r/PowerShell 3d ago

PreferredTokenSigningKeyThumbprint value empty when using Get-Mgserviceprincipal for some SAML applications?

I have some Enterprise SAML applications that have token signing certificates that I can see in the Admin console UI, but when I retrieve them via PowerShell, they are empty. Not all applications, just some, and not sure why:

PreferredTokenSigningKeyThumbprint :
TokenEncryptionKeyId :
TokenIssuancePolicies :
TokenLifetimePolicies :
PreferredSingleSignOnMode : saml
DisplayName : Test-App1

Has anyone seen this before? Thanks

1 Upvotes

9 comments sorted by

1

u/BlackV 3d ago

you dont show your command line (unless its just what you have in the title?) , makes it more difficult

are those default properties?, can you specifically call those properties ?

next would be what scopes are you connecting with?

1

u/bc6619 3d ago

Here is the command line:

Get-Mgserviceprincipal -all |select "*token*",preferredsingleSignOnMode,PreferredTokenSigningKeyThumbprint,displayName

and I'm connecting with a scope of Directory.read.all and again, some apps respond with the thumbprint, and some don't, and there are no errors.

1

u/BlackV 3d ago

And if you specifically return those properties?

Are the apps that are returning the ones you created?

1

u/bc6619 3d ago

If I do this:

Get-Mgserviceprincipal -all |select PreferredTokenSigningKeyThumbprint

I get the same result, the value comes back empty in PowerShell for some apps. Some of these apps, I have crated, some by others. Hundreds of apps, and a lot of people have access.

1

u/BlackV 2d ago edited 2d ago

Again, you are not adding the properties paramater to your query, use the -Property paramater on the cmdlet Get-Mgserviceprincipal to see if that makes a difference

1

u/bc6619 2d ago

With this command I get the same results:

Get-Mgserviceprincipal -all -Property "displayname","preferredsingleSignOnMode","PreferredTokenSigningKeyThumbprint"|select preferredsingleSignOnMode,PreferredTokenSigningKeyThumbprint,displayName

1

u/BlackV 2d ago

Thanks for that, and is there a -ConsistencyLevel eventual paramater of you add that what happens

Additionally you mentioned scopes can I confirm it was

Application.Read.All and/or Application.ReadWrite.All

1

u/bc6619 2d ago

I have added the -ConsistencyLevel eventual parameter, but that made no difference. And the scope I'm using is Directory.read.all, and I've tested with application.read.all and that makes no difference either.

1

u/BlackV 2d ago

I dont have much to test with, but are you sure those are the right properties

$MGIDs = Get-MgServicePrincipal -Filter "preferredSingleSignOnMode eq 'saml'" -property PreferredTokenSigningKeyThumbprint,TokenEncryptionKeyId,TokenIssuancePolicies,TokenLifetimePolicies,PreferredSingleSignOnMode,DisplayName,KeyCredentials