token and refresh token using ESTSAuth (or ESTSAuthPersistent) cookie. Useful if you have phished a session via Evilginx or have otherwise obtained this cookie.

Be sure to use the right cookie! ESTSAuthPersistent is only useful when a CA policy actually grants a persistent session. Otherwise, you should use ESTSAuth. You can usually tell which one to use based on length, the longer cookie is the one you want to use :)

This feature was backported from the pull request by rotarydrone in the original repo.

Get a refresh token using the authorization code flow

One of the most prominent example for this oauth2 flow (at least at the beginning on 2025) is the Intune Company Portal which allows, for some resources, to bypass device compliance requirements.

This intel was first published by @dirkjan and then released at Black Hat Europe to a wider audience by @TEMP43487580

JumpsecLabs published a blog article and a POC in form of TokenSmith shortly after.

Now the same capabilities are available in TokenTacticsV2.

Get-AzureAuthorizationCode will create a URL you can then use to authenticate to.

Get-EntraIDTokenFromAuthorizationCode uses wither the full URL or can be used with the parameters AuthorizationCode and RedirectUrl to exchange the auth code to an access and refresh token. After that you can try to get access to other resources as always.

How to use the new cmdlets

Get a nested app token using NAA / BroCi

Get-EntraIDTokenFromNestedAppAuth exchanges a broker application's refresh token for a token issued to a nested application. By default, the cmdlet uses the Azure Portal broker (c44b4083-3bb0-49c1-b47d-974e53cbdf3c) and the ADIbizaUX nested client (74658136-14ec-4630-ad9b-26e160ff0fc6) with Microsoft Graph scopes. Override the broker, nested client, scope, and redirect values as needed.

Supported broker presets: AzurePortal, Teams, Microsoft365, EntraAdminCenter, IntuneAdminCenter, Defender, Purview.

Get-EntraIDTokenFromNestedAppAuth `
    -BrokerPreset Defender `
    -TenantId "e3686c4f-af27-4f22-b9de-062f05b93aac" `
    -RefreshToken $response.refresh_token `
    -AnchorMailbox "Oid:3135fd4e-140c-43c0-ad02-718913648fb9@e3686c4f-af27-4f22-b9de-062f05b93aac" `
    -UseCAE

If you omit -RefreshToken, the cmdlet falls back to $response.refresh_token. If you omit -RedirectUri, it is derived from -BrokerClientId and -BrokerRedirectUri using the brokered brk-<brokerClientId>://<broker-host> format. Explicit -BrokerClientId, -BrokerRedirectUri, and -AuthorityHost values override -BrokerPreset.

The Teams preset follows the newer teams.cloud.microsoft broker shape and automatically adds the client_id token-endpoint query parameter, brk-multihub://m365.cloud.microsoft redirect URI, and the MSAL browser telemetry fields seen in current Teams requests.

Refresh to new access token

If you do not specify a refresh token the cmdlets will use $response.refresh_token as a default.

Invoke-RefreshToOutlookToken -domain "myclient.org"

$OutlookToken.access_token

Additional OAuth 2.0 and workload flows

Client secret and on-behalf-of

Get-EntraIDTokenFromClientSecret implements the application-only client credentials grant. Supply either -ClientSecret or -ClientSecretSecureString; neither value is written by the cmdlet.

Get-EntraIDTokenFromClientSecret -TenantId 'contoso.onmicrosoft.com' -ClientId '00000000-0000-0000-0000-000000000000' -ClientSecret 'client-secret-value' -Scope 'https://graph.microsoft.com/.default'

Get-EntraIDTokenOnBehalfOf exchanges an incoming access token issued to the middle-tier app for a downstream delegated token. The assertion must have the middle-tier application as its audience.

Get-EntraIDTokenOnBehalfOf -TenantId 'contoso.onmicrosoft.com' -ClientId '00000000-0000-0000-0000-000000000000' -ClientSecret 'client-secret-value' -UserAssertion $incomingAccessToken -Scope 'https://graph.microsoft.com/User.Read'

Federated credentials, GitHub Actions, and Azure Arc

Get-EntraIDTokenFromFederatedCredential exchanges an external OIDC JWT for an application token. It accepts -FederatedToken, -FederatedTokenSecureString, or -FederatedTokenPath. The Entra federated credential must exactly match the JWT issuer, subject, and audience.

