You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Adding AT PoP skeleton (#2511)
* adding "-AT PoP" option to "Set-MgGraphOptions"
---------
AT PoP Version 1
Fehintolaobafemi/methodanduri (#2751)
* Making changes to how httpmethod and uri is processed
---------
Fixing and updating the docs
resolving build break
fixing build issues related to docs
resolving PR comments
updating nuget packages
removing unnecessary string assignment
Resolving PR comments
reverting test csproj changes
# Microsoft Graph PowerShell SDK: Access Token Proof of Possession (AT PoP) Capability
2
+
3
+
## Overview
4
+
5
+
This README provides comprehensive details on the Access Token Proof of Possession (AT PoP) functionality introduced in the Microsoft Graph PowerShell SDK. This feature enhances security by binding tokens to specific HTTP methods and URIs, ensuring they are used only for their intended purposes.
6
+
7
+
## Table of Contents
8
+
9
+
-[Key Features](#key-features)
10
+
-[Installation](#installation)
11
+
-[Configuration](#configuration)
12
+
-[Usage Examples](#usage-examples)
13
+
-[References](#references)
14
+
15
+
## Key Features
16
+
17
+
-**Access Token Proof of Possession (AT PoP)**: This feature binds tokens to specific HTTP methods and URIs, preventing misuse of tokens by ensuring they are used only for the intended HTTP requests.
18
+
-**Updated Dependencies**: Compatibility improvements with recent library changes.
19
+
-**Enhanced Token Acquisition Options**: Users can now specify the HTTP method and URI during token acquisition to further secure token usage.
20
+
21
+
### Token acquisition behaviors
22
+
23
+
| Condition | Unbound (default) | Bound (PoP) |
24
+
|-----------|-----------|-----------|
25
+
| First sign-in | New token, interactive| New token, interactive |
26
+
| Existing token, same URI | No new token, silent | No new token, silent |
27
+
| Existing token, different URI | No new token, silent | New token, silent |
28
+
| Existing expired token, below max token refreshes | New token, silent | New token, silent |
29
+
| Existing expired token, exceeded max refreshes | New token, interactive | New token, interactive |
30
+
31
+
## Installation
32
+
33
+
To install the Microsoft Graph PowerShell SDK with the latest updates, use the following command:
Ensure you are using the latest version to access the AT PoP functionality.
40
+
41
+
## Configuration
42
+
43
+
### Enabling Access Token Proof of Possession
44
+
45
+
To enable AT PoP, configure the Microsoft Graph SDK options as follows:
46
+
47
+
```powershell
48
+
Set-MgGraphOption -EnableATPoP $true
49
+
50
+
Connect-MgGraph
51
+
```
52
+
53
+
This configuration ensures that the acquired token is only valid for the specified HTTP method and URI.
54
+
55
+
## Usage Examples
56
+
57
+
### Example 1:
58
+
59
+
```powershell
60
+
Set-MgGraphOption -EnableATPoP $true
61
+
62
+
Connect-MgGraph
63
+
64
+
Invoke-MgGraphRequest -Method GET https://graph.microsoft.com/v1.0/me -Debug
65
+
```
66
+
67
+
### Example 2:
68
+
69
+
```powershell
70
+
Set-MgGraphOption -EnableATPoP $true
71
+
72
+
Connect-MgGraph
73
+
74
+
Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/me/sendMail" -Method POST -Debug
75
+
```
76
+
77
+
## References
78
+
79
+
This README provides a detailed guide on the new AT PoP functionality, offering users the ability to secure their token usage effectively. If you have any questions or need further assistance, please refer to the official [Microsoft Graph PowerShell SDK documentation](https://docs.microsoft.com/en-us/powershell/microsoftgraph/).
Copy file name to clipboardExpand all lines: docs/authentication.md
+20
Original file line number
Diff line number
Diff line change
@@ -112,6 +112,26 @@ When using `-AccessToken`, we won't have access to the refresh token and the cli
112
112
113
113
Before using the provided `-AccessToken` to get Microsoft Graph resources, customers should ensure that the access token has the necessary scopes/ permissions needed to access/modify a resource.
114
114
115
+
### Access Token Proof of Possession (AT PoP)
116
+
117
+
AT PoP is a security mechanism that binds an access token to a cryptographic key that only the token requestor has. This prevents unauthorized use of the token by malicious actors. AT PoP enhances data protection, reduces token replay attacks, and enables fine-grained authorization policies.
118
+
119
+
Note: AT PoP requires Web Account Manager (WAM) to function.
120
+
121
+
Microsoft Graph PowerShell module supports AT PoP in the following scenario:
122
+
123
+
- To enable AT PoP on supported devices
124
+
125
+
```PowerShell
126
+
Set-MgGraphOption -EnableATPoP $true
127
+
```
128
+
129
+
- To disable AT PoP on supported devices
130
+
131
+
```PowerShell
132
+
Set-MgGraphOption -EnableATPoP $false
133
+
```
134
+
115
135
## Web Account Manager (WAM)
116
136
117
137
WAM is a Windows 10+ component that acts as an authentication broker allowing the users of an app benefit from integration with accounts known to Windows, such as the account already signed into an active Windows session.
0 commit comments