CODEWITHSUNDEEP
azure-active-directorymicrosoft-graph-apimicrosoft-graph-sdks
unruledboy
unruledboy

Reputation: 2342

Microsoft graph API: permission grant for application (app roles) (NOT delegate via Oauth2PermissionGrants)

We are using the Microsoft graph API (.net SDK).

We know that we can use GraphServiceClient.Oauth2PermissionGrants for delegated grant (in Azure AD app it's "Expose an API").

But when it comes to granting admin consent for application type (via app role of other applications), like below: enter image description here

In the portal, we can just click "Grant admin consent for XXXX".

I could not figure out how to GraphServiceClient.PermissionGrants does not seem to be the one we are after.

Upvotes: 1

Views: 1631

Answers (1)

unruledboy
unruledboy

Reputation: 2342

Googled around, found the related answer Azure OAuth: Unable to programmatically create app with admin consent for permissions , which leads me to the actual API used https://learn.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignedto?view=graph-rest-1.0&tabs=csharp

In a nutshell, use app role assignment via AppRoleAssignedTo:

GraphServiceClient graphClient = new GraphServiceClient( authProvider );

var appRoleAssignment = new AppRoleAssignment
{
    PrincipalId = Guid.Parse("THE-OBJECT-ID-OF-THE-PRINCIPAL-OF-THE-AZURE-AD-APPLICATION-THAT-NEEDS-ACCESS"),
    ResourceId = Guid.Parse("THE-OBJECT-ID-OF-THE-PRINCIPAL-OF-THE-AZURE-AD-APPLICATION-THAT-HAS-THE-APP-ROLE-DEFINED"),
    AppRoleId = Guid.Parse("THE-ID-OF-THE-APP-ROLE-DEFINED-IN-THE-RESOURCE-ID-ABOVE")
};

await graphClient.ServicePrincipals["THE-OBJECT-ID-OF-THE-PRINCIPAL-OF-THE-AZURE-AD-APPLICATION-THAT-HAS-THE-APP-ROLE-DEFINED"].AppRoleAssignedTo
    .Request()
    .AddAsync(appRoleAssignment);

Upvotes: 4

Related Questions