CODEWITHSUNDEEP
azurepowershellpermissions
ingo_ww
ingo_ww

Reputation: 321

how I can make an service principal as an App Registration Owner with azure portal or PowerShell?

so the background as follows:

for installation and deployment process we need to modify a customer created App Registration. but we get not the right Application.ReadWriteAll but we could get Application.ReadWrite.OwnedBy.

I know that if creating an Graph Api Call (excecuted with Postman) as shown below it worked, because Creator is automatically the Owner. .

 HTTP-Post Request:
https://graph.microsoft.com/v1.0/applications   
with body:
     {
      "displayName": "AppRegName"
    }

But I need to solution with standard tool like azure portal or powershell and I found no way to assign or remove a service principal as owner to an App Registration.

Is there a way to to do this with powershell?

The authentifiaction with an service principal i dont't know how I can do it?

I think after I can create an App Registration with
$appRegistration = New-AzADApplication -DisplayName "AppRegCreatebyPS" but I very unexperinced in using powershell. So how I can tell powershell to use the service principal authentitification for creating App Registrations?

A short extra question:

Can I remove later the owner role for the service principal and how can I do it?

Thanks for all Readers And I hope someone can give me a hint.

Upvotes: 3

Views: 6783

Answers (2)

HS447
HS447

Reputation: 81

This can be done like below from bash or windows subsystem linux.

Login to your Azure account

az login

Execute below command

az ad app owner add --id AAAA --owner-object-id AAAA

--id(Application id) , --owner-object-id (Owners object id)

Ref : https://learn.microsoft.com/en-us/cli/azure/ad/app/owner?view=azure-cli-latest

Upvotes: 1

Ansuman Bal
Ansuman Bal

Reputation: 11411

You can create App registration, Service Principal for App registration, Add application owner and remove application owner all from PowerShell AzureAD module.

Command to install Azure AD module in PowerShell:

Install-Module AzureAD

You can use the below commands :

#Connect to Azure AD 
Connect-AzureAD

#Create Azure AD app Registration
$appRegistration = New-AzureADApplication -DisplayName "AppRegCreatebyPS"

# Create A service Principal for the above app Registration
New-AzureADServicePrincipal -AccountEnabled $true -AppId $appRegistration.AppId -AppRoleAssignmentRequired $true -DisplayName $appRegistration.DisplayName

# get objectid for the service principal
$serviceprincipal= Get-AzureADServicePrincipal -Filter "DisplayName eq 'AppRegCreatebyPS'"

#Get the old app registration for whom you want set owner
$oldappregistration = Get-AzureADApplication -Filter "DisplayName eq 'Postman'"

#add service principal to the application owner of old app registration
Add-AzureADApplicationOwner -ObjectId $oldappregistration.ObjectId -RefObjectId $serviceprincipal.ObjectId

# verify the owner for the old app registration
Get-AzureADApplicationOwner -ObjectId $oldappregistration.ObjectId

#remove the owner for the old app registration
Remove-AzureADApplicationOwner -ObjectId $oldappregistration.ObjectId -OwnerId $serviceprincipal.ObjectId

enter image description here

Reference:

Cmdlts for Azure AD module reference

Upvotes: 4

Related Questions