Skip to main content

App Role assignment to service principal --

 Using Ms Graph Rest API's

Permissions

One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.

Permission typePermissions (from least to most privileged)
Delegated (work or school account)AppRoleAssignment.ReadWrite.All and Application.Read.All, AppRoleAssignment.ReadWrite.All and Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All
Delegated (personal Microsoft account)Not supported.
ApplicationAppRoleAssignment.ReadWrite.All and Application.Read.All, AppRoleAssignment.ReadWrite.All and Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All

Create 2 app registrations.

App role owner will contain the app role that will be assigned to a service principal.

The  reader role in approleowner will be added to the approlesubscriber


Setup postman to use the Oauth auth flow to get a token for MS Graph.
ClientId:   Application (client) ID for approlesubscriber
Client Secret: secret for approlesubscriber
Scope: https://graph.microsoft.com/.default
Auth URL:  https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/authorize
Access Token URL:  https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token


Assign the delegated permissions so that we can act on behalf of the logged in user. 

Add Role Assignment

URL : https://graph.microsoft.com/v1.0/servicePrincipals/{ResourceId}/appRoleAssignedTo

PrincipalId: Approlesubscribers enterprise apps object id (to whom we assign the role)

ResourceId: Approleowners enterprise apps object id (who has the app role)

AppRoleId: Id of the app role (shown in the below image)














Comments

Post a Comment

Popular posts from this blog

Az-500 NSG and ASG

Application security groups Application security groups enable you to configure network security as a natural extension of an application's structure, allowing you to group virtual machines and define network security policies based on those groups. You can reuse your security policy at scale without manual maintenance of explicit IP addresses. The platform handles the complexity of explicit IP addresses and multiple rule sets, allowing you to focus on your business logic. To better understand application security groups, consider the following example: In the previous picture,  NIC1  and  NIC2  are members of the  AsgWeb  application security group.  NIC3  is a member of the  AsgLogic  application security group.  NIC4  is a member of the  AsgDb  application security group. Though each network interface in this example is a member of only one network security group, a network interface can be a member of multiple app...
Post a Comment
Read more

ASp.net core 3.1 identity

It is just an extension to cookie authentication. We get a UI, Tables, helper classes, two factor authentication etc. Even EF and its database constructs. So instead of writing code for all of this we can just use these in built features. Extending Default Identity Classes Add a class that inherits from    public class AppUser : IdentityUser     {         public string Behavior { get; set; }     } Also change the user type in login partial.cs under shared folder Then add migrations and update db using migrations. We can customize further.  services.AddDefaultIdentity<AppUser>(options =>              {                 options.SignIn.RequireConfirmedAccount = true;                 options.Password.RequireDigit = false;           ...
2 comments
Read more