Page Comparison

...

To assign permissions to the service principal, you need to complete the following tasks:

1. Start an Azure Cloud Shell session.

2. Run the permissions script included in this topic.

Set Permissions

1. In Azure, select Cloud Shell.
   

...

1. Image Added

2. Select PowerShell as the script language.

3. From the shell, open the editor.
   

...

1. Image Added

2. Copy the below script and paste it into the editor.
   

   Insert excerpt
   IL:Azure Bits IL:Azure Bits name Permissions Script nopanel true

   Code Block
   language powershell
   $webApp=<"Web-App-Name"> $sprincipal_id=$(az resource list -n $webApp --query [*].identity.principalId --out tsv) $graphResourceId=$(az ad sp list --display-name "Microsoft Graph" --query [0].id --out tsv) $uri="https://graph.microsoft.com/v1.0/servicePrincipals/$sprincipal_id/appRoleAssignments" $PermissionsToAdd = @("Directory.Read.All","Organization.Read.All", "User.Read.All", "Group.Read.All", "GroupMember.Read.All", "Reports.Read.All", "AuditLog.Read.All","Policy.Read.All","Policy.ReadWrite.ConditionalAccess","Application.Read.All","Domain.Read.All" ) $PermissionsToAdd | foreach { $appRoleId=$(az ad sp list --display-name "Microsoft Graph" --query "[0].appRoles[?value=='$($_)' && contains(allowedMemberTypes, 'Application')].id" --output tsv) $body="{'principalId':'$sprincipal_id','resourceId':'$graphResourceId','appRoleId':'$appRoleId'}" az rest --method post --uri $uri --body $body --headers "Content-Type=application/json" }

   
   The editor should look similar to that shown below. The value of $PermissionsToAdd will differ according to your permissions.
   

...

1. Image Added

2. Set the value of $webApp to the name of the app service you created to host the Azure AD SCIM microservice.
   

   Insert excerpt
   IL:Azure Bits IL:Azure Bits name Enclose in quotes nopanel true

   Code Block
   language powershell
   $webApp="The name of your app service"

3. Save the script as apply-perms.ps1
   

...

1. Image Added

2. Back in the shell, return the subscription name

...

1. with the app service.

   Code Block
   az account show

2. Copy the name.
   

...

1. Image Added

2. Run the below command to set the subscription name to the value you just copied.

   Code Block
   az account set -s "Your Subscripton Name"

3. Run the permissions script.

   Code Block
   .\apply-perms.ps1

Table 1: Permissions

Create Custom Role in Azure if Managing Azures roles and Management Groups from EmpowerID

If you are managing Azure roles and management groups in EmpowerID, in addition to adding the needed permissions in the above script, you need to create a custom role and add those permissions to the role as shown in the below procedure.

1. In Azure, navigate to the target subscription and select Access control (IAM) from the Azure navbar.

2. On the Access Control (IAM) page, click Add and select Add custom role.
   

...

1. Image Added

2. Under Basics, enter a Custom role name.

3. Select the Permissions tab and click Add permissions.
   

...

1. Image Added

2. Search for Microsoft.ManagedIdentity and click the Microsoft Managed Identity tile.
   

...

1. Image Added

2. For Actions, under Microsoft.ManagedIdentity/userAssignedIdentities, select the following:

   • Read : Get User Assigned Identity

   • Write : Create/Update User Assigned Identity

   • Delete : Delete User Assigned Identity

3. Click Add.
   

...

1. Image Added

2. Back on the Create a custom role page, click Add permissions again and then search for Microsoft.Authorization.

3. Click the Microsoft Authorization tile and then add the below permissions:

   • Microsoft.Authorization/roleAssignments

     • Read : Get role assignment

     • Write : Create role assignment

     • Delete : Delete role assignment

   • Microsoft.Authorization/roleDefinitions

     • Read : Get role definition

     • Write : Create or update custom role definition

     • Delete : Delete custom role definition

4. Click Add.
   

...

1. Image Added

2. Back on the Create a custom role page, click Add permissions again and then search for Microsoft.Authorization.

3. Click the Microsoft Management tile and select Read : List Groups under Microsoft.Management/managementGroups.

4. Click Add.
   

...

1. Image Added

2. Back on the Create a custom role page, click Add permissions again, and then search for Microsoft.Resources.

3. Click the Microsoft Resources tile and then select the following permissions:

   • Microsoft.Resources/subscriptions/resourcegroups

     • Read : Get Resource Group

   • Microsoft.Resources/subscriptions/resources

     • Read : Get Subscription Resources

   • Microsoft.Resources/tenant

     • Read : Get Tenants

4. Click Add.

5. Back on the Create a custom role page, select the Assignable scopes tab and verify the scope.
   

...

1. Image Added

2. Click Review + Create.

3. Review the permissions and then click Create.
   

...

1. Image Added

2. Click OK to close the “created custom role” message.
   

...

1. Image Added

   
   Now that you have created the custom role with the needed permissions, you need to assign the Azure AD SCIM microservice to the role.

2. On the Access control (IAM) page, click Add > Add role assignment.
   

...

1. Image Added

2. In the Add role assignment pane that appears, enter the following:

   • Role – Select the custom role you just created

   • Assign access to – App Service

   • Subscription – Target subscription

   • Select – The SCIM app service you created earlier.

3. Click Save to add the role assignment.
   

...

1. Image Added

2. On the Access control (IAM) page, select the Role assignments tab. You should see the SCIM app service you created assigned to the custom role.
   

...

1. Image Added

Verify Permissions

After setting permissions for the app service, you can verify them by doing the following:

1. In Azure, navigate to your Azure Active Directory.

2. On the Azure Active Directory navbar, click Enterprise applications.

3. For Application type, select Managed Identities to filter the applications.
   

...

1. Image Added

2. Click Apply.

3. Click the Name link for your application.
   

...

1. Image Added

2. Under Security on the navbar, click Permissions.
   

...

1. Image Added

   
   You should see the permissions you set in the script granted to the application. Note that Admin consent has been granted for each permission.
   

...

1. Image Added

...