Get-EntraIDTokenFromGitHubActions -TenantId $env:AZURE_TENANT_ID -ClientId $env:AZURE_CLIENT_ID -Scope 'https://management.azure.com/.default'

The GitHub workflow needs permissions: id-token: write. Configure the app registration federated credential for the target repository/environment and the api://AzureADTokenExchange audience.

Get-EntraIDTokenFromAzureArcManagedIdentity retrieves a resource token from the local Azure Arc managed-identity endpoint. It runs only where IDENTITY_ENDPOINT is present and completes the endpoint's local challenge-file protocol; it is not a federated-credential exchange.

Implicit flow compatibility

Entra recommends authorization code flow with PKCE. When an existing registration requires implicit access tokens, generate an authorization URL and then paste the final browser redirect back into the parser:

$request = New-EntraIDImplicitAuthorizationUrl -TenantId 'organizations' -ClientId '00000000-0000-0000-0000-000000000000' -RedirectUri 'https://app.example/callback' -Scope 'https://graph.microsoft.com/User.Read'
Start-Process $request.AuthorizationUrl
$token = ConvertFrom-EntraIDImplicitRedirect -RedirectUrl '<pasted-final-url>' -ExpectedState $request.State

Enable Access tokens under the application registration's Implicit grant and hybrid flows before using this flow.

Custom federated credential provider

This workflow makes a local certificate the signer for a custom external OIDC issuer. Only public discovery metadata and JWKS are hosted; the PFX/private key and New-EntraIDFederatedClientAssertion remain on the assertion-issuing machine. Hosting options are a Cloudflare named tunnel in front of the checked-in loopback static host (infra/Start-TTFederatedIssuerStaticHost.ps1) or an Azure Storage static website (infra/oidc-static-website.bicep).

$certificate = New-EntraIDFederatedSigningCertificate -PfxPath $pfxPath -PfxPasswordSecureString $password -PublicCertificatePath $publicCertificatePath
$metadata = New-EntraIDFederatedIssuerMetadata -Issuer $issuer -Subject $subject -OutputPath $metadataPath -PfxPath $pfxPath -PfxPasswordSecureString $password
$assertion = New-EntraIDFederatedClientAssertion -Issuer $issuer -Subject $subject -PfxPath $pfxPath -PfxPasswordSecureString $password
$token = Get-EntraIDTokenFromFederatedCredential -TenantId $tenantId -ClientId $clientId -FederatedToken $assertion -Scope $scope

The full step-by-step guide with hosting, publishing, verification, Entra configuration, and key rotation is in docs/use-cases/custom-oidc-provider.md.

Connect to AzureAD using access token

Connect-AzureAD -AadAccessToken $response.access_token -AccountId user@myclient.org

Connect to MgGraph using access token

Invoke-RefreshToMSGraphToken -Domain "myclient.org"
Connect-MgGraph -AccessToken $MSGraphToken.access_token -Scopes "User.Read.All","Group.ReadWrite.All"

Clear tokens

This will remove any token variables.

Clear-Token -Token All

Continuous Access Evaluation

With continuous access evaluation Microsoft implements additional security measures, but also extend the maximum lifetime of an access token to 24 hours. Certain CAE capable service like MSGraph, Exchange, Teams and SharePoint can blocke access tokens based on certain events triggered by Azure AD. Currently those critical events are:

  • User Account is deleted or disabled
  • Password for a user is changed or reset
  • Multi-factor authentication is enabled for the user
  • Administrator explicitly revokes all refresh tokens for a user
  • High user risk detected by Azure AD Identity Protection (not in Teams and SharePoint Online)
Invoke-RefreshToMSGraphToken -Domain "myclient.org" -UseCAE
if ((Parse-JWTtoken $MSGraphToken.access_token).ValidForHours -gt 23) { "MSGraph token is CAE capable" }

Use with AAD Internals

If you have AADInternals installed as well you can use the created access tokens.

Invoke-RefreshToMSTeamsToken -UseCAE -Domain "myclient.org"
Set-AADIntTeamsStatusMessage -Message "My cool status message" -AccessToken $MSTeamsToken.access_token -Verbose

Commands

Get-Command -Module TokenTactics

Only supported user-facing commands are exported; parsing, PKCE, generic refresh, and FIDO cryptographic helpers remain private implementation details.

