You are viewing an earlier version of the admin guide. For the latest version, please visit EmpowerID Admin Guide v7.211.0.0.
Azure Permissions Required by Azure License Manager
Azure License Manager leverages EmpowerID’s SCIM Microservice Connector. This microservice is a fully compliant SCIM 2.0 Server to which EmpowerID communicates to inventory and manage your Azure tenant licenses and security. In order to use Azure License Manager, you need to configure Azure for the SCIM microservice. Part of this configuration involves creating an App Service in Azure that has App service authentication turned on, Login with Azure Active Directory enabled for unauthenticated requests to the App service, and Azure Active Directory selected as the identity provider. This deployment model enables secure fine-grained Graph API access, requiring read access to organization, user, group, and license data in Azure AD, as well as read and write access to license groups. The microservice leverages a system-assigned managed identity and app service authentication.
Required Permissions for the Managed Identity
Required permissions for the managed identity (not service principal) follow the least-privilege principle and include the following:
Graph API / Permissions name | Access Granted by Permissions | Used By | Purpose |
AuditLog.Read.All | Read audit log data | App Service Managed Identity | Last sign in inventory for users |
Group.Read.All | Read group data | App Service Managed Identity | Read all groups in Azure AD |
GroupMember.ReadWrite.All | Read and write group memberships | App Service Managed Identity | Read and edit (and / remove) group memberships |
User.Read.All | Read user profile | App Service Managed Identity | Read all users Azure AD |
Reports.Read.All | Read report data | App Service Managed Identity | Read all reports, such as Office 365 Active User Details, etc. |
Organization.Read.All | Read organization information | App Service Managed Identity | Read all subscribed SKUs (license and service plans) |
##############################################################################################################
###### PowerShell Script to Grant GRAPH API permissions for Azure License Manager Managed Identitity #########
###### Example below grants full permissions needed for both Azure License Manager and RBAC Manager ##########
###### Edit as desired - required permissions for Azure License Manager "Read Access" shown below ############
Param(
$tenantId = "",
$appServiceObjectID = "",
$PermissionsToAdd= @("Directory.ReadWrite.All",
"Directory.AccessAsUser.All",
"Reports.Read.All",
"User.ReadWrite.All",
"Group.ReadWrite.All",
"RoleManagement.ReadWrite.Directory",
"AuditLog.Read.All"
)
)
<#
Read Access
@("Reports.Read.All", "Group.Read.All", "User.Read.All", "Contacts.Read", "Directory.Read.All", "Directory.Read.All", "Group.ReadWrite.All", "AuditLog.Read.All", "GroupMember.ReadWrite.All", "RoleManagement.Read.Directory", "Organization.Read.All", "OrgContact.Read.All")
#>
<#
Full Access
@("Directory.ReadWrite.All",
"Directory.AccessAsUser.All",
"Reports.Read.All",
"User.ReadWrite.All",
"Group.ReadWrite.All",
"RoleManagement.ReadWrite.Directory",
"AuditLog.Read.All"
)
#>
<#
Read Access
#>
# Install AzureAD module if not installed
if (-Not(Get-Module -ListAvailable -Name AzureAD)) {
try {
Install-Module AzureAD -Force
}
catch {
if ($_.Exception.Message.Contains("Administrator rights")) {
Write-Host "You must run the script with administrator rights"
}
else {
Write-Error $_.Exception.Message
}
}
}
if (Get-Module -ListAvailable -Name AzureAD) {
# Check if connected to the target Azure AD Tenant
try {
$tenantDetail = Get-AzureADTenantDetail
}
catch [Microsoft.Open.Azure.AD.CommonLibrary.AadNeedAuthenticationException]
{
Write-Host "You're not connected.";
Connect-AzureAD -TenantId $tenantId;
$tenantDetail = Get-AzureADTenantDetail
}
if ($tenantDetail.ObjectId -ne $tenantId) {
Write-Host "You're not connected to the tenant: " $tenantId;
Connect-AzureAD -TenantId $tenantId;
}
# Managed Identity for the SCIM App Service | Found in App Service -> Identity
$ManagedIdentitiesServicePrincipal = Get-AzureADServicePrincipal -Filter "ObjectId eq `'$appServiceObjectID`'"
if ($ManagedIdentitiesServicePrincipal -eq $null) {
throw "Managed Identity for the app service is not found. `nApp Service Object ID: $appServiceObjectID "
}
# Resource Name : Microsoft Graph | Resource URI : https://graph.microsoft.com | Application ID : 00000003-0000-0000-c000-000000000000
$GraphAppId = "00000003-0000-0000-c000-000000000000"
$GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$GraphAppId'"
# Permissions
foreach ($PermissionToAdd in $PermissionsToAdd) {
$AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionToAdd.Trim() -and $_.AllowedMemberTypes -contains "Application"}
if ($AppRole -eq $null) {
Write-Error "Invalid Permission `nPermission name: $PermissionToAdd"
}
else {
# Assigns a Graph API service principal to an application role
try {
New-AzureAdServiceAppRoleAssignment -ObjectId $ManagedIdentitiesServicePrincipal.ObjectId -PrincipalId $ManagedIdentitiesServicePrincipal.ObjectId -ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id -ErrorAction Stop
}
catch {
if ($_.Exception.ErrorContent.Message.Value.Contains("Permission being assigned already")) {
Write-Host "`""$AppRole.DisplayName"`"" " Permission is already assigned on the app service"
}
else {
Write-Error $_
}
}
}
}
}