Martin H. | MVP

Ultra High Definition Enthusiast / XBOX Guy / Blogger / Love @boxbread / M365/Teams Engineer / PowerShell Enthusiast / Microsoft MVP.

[Martin H. | MVP @mozzeph]

I think my old thread is messed up. I'll start a new one. Today I've released version 2.7.0 of the M365 Call Flow Visualizer. #MSTeams
- [()] will be removed from holiday call handling names because of mermaid syntax errors.
- Added support to display / export MS System Greeting

[Martin H. | MVP @mozzeph]

Outlook and Teams only allow https:// links and dont allow sending links with app specific uri schemes.

I created a prototype redirection service so you can send app deep links via email or chat:

https://t.co/EpBQ1fAlRp

You can paste that uri into the website and then share a weblink via email or chat that opens the app.

[Martin H. | MVP @mozzeph]

I’d never use a work laptop to interview for another job. In fact, I don’t sign into anything personal on my work device.

But I guess it’s pretty normal for startups to use work laptop for anything since they typically don’t really manage them.

Canva even offered their laid-off employees to keep their MacBooks because they’re aware that not everybody owns a personal computer…

Imho, people working in tech should not only understand but also advocate to strictly separate personal and work devices and environments. Even if their employer technically allows personal stuff on work device.

[ASHA @asha_shar]

Today marks the first step in our new 10-year strategic partnership with Take-Two. GTA VI, already the most pre-ordered game ever on Microsoft Store, will be playable on XBOX One through cloud gaming when it launches on November 19.

[Martin H. | MVP @mozzeph]

@nyc_prophet Why people ever assumed this is beyond me. I can’t think of any precedence where a major multiplat game targetted 60fps only on PS5 Pro but not on XBOX Series X or PS5 as well.

[Martin H. | MVP @mozzeph]

@guyrleech @Azure try https://t.co/XbMGLu0VQa

[Martin H. | MVP @mozzeph]

@Flatpanels why can’t they just add support for passthrough audio?

[Martin H. | MVP @mozzeph]

I wonder if AI models rank us internally, like how good someone's ideas and skills are...

[Martin H. | MVP @mozzeph]

@JBoss293 XBOX does so much stuff that people just dont talk about and take for granted.

https://t.co/czfSwTAnbg

[Martin H. | MVP @mozzeph]

+ AMD FSR 4.1 soon.

[Martin H. | MVP @mozzeph]

Looks like Microsoft Accounts are finally showing failed and suspicious login attempts again!

[Martin H. | MVP @mozzeph]

@merill True true. Really great episode with Kelvin btw. I really enjoyed that!

[Martin H. | MVP @mozzeph]

@merill I agree. That's why I said "if you must use secrets". MSIs are awesome!

[Martin H. | MVP @mozzeph]

@Vicecity_wire Who's going to tell him he won't be able to play the PS5 version on an XBOX?

[Martin H. | MVP @mozzeph]

I just watched the episode, and I now understand where my confusion came from:

I was talking about rotating secrets specifically but phrased it too broadly as credentials. The episode covers self-rotation of Certs though.

Based on my testing, updating an app's own secret is not permitted without additional graph permissions.

I just tested this again with an app that owns itself and no Application.ReadWrite.OwnedBy and I get 403 for both trying to add a secret to app and SP objects.

As soon as I grant the permission, it works. Docs for applications/addPassword also list Application.ReadWrite.OwnedBy as least privilege for application permissions. It's the same for applications/key but there is a clear note for Certs:

"An application doesn't need any specific permission to roll its own keys."

This isn't the case for the addPassword docs.

If you must use client secrets, you have to grant Graph permissions, but you can use narrower permissions by making the service principal own its own app registration and grant Application.ReadWrite.OwnedBy rather than granting Application.ReadWrite.All.

But the app's service principal must be added via Graph as the app registration's owner deliberately first. This is not supported in Portal. Portal only allows user principals.

Even big vendors like i.e. HashiCorp don't advertise this on their Docs and instead just say you need Application.ReadWrite.All for rotate root with client secrets.

All I saw in your tweet was the statement:
"Never Application.ReadWrite.All just so an app can manage its own credentials"

And I wanted to chime in to provide the additional info for client secrets, that have been sitting in the back of my head, waiting to be put into a blog post. 😊

[Martin H. | MVP @mozzeph]

@acjuelich Thanks.

[Martin H. | MVP @mozzeph]

GTA VI is almost here. The Florida vibe in the screenshots and trailers look amazing.

Want to get yourself into that Florida mood ahead of the launch? Watch these shows:

- Bad Monkey (Apple TV)
- RJ Decker (Hulu)

[Martin H. | MVP @mozzeph]

@merill

[Martin H. | MVP @mozzeph]

+ AMD FSR 4.1 soon.

[Martin H. | MVP @mozzeph]

XBOX Series X|S platform features that don't get talked about a lot and are likely taken for granted. A thread:

Display technology:

- System-level VRR support
- AMD FreeSync
- LFC support (Low Framerate Compensation)
- Dolby Vision support
- 40 Gbps HDMI 2.1 bandwidth

[Martin H. | MVP @mozzeph]

@metalgmr666 @Bruzewane @GamerofGreat @GTAVI_Countdown no it doesn’t. quick resume will use space for the ram snapshot, yes, but it doesn’t make a game’s install size any bigger. Also you can now exclude games from quick resume. XBOX OS reserves space for quick resume as such, nor for every game’s QR snapshot.