Page Comparison

As the app service you created for the Azure AD SCIM microservice calls Microsoft Graph, you need to assign to the service principal permissions required for your use case. You assign these permissions using the Azure CLICloud Shell, which is a command-line tool that use to connect to Azure and execute administrative commands on Azure resources.

To assign permissions to the service principal, you need to complete the following tasks:

1. Install Azure CLI on your machine (if not already installed).

2. Open an administrative command prompt or PowerShell session and run the permissions script included in this topic.

Install Azure CLI

If Azure CLI is not installed on your machine, please see Microsoft’s instructions for doing so here: Install the Azure CLI for Windows | Microsoft Docs.

Set Permissions

To set permissions, execute the below script in either an administrative command prompt or PowerShell session. When executing the script, Azure prompts you to log in to your tenant. Be sure to authenticate with the credentials of a user who can add Microsoft Graph permissions to the App Service managed identity (owner at the tenant level).

Before running the script, be sure to enter the values for the following:

• SubscriptionID – Subscription ID of the subscription with the app service

• webApp – Name of the app service you created for the Azure AD SCIM microservice

...

...

browser-accessible shell for managing Azure resources.

To assign permissions to the service principal, you need to complete the following tasks:

1. Start an Azure Cloud Shell session.

2. Run the permissions script included in this topic.

Set Permissions

1. In Azure, select Cloud Shell.
   

   Image Added

2. Select PowerShell as the script language.

3. From the shell, open the editor.
   

   Image Added

4. Copy the below script and paste it into the editor.
   

   Insert excerpt
   IL:Azure Bits IL:Azure Bits name Permissions Script nopanel true

   Code Block
   language powershell
   $webApp=<"Web-App-Name"> $sprincipal_id=$(az resource list -n $webApp --query [*].identity.principalId --out tsv) $graphResourceId=$(az ad sp list --display-name "Microsoft Graph" --query [0].

...

1. id --out tsv) $uri="https://graph.microsoft.com/v1.0/servicePrincipals/$sprincipal_id/appRoleAssignments" $PermissionsToAdd = @("Directory.Read.All","Organization.Read.All", "User.Read.All", "Group.Read.All", "GroupMember.Read.All", "Reports.Read.All", "AuditLog.Read.All","Policy.Read.All","Policy.ReadWrite.ConditionalAccess","Application.Read.All","Domain.Read.All" ) $PermissionsToAdd | foreach { $appRoleId=$(az ad sp list --display-name "Microsoft Graph" --query "[0].appRoles[?value=='$($_)' && contains(allowedMemberTypes, 'Application')].id" --output tsv) $body="{'principalId':'$sprincipal_id','resourceId':'$graphResourceId','appRoleId':'$appRoleId'}

...

1. " az rest --method post --uri $uri --body $body --headers "Content-Type=application/json" }

   
   The editor should look similar to that shown below. The value of $PermissionsToAdd will differ according to your permissions.
   

   Image Added

2. Set the value of $webApp to the name of the app service you created to host the Azure AD SCIM microservice.
   

   Insert excerpt
   IL:Azure Bits IL:Azure Bits name Enclose in quotes nopanel true

   Code Block
   language powershell
   $webApp="The name of your app service"

3. Save the script as apply-perms.ps1
   

   Image Added

4. Back in the shell, return the name of the subscription with the app service.

   Code Block
   az account show

5. Copy the name.
   

   Image Added

6. Run the below command to set the subscription name to the value you just copied.

   Code Block
   az account set -s "Your Subscripton Name"

7. Run the permissions script.

   Code Block
   .\apply-perms.ps1

Table 1: Permissions

...