Ability to Grant Permissions via API or Powershell
Azure AD allows you to create app registrations, define roles on them and give permissions to each other (as application identities). This way you can have a Web application talking to your API with its service principal and you can protect your API with roles.
Service Principal creation, role definition and permission assignment can be done through Portal, Powershell and API. But in order to make Application Permissions (which requires admin consent) work, you need someone with Global Administrator role to go to Azure Portal and click Grant Permissions button (or do the same thing via OAuth prompt on your web apps).
Right now there is no way to automatize Grant Permissions and it is a manual process at the moment. We confirmed this with the Microsoft Support and Product Teams as well.
If this can be managed via Powershell or API, we would like to include it in our Automation Runbooks and take the work load off of our security teams.
Thank you for the feedback! This is in the backlog and we are looking into this. We don’t have an ETA yet, but we will share once we have one. Please keep voting if this feature matters to you.
yes please - a set of commandlets to grant API permissions would be helpful
Claude Gex commented
We managed to grant delegated permission via https://graph.microsoft.com/v1.0/oAuth2Permissiongrants
Application Roles can be add via https://graph.microsoft.com/v1.0/servicePrincipals/<service-principal-id>/appRoleAssignedTo or via https://docs.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignments?view=graph-rest-1.0&tabs=http
Do we have any update on this?
@Microsoft, heading for two years with no further update. What is the ETA on this?
Stefan Buciu commented
Any updates on this?
Claude Gex commented
We are struggling with the exact same issue as Mats described.
@microsoft azure ad team: what is the current state?
Mike McAdams commented
+1 on this ... need a way to write a test that enumerates all permission scopes (app and user) and then confirms the presence of a scope within the cloud at hand
Andy Ball commented
Mats Magnem commented
Yo you know if this is possible yet? The Azure portal does this by the REST API, but when I try to do the same, I get that the api-version is wrong. I guess this is functionality Microsoft wants for themselves.
I have tried:
With my valid access token and the proper request object containing app id, dynamicPermissions (roles and scopes) etc.
But it does not work. I have also swapped "myorganization" in the url with my tenantid (guid), like I do on other operations against the graph.windows.net API endpoint.
Any idea if the app-version 2.0 will be open to public?
Hi there, any update on this?
Filip Van Raemdonck commented
Is it possible to do this via powershell already?
Alex Salter commented
Please also consider providing a means to grant permissions through az as well.
Ben Hatton commented
As a workaround, a module to invoke REST API has been contributed by Jos Lieben:
[apologies for previous now deleted post, didn't sufficiently read what I was suggesting]
do we have grant permissions for users via powershell yet?
This feature will help us to complete our automation runbooks without any manual intervention.
When can we expect Oauth2 grant permissions command through powershell?
Still no cmdlet for that?