Assign Azure AD Roles to Applications

If your organization integrates applications with Azure AD, you can manage those applications in EmpowerID. This includes onboarding applications, assigning users to application roles, assigning Azure AD roles to applications, editing applications, and deleting applications. In this article, we demonstrate this by adding the Cloud Application Administrator role to an Azure application and verifying the role assignment in Azure.

Assign an application role to an application

1. Navigate to the Resource Admin application portal for your environment.

2. Select Applications from the dropdown menu and search for the application to which you want to assign an Azure AD role.

3. Click the Friendly Name link for the application.
   

   

    

4. Select Azure Application Roles on the application menu, expand Actions and then click Create Azure Application Role.
   

   

    
   This initiates the Create Azure App Role workflow with the selected application as the target and directs you to the App Role Details form.
   

   

5. Fill in the form fields with the appropriate information for your app role.
   

   Field	Description	Example
   Name	Name of the app role	Report Writer
   Allowed Member Types	Specifies whether the app role can be assigned. Options include: Default Users/Groups Applications Both (Users/Groups) + Applications	Users/Groups
   Value	Specifies the value of the roles claim that the application should expect in the token	Report.Create
   Description	Description of the app role	Writers can create reports
   Application Role Requestable in IAM Shop	Specifies whether users can request the role in the IAM Shop
   Select A Location	Select a location in EmpowerID for the application role. This location is for RBAC delegation only. If there is a location selected by default and you wish to change it, click the link for the location and then search for and select the desired location from the Location tree.	EmpowerID Applications

6. Click Next.

7. Review the summary information and then click Submit.
   

Verify the application role in Azure

1. In Azure, navigate to Azure AD > App registrations.

2. Select All applications and search for the target application.

3. Click the Display Name link for the application.
   

   

4. Under Manage, click App Roles.
   
   You should see the app role you created for the application.