No more delegated access for customers tenant's through powershell API for Azure's Subs

[FrancisALde]

Hi All,
My name is Francesco Alderighi and i'm working in IT since 4 years.

At the beginning of this summer i've done a powershell script that was downloading Azure's subs consumption, the MFA status for the users, and other stuff for every customer's tenant.

Since the beginning of this month (October 2023), i'm facing a problem cause the code that i've written is not taking anymore the access token that i need to do all the API call.

That's the flow that i'm following:

So first of all i login in the Partner Center API repository through an application:

$appId = "XXXXXXXXXXXXXXXXXXXX"
$appSecret = ConvertTo-SecureString -String "XXXXXXXXXXXXXXXXXXXX" -AsPlainText -Force
$tenantId = "XXXXXXXXXXXXXXXXXXXX" 
$scopes = "https://api.partnercenter.microsoft.com/user_impersonation"
$credential = [PSCredential]::new($appId, $appSecret)

$tokenSplat = @{ ApplicationId = $appId 
	Credential = $credential 
    Scopes = $scopes
	TenantId = $tenantId 
	RefreshToken = $env:AzStRefrToken
} 

$newToken = New-PartnerAccessToken @tokenSplat

Then i take every tenants that i need to investigate for my company (around 1000 tenants)
and cycling them i log on everytenant for their resources and data:

$null = $(
        [hashtable]@{
            'AzuToken' = 'https://management.core.windows.net/user_impersonation'
            'AadToken' = 'https://graph.windows.net/.default'
        }
    ).GetEnumerator().ForEach{
        $null = Set-Variable -Force -Name $_.'Name' -Value (
            New-PartnerAccessToken -Scope $_.'Value' -Tenant $tenant -ApplicationId $appId -Credential $credential -RefreshToken $newToken.RefreshToken 
        )
    }

So this is the flow that i'm following, and this worked for 3/4 motnhs, but now since the start of October,
and since the introduction of GDAP, is not working anymore and i don't know what i gotta do.

Is there anyone that is facing the same problems or, hopefully, had already solved it ?

[salbeck-sit]

Have a look at https://tminus365.com/vendor-integrations-break-with-gdap-the-fix/, maybe it can help ? Note that there's a link to another similar article.