After you have published the EmpowerID SCIM Microservice microservice app to Azure, you need to return to Azure to do the following post-publishing steps:
...
Turn on System-assigned managed identity for the App Service
...
run the following PowerShell script to assign several required permissions to the App Service managed identity
...
Assign the App Service to the Global Administrator role for the tenant
These steps ensure that EmpowerID has the appropriate authentication and access to read and write the user information for your Azure tenant.
To turn on System-assigned managed identity for the App Service
Log in to your Azure portal as an administrator and navigate to your App Service.
Under Settings in the sidebar of the App Service, click Identity.
On the Azure navbar, click App registrations.
On the Identity page, click the System assigned tab and toggle Status to On.
Copy the Object ID. The Object ID is the ID of the service principal created when the System assigned managed identity feature is enabled. You need to assign to the service principal root level permissions to the App Service as shown below.
To assign to the identity root level permissions to the App Service
In Azure navigate to Management groups.
Click the details link beside Tenant Root Group.
On the tenant root page, click Access Control (IAM) in the sidebar.
On the Access Control (IAM) page, click Add and then select Add role assignment.
In the Add role assignment pane that appears, click Select a role and then select Owner.
Search for and select the App Service you deployed to the tenant.
Save the role assignment.
Assign the App Service to the Global Administrator role for the tenant
Navigate to Azure Active Directory.
In Azure Active Directory, select Roles and administrators (Preview) from the sidebar.
Enter Global administrator in the search field and then select the Global administrator role.
On the Global administrator | Assignments page, click Add assignments.
In the Add assignments pane that appears, search for the App Service and then click the tile for the service to select it.
Click Add.
The SCIM App service now has the global administrator role for the tenant. The next step is to connect EmpowerID to Azure AD.. Required permissions follow the least-privilege principle and include the following:
Graph API / Permissions name | Access Granted by Permissions | Used By |
AuditLog.Read.All | Read audit log data | App Service Managed Identity |
Group.Read.All | Read group data | App Service Managed Identity |
GroupMember.ReadWrite.All | Read and write group memberships | App Service Managed Identity |
User.Read.All | Read user profile | App Service Managed Identity |
Reports.Read.All | Read report data | App Service Managed Identity |
Organization.Read.All | Read organization information | App Service Managed Identity |
The above permissions have been added to the script's PermissionsToAdd parameter, shown below. In addition to adding the permissions, you need to enter values for these parameters:
tenantID — Your Tenant ID
appServiceObjectID — Object ID of the SCIM App Service
| Tip |
|---|
When running the script, be sure to authenticate to Azure as a user with adequate permissions to execute it in Azure AD (owner at the tenant level). |
| Code Block | ||
|---|---|---|
| ||
###############
## GRAPH API ##
###############
Param(
$tenantId = "",
$appServiceObjectID = "",
$PermissionsToAdd = @("Organization.Read.All", "User.Read.All", "Group.Read.All", "GroupMember.ReadWrite.All", "Reports.Read.All", "AuditLog.Read.All")
)
# Install AzureAD module if not installed
if (-Not(Get-Module -ListAvailable -Name AzureAD)) {
try {
Install-Module AzureAD -Force
}
catch {
if ($_.Exception.Message.Contains("Administrator rights")) {
Write-Host "You must run the script with administrator rights"
}
else {
Write-Error $_.Exception.Message
}
}
}
if (Get-Module -ListAvailable -Name AzureAD) {
# Check if connected to the target Azure AD Tenant
try {
$tenantDetail = Get-AzureADTenantDetail
}
catch [Microsoft.Open.Azure.AD.CommonLibrary.AadNeedAuthenticationException]
{
Write-Host "You're not connected.";
Connect-AzureAD -TenantId $tenantId;
$tenantDetail = Get-AzureADTenantDetail
}
if ($tenantDetail.ObjectId -ne $tenantId) {
Write-Host "You're not connected to the tenant: " $tenantId;
Connect-AzureAD -TenantId $tenantId;
}
# Managed Identity for the SCIM App Service | Found in App Service -> Identity
$ManagedIdentitiesServicePrincipal = Get-AzureADServicePrincipal -Filter "ObjectId eq `'$appServiceObjectID`'"
if ($ManagedIdentitiesServicePrincipal -eq $null) {
throw "Managed Identity for the app service is not found. `nApp Service Object ID: $appServiceObjectID "
}
# Resource Name : Microsoft Graph | Resource URI : https://graph.microsoft.com | Application ID : 00000003-0000-0000-c000-000000000000
$GraphAppId = "00000003-0000-0000-c000-000000000000"
$GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$GraphAppId'"
# Permissions
foreach ($PermissionToAdd in $PermissionsToAdd) {
$AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionToAdd.Trim() -and $_.AllowedMemberTypes -contains "Application"}
if ($AppRole -eq $null) {
Write-Error "Invalid Permission `nPermission name: $PermissionToAdd"
}
else {
# Assigns a Graph API service principal to an application role
try {
New-AzureAdServiceAppRoleAssignment -ObjectId $ManagedIdentitiesServicePrincipal.ObjectId -PrincipalId $ManagedIdentitiesServicePrincipal.ObjectId -ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id -ErrorAction Stop
}
catch {
if ($_.Exception.ErrorContent.Message.Value.Contains("Permission being assigned already")) {
Write-Host "`""$AppRole.DisplayName"`"" " Permission is already assigned on the app service"
}
else {
Write-Error $_
}
}
}
}
} |
| Insert excerpt | ||||||
|---|---|---|---|---|---|---|
|