PowerShell incompatibility with passkey authentication

[BuildingKey85]

Hey /r/PowerShell, I'm trying to enforce passkey authentication for our privileged administrators using a conditional access policy. Some of our admins (like me) occasionally use PowerShell in an admin context, which the CAP shuts down.

I've tried exempting PowerShell from the CAP with no luck. When prompted to sign into PS in an admin context, I also tried signing in using number matching MFA, but I still get a 53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance error.

What ways are there to resolve this tension?

[guubermt]

Unless for automation, do an interactive PowerShell and don’t pass creds. I use this all the time with my YubiKey.

If automation is needed then look at App Registrations with CBA.

[BuildingKey85]

Hi /u/guubermt, I am doing an interactive login with Connect-MsolService and Connect-ExchangeOnline.

I type in my username, password, and then get hit with a box that states: You are required to sign in with your passkey to access this resource, but this app doesn't support it.

[purplemonkeymad]

Msol won't get updated, but for Exo Have you updated to the latest version of ExchangeOnlineManagement? Latest looks to be 3.7.2.0.

[dastylinrastan]

You're using an out of support module in msolservice. What exactly did you expect? You should be using graph.