New-AzureADServiceAppRoleAssignment in Azure CLI?

Question

Is there a pendant in the Azure CLI world for the following command?

New-AzureADServiceAppRoleAssignment -ObjectId $clientManagedIdentityObjectId -Id $serverAppRoleId -ResourceId $serverEnterpriseAppObjectId -PrincipalId $clientManagedIdentityObjectId

I'd like to add a managed identity to an appRole within an Enterprise Application.

az ad app permission add does not seem to do the right thing or I am misinterpreting the underdocumented parameters.

Answer 1

There is no built-in cli command to do this, your option is to use az rest call the Microsoft Graph - Grant an appRoleAssignment to a service principal directly.

First, store a .json file as below to your powershell execute location, the meaning of the values see this. e.g. my location is PS C:\Users\joyw>, I store the file in C:\Users\joyw folder.

{
  "principalId": "principalId-value",
  "resourceId": "resourceId-value",
  "appRoleId": "appRoleId-value"
}

Then run the command

az rest --method POST --uri "https://graph.microsoft.com/v1.0/servicePrincipals/{object-id of your Managed identity}/appRoleAssignments" --headers 'Content-Type=application/json' --body `@body.json