Remove-MgApplicationKey - delete expired app registration certificates

Question

I am updating my current scripts from the AzureAD module and want to update a script which deletes expired app registration certificates.

I can remove expired secrets using the new module, however the new command Remove-MgApplicationKey requires proof as per Microsoft document: https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/remove-mgapplicationkey?view=graph-powershell-1.0 . (As part of the request validation for this method, a proof of possession of an existing key is verified before the action can be performed).

`$params = @{
    KeyId = "f0b0b335-1d71-4883-8f98-567911bfdca6"
    Proof = "eyJ0eXAiOiJ..."
}
Remove-MgApplicationKey -ApplicationId $applicationId -BodyParameter $params`

Any suggestions on how to code this in PowerShell?

Thanks.

C# example from Microsoft doc: https://learn.microsoft.com/en-us/graph/application-rollkey-prooftoken

Answer 1

Code would look something like this

using assembly System;
using assembly System.Security.Cryptography.X509Certificates;

# Configure the following
$pfxFilePath = "<Path to your certificate file";
$password = "<Certificate password>";
$objectId = "<id of the application or servicePrincipal object>";

# Get signing certificate
#$signingCert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new([string]$pfxFilePath, [string]$password);
#$signingCert = [System.Security.Cryptography.X509Certificates]::X509Certificate2($pfxFilePath, $password);
$signingCert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new();
$signingCert.CreateFromEncryptedPemFile($pfxFilePath, $password, $null)
#$signingCert | Format-Table
#$signingCert.filename = $pfxFilePath;
#$signingCert.password = $password;
# audience
$aud = "00000002-0000-0000-c000-000000000000";

#aud and iss are the only required claims.
$claims = [System.Collections.Generic.Dictionary[string, object]]::new()
$claims.Add("aud", $aud)
$claims.Add("iss", $objectId)

#token validity should not be more than 10 minutes
$now = [DateTime]::UtcNow;
$securityTokenDescriptor = New-Object [System.Security.Cryptography.X509Certificates.SecurityTokenDescriptor]::new()

    $securityTokenDescriptor.Claims = $claims,
    $securityTokenDescriptor.NotBefore = $now,
    $securityTokenDescriptor.Expires = $now.AddMinutes(10),
    $securityTokenDescriptor.SigningCredentials = New-Object X509SigningCredentials($signingCert);


$handler = [Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler]::new();
$x = handler.CreateToken($securityTokenDescriptor);
Write-Host x;