Search code examples
microsoft-graph-apiazure-app-registration

Give admin consent via Graph

We need to provide automated access to our Sharepoint sites, so our customers can up/download files from their environment. We are building an internal self-service application for our customer teams that needs to do the following:

  • Register an app in Azure (done)
  • Give the app Sites.Selected permission (done)
  • Grant permission to a customer site (wip, partly done)
  • Give the app admin consent (?)

We would like to automate the admin consent part as we have hundreds of customers. I didn't find any reference to that. Also, if I call the https://graph.microsoft.com/v1.0/applications/{appid} endpoint I don't see that there's any consent pending that would give me a clue where to search further.

How can we give consent with graph, without human interaction?

Solution

  • I created an Azure AD Application and added API permissions like below:

    enter image description here

    How can we give consent with graph, without human interaction?

    Note that: One needs to have the Global Administrator, Privileged Role Administrator, or Application Administrator roles in order to grant Admin consent to the API permissions of the Azure AD Application.

    Assign any one of the above roles to the Service principal.

    Login with the Azure Service Principal and generate access token:

    az login --service-principal -u "AppID" -p "ClientSecret" -t "TenantID"

az account get-access-token --resource https://graph.microsoft.com

    enter image description here

    To grant Admin consent to the Application type permission, check the below:

    POST https://graph.microsoft.com/v1.0/servicePrincipals/SPObjID/appRoleAssignedTo

{
"principalId": "SPObjID",
"resourceId": "MicrosoftGraphResourceID",
"appRoleId": "APIpermissionID"
}

    enter image description here

    The Admin consent granted successfully to the API permission:

    enter image description here

    To get the values of resourceId and appRoleId of Sites.Selected permission run the below query:

    https://graph.microsoft.com/v1.0/servicePrincipals?$filter=displayName eq 'Microsoft Graph'

    enter image description here

    enter image description here

    To grant Admin consent to the Delegated API permission, check the below:

    POST https://graph.microsoft.com/v1.0/oauth2PermissionGrants

{
"clientId": "ObjectIDofSP",
"consentType": "AllPrincipals",
"resourceId": "MicrosoftGraphResourceID",
"scope": "User.Read"
}

    enter image description here

    The Admin consent granted successfully to the API permission:

    enter image description here