Page Comparison

In order for the app service to access the Microsoft Graph API on your behalf, you need to add the needed permissions to the service principal application you registered for the SCIM app service in Azure, as well as assign the app service to the Owner role for the Tenant Root group and grant the app service the Global reader role for the tenant.

...

After you have published the SCIM microservice app to Azure, run the following PowerShell script to assign Graph API permissions to the app service managed identity.

Set Graph API Permissions

Permissions follow the least-privilege principle and include the following

...

:

...

...

...

Sign in and read user profile

...

App Service Managed Identity

To assign Graph API permissions to the service principal application, do the following:

1. In your Azure tenant, navigate to Azure Active Directory and select App registrations from the Azure sidebar.

2. Search for the service principal application you registered for the SCIM app service and click the Display Name link for it.
   

   Image Removed

3. Navigate to the API permissions page for the application.

4. Click Add a permission.
   

   Image Removed

5. Click Microsoft Graph.
   

   Image Removed

6. Select Application permissions.
   

   Image Removed

7. Search for AuditLog and then expand the AuditLog permission and select AuditLog.Read.All.
   

   Image Removed

8. Search for Group.Read.All and then expand the Group permission and select Group.Read.All.
   

   Image Removed

9. Search for GroupMember.ReadWrite.All and then expand the GroupMember permission and select GroupMember.ReadWrite.All.
   

   Image Removed

10. Search for User.Read.All and then expand the User permission and select User.Read.All.
    

    Image Removed

11. Search for Reports.Read.All and then expand the Reports permission and select Reports.Read.All.
    

    Image Removed

12. Search for Organization.Read.All and then expand the Organization permission and select Organization.Read.All.
    

    Image Removed

13. Click Add permissions.

    You should see the new permissions add to the application.
    

    Image Removed

14. Click Grand admin consent for <Your Tenant Name>.
    

    Image Removed

15. Click Yes to confirm admin consent.
    

    Image Removed

Assign the App service to the owner role for the Tenant Root Group

1. In Azure, navigate to Management Groups and select the Tenant Root Group.

2. Select Access Control (IAM) from the Azure navbar and then click Add role assignment (Preview).
   

   Image Removed

3. Select Owner and click Next.

4. For Assign access to select User, group, or service principal.

5. Click Select members and then search for and select the SCIM app service you created for the Azure AD SCIM microservice.
   

   Image Removed

6. Click Select.
   

   Image Removed

7. Review and assign the role assignment.

Assign the App service to the Global Reader role for the tenant

1. Navigate to Azure Active Directory and select Roles and administrators from the navbar.

2. Search for and select the Global Reader role and go to Description.

3. Click Add assignments and then search for and select the SCIM app service you created for the Azure AD SCIM microservice.
   

   Image Removed

4. Click Add.
   

   Image Removed

...

The above permissions have been added to the script's PermissionsToAdd parameter, shown below. In addition to adding the permissions, you need to enter values for these parameters:

• tenantID — Your Tenant ID

• appServiceObjectID — Object ID of the SCIM App Service

###############
## GRAPH API ##
###############
Param(
    $tenantId = "",
    $appServiceObjectID = "", 
    $PermissionsToAdd = @("Organization.Read.All", "User.Read.All", "Group.Read.All", "GroupMember.ReadWrite.All", "Reports.Read.All", "AuditLog.Read.All")
)

# Install AzureAD module if not installed
if (-Not(Get-Module -ListAvailable -Name AzureAD)) {
    try {
        Install-Module AzureAD -Force
    }
    catch {
        if ($_.Exception.Message.Contains("Administrator rights")) {
            Write-Host "You must run the script with administrator rights"
            
        }
        else {
            Write-Error $_.Exception.Message
        }
        
    }
}


if (Get-Module -ListAvailable -Name AzureAD) {
    # Check if connected to the target Azure AD Tenant
    try { 
        $tenantDetail = Get-AzureADTenantDetail 
    } 
    catch [Microsoft.Open.Azure.AD.CommonLibrary.AadNeedAuthenticationException] 
    { 
        Write-Host "You're not connected."; 
        Connect-AzureAD -TenantId $tenantId;
        $tenantDetail = Get-AzureADTenantDetail 
    }

    if ($tenantDetail.ObjectId -ne $tenantId) {
        Write-Host "You're not connected to the tenant: " $tenantId; 
        Connect-AzureAD -TenantId $tenantId;
    }


    # Managed Identity for the SCIM App Service | Found in App Service -> Identity 
    $ManagedIdentitiesServicePrincipal = Get-AzureADServicePrincipal -Filter "ObjectId eq `'$appServiceObjectID`'"
    if ($ManagedIdentitiesServicePrincipal -eq $null) {
        throw "Managed Identity for the app service is not found. `nApp Service Object ID: $appServiceObjectID "
    }

