Ability to Grant Permissions via API or Powershell
Azure AD allows you to create app registrations, define roles on them and give permissions to each other (as application identities). This way you can have a Web application talking to your API with its service principal and you can protect your API with roles.
Service Principal creation, role definition and permission assignment can be done through Portal, Powershell and API. But in order to make Application Permissions (which requires admin consent) work, you need someone with Global Administrator role to go to Azure Portal and click Grant Permissions button (or do the same thing via OAuth prompt on your web apps).
Right now there is no way to automatize Grant Permissions and it is a manual process at the moment. We confirmed this with the Microsoft Support and Product Teams as well.
If this can be managed via Powershell or API, we would like to include it in our Automation Runbooks and take the work load off of our security teams.
Harun Legoz
shared this idea
Thank you for the feedback! This is in the backlog and we are looking into this. We don’t have an ETA yet, but we will share once we have one. Please keep voting if this feature matters to you.
20 comments
-
Dmitry Serbin
commented
We also need this feature! Is there any update?
-
Charl
commented
I sometimes wish that MS stops building new stuff in Azure and AzureAD and first bring its APIs SDKs and modules and documentation in order.
-
Anonymous
commented
yes please - a set of commandlets to grant API permissions would be helpful
-
Claude Gex
commented
We managed to grant delegated permission via https://graph.microsoft.com/v1.0/oAuth2Permissiongrants
see https://docs.microsoft.com/en-us/graph/api/resources/oauth2permissiongrant?view=graph-rest-1.0
Application Roles can be add via https://graph.microsoft.com/v1.0/servicePrincipals/<service-principal-id>/appRoleAssignedTo or via https://docs.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignments?view=graph-rest-1.0&tabs=http
-
Majed
commented
Do we have any update on this?
-
Bill
commented
@Microsoft, heading for two years with no further update. What is the ETA on this?
Thanks
-
Stefan Buciu
commented
Hello there,
Any updates on this?
Best regards,
Stefan -
Claude Gex
commented
Hi all
We are struggling with the exact same issue as Mats described.
@microsoft azure ad team: what is the current state?
Kind regards
Claude -
Mike McAdams
commented
+1 on this ... need a way to write a test that enumerates all permission scopes (app and user) and then confirms the presence of a scope within the cloud at hand
-
Andy Ball
commented
Bump
-
Mats Magnem
commented
Hi all
Yo you know if this is possible yet? The Azure portal does this by the REST API, but when I try to do the same, I get that the api-version is wrong. I guess this is functionality Microsoft wants for themselves.I have tried:
POST https://graph.windows.net/myorganization/consentToApp?api-version=2.0
With my valid access token and the proper request object containing app id, dynamicPermissions (roles and scopes) etc.But it does not work. I have also swapped "myorganization" in the url with my tenantid (guid), like I do on other operations against the graph.windows.net API endpoint.
Any idea if the app-version 2.0 will be open to public?
-
Anonymous
commented
okk
-
Anonymous
commented
Hi there, any update on this?
-
Filip Van Raemdonck
commented
Hi,
Is it possible to do this via powershell already? -
Alex Salter
commented
Please also consider providing a means to grant permissions through az as well.
-
Ben Hatton
commented
As a workaround, a module to invoke REST API has been contributed by Jos Lieben:
[apologies for previous now deleted post, didn't sufficiently read what I was suggesting]
-
anajafi
commented
do we have grant permissions for users via powershell yet?
-
Anonymous
commented
This feature will help us to complete our automation runbooks without any manual intervention.
-
Anonymous
commented
When can we expect Oauth2 grant permissions command through powershell?
-
Sebastian
commented
Still no cmdlet for that?