TokenHeader

TokenHeader.ps1

$authenticationHeader = @{
"Sec-Fetch-Dest" = "empty";
"Sec-Fetch-Mode" = "cors";
        "accept-encoding"        = "gzip, deflate, br";
        "accept-language"        = "en";
        "x-ms-effective-locale"  = "en.en-us"
        "Authorization"          = "Bearer <#TokenValuePlainText#>";
        "Content-Type"           = "application/json";
        "x-ms-client-request-id" = (New-Guid).Guid;
        "x-ms-session-id"        = "12345678910111213141516";
        "Accept"                 = "*/*";
        "x-requested-with"       = "XMLHttpRequest";
        "user-agent"             = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3829.0 Safari/537.36 Edg/77.0.197.1";
        "method"                 = "GET"
    }

Description

This Header can be used to authenticate against the 'hidden' Azure AD API

• Replace the <#TokenValuePlainText#> with your own token value

Example

# ObjectId of target user
$targetObjectId = 'b88545d6-0cef-4502-9549-5398e01ca24b'

# Uri of _hidden_ API endpoint for identity
$baseUri = 'https://canary.iam.ad.ext.azure.com/api/'

$uri = '{0}PasswordReset/IsResetPasswordByObjectIdAllowed?objectId={1}' -f $baseUri, $targetObjectId
Invoke-RestMethod -Uri $uri -Headers $authenticationHeader