Search code examples
azurepowershellazure-active-directorymicrosoft-graph-api

MS Graph Permissions for Adding a OAuth Client Secret are Too Broad

I am following the example on this page to use powershell to create a client secret for my Azure AD application: https://o365info.com/create-unlimited-client-secret/

It starts out with this command:

Connect-MgGraph -Scopes 'Application.ReadWrite.All'

This gives me a login window that is requesting permissions to read and write to ALL applications.

I don't have permissions to (nor do I want permissions to) all of my companies applications. I just need to add a client secret to the one application that I have permissions for.

So I figure, "fine, I will find the way to just request the scope for my one application." But when I look up the help for my command (Add-MgApplicationPassword), both of the examples also ask for Application.ReadWrite.All.

It seems crazy that the only way I can modify one application is if I am granted permissions to modify ALL applications in my company's Azure Active Directory.

How can I call Add-MgApplicationPassword, but only have permissions to one application?

(NOTE: I can add these via the UI, but I need to be able to automate it via PowerShell.)

Solution

  • Note that: Microsoft Graph API permissions cannot be restricted to one application as it is granted for the entire tenant.

    I agree with @junnas, as a workaround you can make use of Application API permissions "Application.ReadWrite.OwnedBy" to connect to MgGraph with application context.

    • By granting Application.ReadWrite.OwnedBy permission it allows to manage apps that this application creates or owns.
    • By this API permission, it can create the applications and fully manage those applications (read, update, update application secrets and delete).
    • But it will not be able to update the applications that it is not an owner of.

    I created an Azure AD Application and API permission like below:

    enter image description here

    Using the above application, I created another application:

    https://login.microsoftonline.com/TenanTID/oauth2/v2.0/token

client_id:ClientID
client_secret:ClientSecret
scope:https://graph.microsoft.com/.default
grant_type:client_credentials

    enter image description here

    I created the new application successfully:

    POST https://graph.microsoft.com/v1.0/applications
Content-type : application/json

{
"displayName": "ClientSecretApp"
}

    enter image description here

    I used the below PowerShell script to add password to the application:

    $ApplicationId = "ClientID"
$tenantID = "TenantID"

Connect-MgGraph -ClientId $ApplicationId -TenantId $tenantID -CertificateThumbprint "Thumbprint"

$passwordCred = @{
   displayName = 'testsecret'
   endDateTime = (Get-Date).AddMonths(6)
}

$secret = Add-MgApplicationPassword -ApplicationId $ObjectIDoftheOwnedApplication -PasswordCredential $passwordCred
$secret | Format-List

    The Client Secret got created:

    enter image description here

    In Azure Portal:

    enter image description here

    Now, when I passed the ObjectID of the other application which is not owned, I got the error like below:

    enter image description here

    References:

    azure - Microsoft Graph to access only a specific set of users, not all - Stack Overflow by Hury Shen

    Limit permissions to update a single Azure AD group via API - Microsoft Q&A by ShivaniRai-MSFT