You are viewing an earlier version of the admin guide. For the latest version, please visit EmpowerID Admin Guide v7.211.0.0.

Azure Permissions Required by Azure License Manager

Azure License Manager leverages EmpowerID’s SCIM Microservice Connector. This microservice is a fully compliant SCIM 2.0 Server to which EmpowerID communicates to inventory and manage your Azure tenant licenses and security. In order to use Azure License Manager, you need to configure Azure for the SCIM microservice. Part of this configuration involves creating an App Service in Azure that has App service authentication turned on, Login with Azure Active Directory enabled for unauthenticated requests to the App service, and Azure Active Directory selected as the identity provider. This deployment model enables secure fine-grained Graph API access, requiring read access to organization, user, group, and license data in Azure AD, as well as read and write access to license groups. The microservice leverages a system-assigned managed identity and app service authentication.

Required Permissions for the Managed Identity

Required permissions for the managed identity (not service principal) follow the least-privilege principle and include the following:

Graph API / Permissions name

Access Granted by Permissions

Used By

Purpose

AuditLog.Read.All

Read audit log data

App Service Managed Identity

Last sign in inventory for users

Group.Read.All

Read group data

App Service Managed Identity

Read all groups in Azure AD

GroupMember.ReadWrite.All

Read and write group memberships

App Service Managed Identity

Read and edit (and / remove) group memberships

User.Read.All

Read user profile

App Service Managed Identity

Read all users Azure AD

Reports.Read.All

Read report data

App Service Managed Identity

Read all reports, such as Office 365 Active User Details, etc.

Organization.Read.All

Read organization information

App Service Managed Identity

Read all subscribed SKUs (license and service plans)

############################################################################################################## ###### PowerShell Script to Grant GRAPH API permissions for Azure License Manager Managed Identitity ######### ###### Example below grants full permissions needed for both Azure License Manager and RBAC Manager ########## ###### Edit as desired - required permissions for Azure License Manager "Read Access" shown below ############ Param( $tenantId = "", $appServiceObjectID = "", $PermissionsToAdd= @("Directory.ReadWrite.All", "Directory.AccessAsUser.All", "Reports.Read.All", "User.ReadWrite.All", "Group.ReadWrite.All", "RoleManagement.ReadWrite.Directory", "AuditLog.Read.All" ) ) <# Read Access @("Reports.Read.All", "Group.Read.All", "User.Read.All", "Contacts.Read", "Directory.Read.All", "Directory.Read.All", "Group.ReadWrite.All", "AuditLog.Read.All", "GroupMember.ReadWrite.All", "RoleManagement.Read.Directory", "Organization.Read.All", "OrgContact.Read.All") #> <# Full Access @("Directory.ReadWrite.All", "Directory.AccessAsUser.All", "Reports.Read.All", "User.ReadWrite.All", "Group.ReadWrite.All", "RoleManagement.ReadWrite.Directory", "AuditLog.Read.All" ) #> <# Read Access #> # Install AzureAD module if not installed if (-Not(Get-Module -ListAvailable -Name AzureAD)) { try { Install-Module AzureAD -Force } catch { if ($_.Exception.Message.Contains("Administrator rights")) { Write-Host "You must run the script with administrator rights" } else { Write-Error $_.Exception.Message } } } if (Get-Module -ListAvailable -Name AzureAD) { # Check if connected to the target Azure AD Tenant try { $tenantDetail = Get-AzureADTenantDetail } catch [Microsoft.Open.Azure.AD.CommonLibrary.AadNeedAuthenticationException] { Write-Host "You're not connected."; Connect-AzureAD -TenantId $tenantId; $tenantDetail = Get-AzureADTenantDetail } if ($tenantDetail.ObjectId -ne $tenantId) { Write-Host "You're not connected to the tenant: " $tenantId; Connect-AzureAD -TenantId $tenantId; } # Managed Identity for the SCIM App Service | Found in App Service -> Identity $ManagedIdentitiesServicePrincipal = Get-AzureADServicePrincipal -Filter "ObjectId eq `'$appServiceObjectID`'" if ($ManagedIdentitiesServicePrincipal -eq $null) { throw "Managed Identity for the app service is not found. `nApp Service Object ID: $appServiceObjectID " } # Resource Name : Microsoft Graph | Resource URI : https://graph.microsoft.com | Application ID : 00000003-0000-0000-c000-000000000000 $GraphAppId = "00000003-0000-0000-c000-000000000000" $GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$GraphAppId'" # Permissions foreach ($PermissionToAdd in $PermissionsToAdd) { $AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionToAdd.Trim() -and $_.AllowedMemberTypes -contains "Application"} if ($AppRole -eq $null) { Write-Error "Invalid Permission `nPermission name: $PermissionToAdd" } else { # Assigns a Graph API service principal to an application role try { New-AzureAdServiceAppRoleAssignment -ObjectId $ManagedIdentitiesServicePrincipal.ObjectId -PrincipalId $ManagedIdentitiesServicePrincipal.ObjectId -ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id -ErrorAction Stop } catch { if ($_.Exception.ErrorContent.Message.Value.Contains("Permission being assigned already")) { Write-Host "`""$AppRole.DisplayName"`"" " Permission is already assigned on the app service" } else { Write-Error $_ } } } } }