Authors and contributors

  • @rvrsh3ll Author of TokenTactics (original)
  • @0xBoku co-author of TokenTactics (original) and researcher.
  • @f-bader updated TokenTactics to support V2 endpoint and additional features like CAE. Maintainer of TokenTacticsV2
  • @Pri3st added functions to fetch Storage and Key Vault access tokens and a custom user agent

TokenTactic's methods are highly influenced by the great research of Dr Nestori Syynimaa at https://o365blog.com/.

Changelog

0.6.0 (2026-08-16)

  • Centralize Entra first-party OAuth client IDs, scopes, authorities, endpoint versions, and redirect URIs in a shared registry.
  • Preserve required legacy clients and redirect URIs while routing device-code, authorization-code, cookie, passkey, and refresh flows through the registry.
  • Fix v1 device-code polling, native/URN redirect handling, passkey completion edge cases, and refresh-token verbose logging.
  • Add regression coverage for the OAuth registry, native redirects, device-code contracts, passkey flows, and refresh commandlets.

0.5.0 (2026-08-13)

  • Add OAuth 2.0 client-credentials, on-behalf-of, and implicit-flow compatibility cmdlets, including secure-string credential support and state validation.
  • Add workload identity federation exchanges for external OIDC tokens, GitHub Actions, and Azure Arc managed identities.
  • Add certificate-backed application and OBO authentication with Windows certificate-store and portable PFX support, including OpenSSL fallback on macOS and Linux.
  • Add custom OIDC issuer tooling for signing certificates, discovery/JWKS metadata, client assertions, loopback hosting, and Azure Storage static website deployment.

0.4.0 (2026-08-12)

  • Add Get-EntraIDFido2Challenge to retrieve a FIDO2 sign-in challenge and save the web session for the split passkey flow.
  • Add Get-WindowsHelloFidoAssertion to create a signed WebAuthn assertion with a Windows Hello for Business key. Based on fido_assertion.ps1 by Dirk-jan Mollema (ROADtools), released under the MIT license.
  • Add New-EntraIDUserHandle to calculate the FIDO2 user handle from a tenant ID and user object ID.
  • Add Invoke-EntraIDPasskeyAssertionLogin to complete the passkey sign-in from a signed assertion, returning tokens by default or the ESTSAUTH cookie via -OutputType ESTSAUTHCookie.

0.3.3 (2026-08-05)

  • Add New-TPMCertificate for creating non-exportable, Windows TPM-backed RSA certificates and optionally exporting their public DER certificate.
  • Add Get-EntraIDTokenFromCertificate to request Entra ID application tokens through OAuth 2.0 client credentials with an RS256 certificate assertion.

0.3.2 (2026-07-26)

  • Split the former TokenHandler implementation into grouped module files and split the matching test file into dedicated test files.
  • Rename the device code cmdlet to Get-EntraIDTokenFromDeviceCode and keep Get-EntraIDToken as a compatibility alias.
  • Add TenantId as an alias for the Domain parameter across the refresh-token cmdlets and their shared helper.

0.3.1 (2026-07-26)

  • Add Get-EntraIDTokenFromNestedAppAuth to exchange broker refresh tokens for nested app tokens using NAA / BroCi.
  • Add broker presets for Azure Portal, Teams, Microsoft 365, Entra admin center, Intune admin center, Defender, and Purview, including the newer teams.cloud.microsoft broker flow.
  • Add deterministic Pester coverage for the new Nested App Authentication request contracts and export surface.

0.3.0 (2026-07-13)

  • Add a pinned Pester 5 test runner, cross-platform GitHub Actions checks, test reports, and an enforced coverage baseline.
  • Add deterministic mocked coverage for device code, cookie, authorization code, SCCAUTH, refresh-token, and passkey flows.
  • Fix token cleanup, URL decoding, UTC JWT timestamps, PEM validation, Yammer scope, CAE cookie support, PurviewACC tenant headers, and passkey assertion construction.
  • Export only supported user-facing commands and compatibility aliases. Implementation helpers previously exposed by the wildcard export are now private; scripts should use the corresponding public commands instead.