    # Resource Name : Microsoft Graph | Resource URI : https://graph.microsoft.com | Application ID : 00000003-0000-0000-c000-000000000000
    $GraphAppId = "00000003-0000-0000-c000-000000000000"
    $GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$GraphAppId'"

    # Permissions
    foreach ($PermissionToAdd in $PermissionsToAdd) {
        $AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionToAdd.Trim() -and $_.AllowedMemberTypes -contains "Application"}
        if ($AppRole -eq $null) {
            Write-Error "Invalid Permission `nPermission name: $PermissionToAdd"
        }
        else {
            # Assigns a Graph API service principal to an application role
            try {
                New-AzureAdServiceAppRoleAssignment -ObjectId $ManagedIdentitiesServicePrincipal.ObjectId -PrincipalId $ManagedIdentitiesServicePrincipal.ObjectId -ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id -ErrorAction Stop
            }
            catch {
                if ($_.Exception.ErrorContent.Message.Value.Contains("Permission being assigned already")) {
                    Write-Host "`""$AppRole.DisplayName"`"" " Permission is already assigned on the app service"
                }
                else {
                    Write-Error $_
                }
            }
        }
    }
}

Insert excerpt
IL:External Stylesheet - Test IL:External Stylesheet - Test nopanel true

Set Azure REST API Permissions

If you are managing Azure roles in EmpowerID, in addition to setting the above permissions via PowerShell, you need to create a custom role in Azure and add the below permissions scoped to the appropriate Azure subscription(s) you want to manage in EmpowerID. These permissions allow EmpowerID to call the relevant Azure REST API endpoints needed to manage Azure roles.

Table

...

1: Permissions needed to manage Azure roles in EmpowerID

To set the Azure REST API Permissions for the target subscription, do the following:

1. In Azure, navigate to the target subscription and select Access control (IAM) from the Azure navbar.

2. On the Access Control (IAM) page, click Add and select Add custom role.
   

   Image Modified

3. Under Basics, enter a Custom role name.

4. Select the Permissions tab and click Add permissions.
   

   Image Modified

5. Search for Microsoft.ManagedIdentity and click the Microsoft Managed Identity tile.
   

   Image Modified

6. For Actions, under Microsoft.ManagedIdentity/userAssignedIdentities, select the following:

   • Read : Get User Assigned Identity

   • Write : Create/Update User Assigned Identity

   • Delete : Delete User Assigned Identity

7. Click Add.
   

   Image Modified

8. Back on the Create a custom role page, click Add permissions again and then search for Microsoft.Authorization.

9. Click the Microsoft Authorization tile and then add the below permissions:

   • Microsoft.Authorization/roleAssignments

     • Read : Get role assignment

     • Write : Create role assignment

     • Delete : Delete role assignment

   • Microsoft.Authorization/roleDefinitions

     • Read : Get role definition

     • Write : Create or update custom role definition

     • Delete : Delete custom role definition

10. Click Add.
    

    Image Modified

11. Back on the Create a custom role page, click Add permissions again and then search for Microsoft.

...

1. Authorization.

2. Click the Microsoft Management tile and select Read : List Groups under Microsoft.Management/managementGroups.

3. Click Add.
   

   Image Modified

4. Back on the Create a custom role page, click Add permissions again and then search for Microsoft.Resources.

5. Click the Microsoft Resources tile and then select the following permissions:

   • Microsoft.Resources/subscriptions/resourcegroups

     • Read : Get Resource Group

   • Microsoft.Resources/subscriptions/resources

     • Read : Get Subscription Resources

6. Click Add.

7. Back on the Create a custom role page, select the Assignable scopes tab and verify the scope.
   

   Image Modified

8. Click Review + Create.

9. Review the permissions and then click Create.
   

   Image Modified

10. Click OK to close the “created custom role” message.
    

    Image Modified

    
    Now that you have created the custom role with the needed permissions, you need to assign the Azure AD SCIM microservice to the role.

11. On the Access control (IAM) page, click Add > Add role assignment.
    

    Image Modified

12. In the Add role assignment pane that appears, enter the following:

    • Role – Select the custom role you just created

    • Assign access to – App Service

    • Subscription – Target subscription

    • Select – The SCIM app service you created earlier.

13. Click Save to add the role assignment.
    

    Image Modified

14. On the Access control (IAM) page, select the Role assignments tab. You should see the SCIM app service you created assigned to the custom role.

...

Next Steps

Connect EmpowerID to Azure Active Directory

...

IN THIS ARTICLE

...