CODEWITHSUNDEEP
azure-active-directoryazure-cliaz
kanthael
kanthael

Reputation: 105

Add members to Azure Enterprise App through CLI

We have an enterprise application in our Azure AD tenant for provisioning users to another SaaS platform. Currently it is only setup with the option "Sync only assigned users and groups" since we do not want the whole directory brought over.

My question is simple, is there a way to use the az-cli (currently have version 2.0.60 installed) to add users to that enterprise application?

I checked out the:

I would expect there would be a simple role assignment command to run that adds a user by upn/objectId to the enterprise application.

Everyone in my team are using Mac's and we could use PowerShellCore if that has better support.

Thanks!

Upvotes: 5

Views: 5102

Answers (2)

Brendan Foxen
Brendan Foxen

Reputation: 71

If it helps, I did this using az rest. We all use Macs here and PowerShell core seems broken in a few places (doesn't support certificate-based logins and the New-AzureADUserAppRoleAssignment cmdlet didn't work for us. We were using the preview version. The Graph API docs are also quite wrong so took a bit of fiddling to get the right endpoint and payload. Example below:

az rest \
  --method post \
  --uri https://graph.microsoft.com/beta/users/$user/appRoleAssignments \
  --body "{\"appRoleId\": \"$appRoleId\", \"principalId\": \"$user\", \"resourceId\": \"$spObjectId\"}" \
  --headers "Content-Type=application/json"

Can post a sample bash script for the above that sets the vars if anyone's interested?

Upvotes: 7

Joy Wang
Joy Wang

Reputation: 42043

It seems you could not do that via Azure CLI, my workaround is to use powershell to do that.

Everyone in my team are using Mac's and we could use PowerShellCore if that has better support.

First, you need to install the AzureAD.Standard.Preview powershell module which supports powershell core, you can understand the module is an equivalent of AzureAD module in powershell core, they have the same usage, it is a preview version, for more details see this link.

Then try the command New-AzureADUserAppRoleAssignment as below, this sample assigns a user to an application with default app role id.

New-AzureADUserAppRoleAssignment -ObjectId "<user objectid>" -PrincipalId "<user objectid>" -ResourceId "<service principal objectid(i.e. Enterprise Application objectid)>" -Id ([Guid]::Empty)

enter image description here

Check in the portal:

enter image description here

If you want to assign a user to a specific app role within an application, try the command below.

$username = "<You user's UPN>"
$app_name = "<Your App's display name>"
$app_role_name = "<App role display name>"

# Get the user to assign, and the service principal for the app to assign to
$user = Get-AzureADUser -ObjectId "$username"
$sp = Get-AzureADServicePrincipal -Filter "displayName eq '$app_name'"
$appRole = $sp.AppRoles | Where-Object { $_.DisplayName -eq $app_role_name }

#Assign the user to the app role
New-AzureADUserAppRoleAssignment -ObjectId $user.ObjectId -PrincipalId $user.ObjectId -ResourceId $sp.ObjectId -Id $appRole.Id

Upvotes: 6

Related Questions