Search code examples
azureazure-active-directorypostmanidentity

client_credentials authentication with Azure ID: Application is not assigned to a role

I'm trying to use Azure AD for a App-to-App authentication (grant_type: client_credentials) for calling a Rest API.

To avoid implementation issue I firstly tried with Postman with the following configuration, and got the error " Application {clientID} is not assigned to a role for the application {clientID}":

Postman

On Azure the App Registration seems to be properly configured, with a custom scope in "API permissions" and the same scope listen in "Expose an API".

What should I have to add in order to be able to call that API? Please note that the same API works properly using IdentityServer4 with client_credentials grand type.

Thanks in advance

Solution

  • The answer from Rukmini is not entirely correct. In the answer provided, a Delegated permissions is assigned as API permission, and the token request is with a client_credentials flow. For client_credentials flow authentication, an Application permissions is required, not Delegated.

    The issue can be fixed by keeping the "Assignment Required" on YES for security reasons (you may want to decide who, user/group or service principal, can access your application), and creating an Application permission on your App Registration.

    Specifically:

    • Create an App Role for the app registration with users/groups and Applications (if you need to have both Delegated and Application permissions, otherwise Application is sufficient")
    • Create an API in "Expose an API" (if you need Delegated permissions for your users) with another Value
    • Edit the manifest to have matching values between the ID of the app role and the scope, and between the scope name and App Role value (only if you want to have both the Delegated and the Application permissions with the same value)
    • In API Permissions, Add a permission for your application using Application permissions and grant admin consent

    That way, you can keep the Assignment required on YES and use both client_credential and other flows. For other flows, you need to add also the Delegated permissions.