In Azure Active Directory App Registration Api Permissions, how do we enable the adding user_impersonation?

Question

We have multiple microservices, some of which need to talk to each other without human interaction, and some of which require App Roles in order to grant access.

Instead of using the Resource Owner Password Credentials grant flow which is "not recommended", we'd like for to include App Roles from the registered app within the appropriate JWT tokens.

To do this, we need to include the delegated permission "user_impersonation" as a permission for the API we need to access.

I've figured out how to do this sometimes, but it does not always seem to be available as an API permission for any particular application.

What do I need to do to make this available on an application where it is not already available so I can grant the permission and thereby get the app roles included in the JWT tokens?

Answer 1

Azure Active Directory blade has two App registration options> legacy and preview. In legacy app registrartion when we click on the option ‘Expose an API’ you can see there is a user_impersonation scope created automatically.

But for preview we need to create manually with scope > user_impersonation.

user_impersonation scope name could be anything you because it is a custom scope, as long as your code check for that same scope name that you created.

So after creating that custom scope , you can try to get Get access on behalf of a user - Microsoft Graph | Microsoft Docs if required.

Also please note that when you are using client credential flow and using application permission , you get roles in place of scope i.e; scp claim in the token.

Check this > SO reference.

Also check this github discussion for same point. Also you can reach out to AzureSuport Team for further troubleshooting.