To grant Microsoft Graph API permissions to a User-Assigned Managed Service Identity or System-Assigned Managed Service Identity, one has to use PowerShell. All the articles I can find (e.g. this) point to using the New-AzureAdServiceAppRoleAssignment
cmdlet from the AzureAD
PowerShell module, however, this module doesn't support anything newer than Windows PowerShell version 5.1 and as I need to complete the task on a Linux-based build agent, I need to find a way supported by PowerShell (core).
Looking at the last update date of AzureAD
, I suspect MS aren't planning on updating it further and besides a lot of the functionality has already moved to the Az
PowerShell module, however, the critical cmdlet doesn't appear to have made it across. (AzureADPreview
has the same issues). I am not sure which direction Microsoft are heading, but to confuse matters, there is the Microsoft.Graph
module; more specifically Microsoft.Graph.Applications
. Reviewing the list of cmdlets in the module, the most likely candidate to achieve the same task is New-MgServicePrincipalAppRoleAssignment
, however, I cannot get it to work.
The following is the AzureAD
Windows PowerShell (5.1) way (that works with the new Az
cmdlets):
$DestinationTenantId = "a3186524-d3d5-4820-8cb5-9ad21badb14a"
$MsiName = "myUserMSI" # Name of system-assigned or user-assigned managed service identity. (System-assigned use same name as resource)
# Graph API permissions to set
$oPermissions = @(
"Directory.ReadWrite.All"
"Group.ReadWrite.All"
)
$GraphAppId = "00000003-0000-0000-c000-000000000000" # Don't change this.
$oMsi = Get-AzADServicePrincipal -Filter "displayName eq '$MsiName'"
$oGraphSpn = Get-AzADServicePrincipal -Filter "appId eq '$GraphAppId'"
$oAppRole = $oGraphSpn.AppRole | Where-Object {($_.Value -in $oPermissions) -and ($_.AllowedMemberType -contains "Application")}
Connect-AzureAD -TenantId $DestinationTenantId
foreach($AppRole in $oAppRole)
{
New-AzureAdServiceAppRoleAssignment `
-ObjectId $oMsi.Id `
-PrincipalId $oMsi.Id `
-ResourceId $oGraphSpn.Id `
-Id $AppRole.Id `
-Verbose
}
Here is my attempt at using the Microsoft.Graph.Applications
module with PowerShell (v.7.2.5).
$DestinationTenantId = "a3186524-d3d5-4820-8cb5-9ad21badb14a"
$MsiName = "myUserMSI" # Name of system-assigned or user-assigned managed service identity. (System-assigned use same name as resource)
$oPermissions = @(
"Directory.ReadWrite.All"
"Group.ReadWrite.All"
"GroupMember.ReadWrite.All"
"User.ReadWrite.All"
"RoleManagement.ReadWrite.Directory"
)
$GraphAppId = "00000003-0000-0000-c000-000000000000" # Don't change this.
$oMsi = Get-AzADServicePrincipal -Filter "displayName eq '$MsiName'"
$oGraphSpn = Get-AzADServicePrincipal -Filter "appId eq '$GraphAppId'"
$oAppRole = $oGraphSpn.AppRole | Where-Object {($_.Value -in $oPermissions) -and ($_.AllowedMemberType -contains "Application")}
Connect-MgGraph -TenantId $DestinationTenantId
foreach($AppRole in $oAppRole)
{
$oAppRoleAssignment = @{
"PrincipalId" = $oMSI.Id
"ResourceId" = $GraphAppId
"AppRoleId" = $AppRole.Id
}
New-MgServicePrincipalAppRoleAssignment `
-ServicePrincipalId $oAppRoleAssignment.PrincipalId `
-BodyParameter $oAppRoleAssignment `
-Verbose
}
This results in the following error:
PS C:\> . "Set-ApiPermissionsForMI.ps1"
VERBOSE: Performing the operation "New-MgServicePrincipalAppRoleAssignment_Create1" on target "Call remote 'ServicePrincipalsCreateAppRoleAssignments1' operation".
New-MgServicePrincipalAppRoleAssignment_Create1: C:\Set-ApiPermissionsForMI.ps1:36:3
Line |
36 | New-MgServicePrincipalAppRoleAssignment `
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Resource '00000003-0000-0000-c000-000000000000' does not exist or one of its queried reference-property objects are not present.
I see it's complaining that the "special" service principal for MS Graph is missing, but as the AzureAD
cmdlet worked, I know it is correct, but I don't know if this cmdlet is even the correct replacement - if there even is a replacement that works with PowerShell core.
If anyone has a solution for my problem, I'd be very grateful if you could share, please.
T.I.A.
Update 1
I've found this document describing the mapping of AzureAD
to Microsoft.Graph
cmdlets. I have the correct cmdlet:
AzureAD | Microsoft.Graph.Applications |
---|---|
New-AzureADServiceAppRoleAssignment | New-MgServicePrincipalAppRoleAssignment |
The document also confirms that Microsoft are replacing the AzureAD
module with the Microsoft.Graph
module.