{"id":4108,"date":"2023-05-29T18:22:22","date_gmt":"2023-05-29T17:22:22","guid":{"rendered":"https:\/\/www.lieben.nu\/liebensraum\/?p=4108"},"modified":"2023-05-29T18:22:22","modified_gmt":"2023-05-29T17:22:22","slug":"programmatically-grant-admin-consent-to-a-service-principal","status":"publish","type":"post","link":"https:\/\/lieben.nu\/liebensraum\/2023\/05\/programmatically-grant-admin-consent-to-a-service-principal\/","title":{"rendered":"Programmatically grant admin consent to a service principal"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Most articles and e.g. az module commands allow you to do an admin consent on an application object. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, Service Principals have the same option in the Azure Portal:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.lieben.nu\/liebensraum\/wp-content\/uploads\/2023\/05\/image.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1283\" height=\"673\" src=\"https:\/\/www.lieben.nu\/liebensraum\/wp-content\/uploads\/2023\/05\/image.png\" alt=\"\" class=\"wp-image-4109\" srcset=\"https:\/\/lieben.nu\/liebensraum\/wp-content\/uploads\/2023\/05\/image.png 1283w, https:\/\/lieben.nu\/liebensraum\/wp-content\/uploads\/2023\/05\/image-300x157.png 300w, https:\/\/lieben.nu\/liebensraum\/wp-content\/uploads\/2023\/05\/image-1024x537.png 1024w, https:\/\/lieben.nu\/liebensraum\/wp-content\/uploads\/2023\/05\/image-768x403.png 768w\" sizes=\"auto, (max-width: 1283px) 100vw, 1283px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In my scenario I have control over both the hosting tenant of this multi-tenant app registration, so I could use the requiredResourceAccess property to read all Oauth2permissiongrants and approleAssignments from the source app registration to re-apply it to the service principal in the consuming tenant.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The result is similar to consenting through the admin portal but does not require user interaction \/ is fully headless, ideal for when you&#8217;re adding scopes\/roles to an application and don&#8217;t want to have to do a manual reconsent in all managed tenants.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here&#8217;s the code to to programmatic admin consent:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/jflieben\/assortedFunctionsV2\/blob\/main\/grant-adminConsentForServicePrincipal.ps1\">https:\/\/github.com\/jflieben\/assortedFunctionsV2\/blob\/main\/grant-adminConsentForServicePrincipal.ps1<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It requires DelegatedPermissionGrant.ReadWrite.All and AppRoleAssignment.ReadWrite.All graph permissions for the calling principal (user or application).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you don&#8217;t have access to the source tenant (e.g. multi tenant), you can also simply create a hashtable with the required permissions (manual definition or export from the application manifest).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Most articles and e.g. az module commands allow you to do an admin consent on an application object. However, Service Principals have the same option in the Azure Portal: In my scenario I have control over both the hosting tenant of this multi-tenant app registration, so I could use the requiredResourceAccess property to read all &hellip; <a href=\"https:\/\/lieben.nu\/liebensraum\/2023\/05\/programmatically-grant-admin-consent-to-a-service-principal\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Programmatically grant admin consent to a service principal<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[7,21,39,43],"tags":[],"class_list":["post-4108","post","type-post","status-publish","format-standard","hentry","category-azuread","category-identity","category-powershell","category-security"],"_links":{"self":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/4108","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/comments?post=4108"}],"version-history":[{"count":0,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/4108\/revisions"}],"wp:attachment":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/media?parent=4108"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/categories?post=4108"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/tags?post=4108"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}