0.2.22 (2026-04-03)

  • Add Get-EntraIDTokenFromSCCAUTHCookie to retrieve Entra ID access tokens for various resources (Azure, MicrosoftGraph, MATP, MCAS, Purview, etc.) using an sccauth cookie from security.microsoft.com. Optionally accepts an XSRF token; if omitted, bootstraps automatically. Supports an optional TenantId parameter for header injection and PurviewACC resource construction.

0.2.20 (2026-01-01)

  • Renamed all Get-Azure cmdlets to Get-EntraID
  • Add aliases for backwards compatibility
  • Add improved error handling for ConvergedSignIn interrupts
  • Add Invoke-EntraIDPasskeyLogin to automate Passkey sign-in flows. This will save the ESTSAUTH cookie and websession as global variables for reuse in other cmdlets like Get-EntraIDTokenFromESTSCookie
  • Add proxy support for Invoke-EntraIDPasskeyLogin, Get-EntraIDTokenFromCookie, Get-EntraIDTokenFromRefreshTokenCredentialCookie and Get-EntraIDTokenFromESTSCookie

0.2.14 (2025-09-11)

  • Add parameter -Username to prefill the login_hint parameter in cmdlet Get-AzureAuthorizationCode
  • Add parameter -CopyToClipboard in cmdlet Get-AzureAuthorizationCode

0.2.13 (2025-07-29)

  • Fix for Custom User Agent parameter

0.2.12 (2025-06-22)

  • Add awareness for current runspace and minimize output if run as PSTask (e.g. if run in Foreach-Object -parallel)

0.2.11 (2025-06-08)

  • Add the ability to freely define any UserAgent using the new -CustomUserAgent property. Thanks to Pri3st

0.2.10 (2025-02-25)

  • Bugfix: Wrong type initialization

0.2.9 (2025-02-17)

  • Add ResourceTenant for Get-EntraIDToken to support B2B device code phishing
  • Switch out Azure Management client id
  • Add UseCodeVerifier to support Proof Key for Code Exchange (PKCE)
  • Add UseV1Endpoint to some functions to support a broader variety of endpoint tests

0.2.8 (2025-01-18)

  • Add Get-AzureTokenFromRefreshTokenCredentialCookie ("x-ms-RefreshTokenCredential") and add modularized Get-AzureTokenFromCookie
  • Add parameter to choose cookie type (ESTSAuth, ESTSAUTHPERSISTENT) to Get-AzureTokenFromESTSCookie
  • Add sample output for Get-AzureTokenFromAuthorizationCode to Get-AzureAuthorizationCode output
  • Improved output and more verbose error handling

0.2.7 (2025-01-08)

  • Expand Get-AzureTokenFromESTSCookie to support the appverify endpoint
  • Improve cookie management of Get-AzureTokenFromESTSCookie

0.2.6 (2025-01-04)

  • Fix bug custom scopes in Get-AzureAuthorizationCode and Get-AzureTokenFromAuthorizationCode
  • Change default redirect Uri for Get-AzureAuthorizationCode

0.2.5 (2025-01-04)

  • Added new cmdlets Get-AzureAuthorizationCode and Get-AzureTokenFromAuthorizationCode
    Those cmdlets are heavily inspired by TokenSmith maintained by @gladstomych
  • Added new cmdlet Invoke-RefreshToDeviceRegistrationToken which is a TokenTactics version of the AADInternals cmdlet Get-AccessTokenForAADJoin
  • Added v1 endpoint support for Invoke-RefreshToToken with the UseV1Endpoint. This was required to add Invoke-RefreshToDeviceRegistrationToken
  • Added pipeline support for ConvertFrom-JWTtoken
  • Add default values to Get-ForgedUserAgent

0.2.1 (2023-07-21)

  • Support for Linux as a device platform
  • Support for OS/2 as a device platform :grin:

0.2.2 (2023-07-22)

0.2.3 (2023-07-23)

New Features in v2

  • Switched to v2.0 of the Azure AD OAuth2 endpoint
  • Support for continuous access evaluation using the new -UseCAE switch
  • Made ClientId a parameter
  • Changed client_id for MSTeams
  • Added support for OneDrive and SharePoint
  • Added IssuedAt, NotBefore, ExpirationDate and ValidForHours in ConvertFrom-JWTtoken output in human readable format
  • Passkey sign-in support
  • Refactored the codebase to for easier maintenance