Search code examples
azurepowershellazure-active-directory

How do I add permissions from "Azure Service Management" to my app on powershell?

Azure Portal

See my image for my azure portal. I currently have a permission from "Azure Service Management" titled "user_impersonation". I'm looking to create this same permission on my new application using powershell.

Here's what I use to try to access the "Azure Service Management" service principal, but it doesn't show any app roles.

$targetSp = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Windows Azure Service Management API'"
$targetSp.AppRoles

Anyone know how to grant permissions from this service principal?

Solution

  • Note that, AppRoles refers to permissions of Application type only. For Delegated permissions, you need to use Oauth2Permissions.

    In my case, I ran below commands to fetch the ID of user_impersonation permission:

    $targetSp = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Windows Azure Service Management API'"
$targetSp.Oauth2Permissions

    Response:

    enter image description here

    To add this permission to newly created application, you can make use of below script:

    $AzureManagementAPI = New-Object -TypeName "Microsoft.Open.AzureAD.Model.ResourceAccess" -ArgumentList "41094075-9dad-400e-a0bd-54e686782033","Scope"

$RequiredAccess = New-Object -TypeName "Microsoft.Open.AzureAD.Model.RequiredResourceAccess"
$RequiredAccess.ResourceAppId = "797f4846-ba00-4fd7-ba43-dac1f8f63013"
$RequiredAccess.ResourceAccess = $AzureManagementAPI

$AppName = "Test Application Feb"
$App = New-AzureADApplication -DisplayName $AppName -IdentifierUris "test9" -HomePage "https://yourapphomepage"

Set-AzureADApplication -ObjectId $App.ObjectId -RequiredResourceAccess @($RequiredAccess)

    Response:

    enter image description here

    When I checked in Portal, new application created successfully with Azure Service Management API permission like this:

    enter image description here

    To grant the admin consent to the added permission, you can use below CLI command:

    az ad app permission admin-consent --id appObjID

    To confirm that, I checked the same in Portal where admin consent granted successfully like this:

    enter image description here

    To grant the same using PowerShell, refer this blog Create and Configure Azure AD Application using PowerShell (morgantechspace.com) by Morgan