Search code examples
azurepowershellstoragerbac

Granting application role of "storage blob data contributor" in storage account

My goal is to make app a "blob storage contributor" of storage account​. To do so I am trying to grant application role, but cannot - when trying i encounter an error.

I am trying to do it with this command:

New-AzureRmRoleAssignment -ApplicationId $appId -ResourceGroupName $resourceGroupName -ResourceName $resourceName -ResourceType 'Microsoft.Storage/storageAccounts' -RoleDefinitionName 'Storage Blob Data Contributor'

I am getting an error: 

New-AzureRmRoleAssignment : The provided information does not map to an AD object id.

Does anyone know what might be the issue? I checked all parameters, object id is correct for sure (tried objectId and ApplicationId and still not working)

When i did similar thing to grant group role with below command it was successful.

New-AzureRmRoleAssignment -ObjectId $groupObjId -ResourceGroupName $resourceGroupName -ResourceName $resourceName -RoleDefinitionName 'Reader' -ResourceType "Microsoft.Storage/storageAccounts"

Any ideas?

Solution

  • I am using the AZ Module but the command should be identical with RM module

    $contributor = Get-AzRoleDefinition "Contributor"
$contributor
$scope = "/subscriptions/<SubscriptionID>/resourceGroups/Demo/providers/Microsoft.Storage/storageAccounts/<Storage Account name>"
New-AzRoleAssignment -ApplicationId <appicationID> -RoleDefinitionName $contributor.Name -Scope $scope

    Image

    PS: you can also get Storage account id for scope by; 

    $stracc = Get-AzStorageAccount -ResourceGroupName <resourecegroupname> -Name <Storage Account name>
$stracc.Id

    Image 2