{"id":4187,"date":"2024-07-19T13:36:53","date_gmt":"2024-07-19T12:36:53","guid":{"rendered":"https:\/\/www.lieben.nu\/liebensraum\/?p=4187"},"modified":"2024-07-19T13:36:53","modified_gmt":"2024-07-19T12:36:53","slug":"sharepoint-online-and-azure-datafactory-using-managed-identity","status":"publish","type":"post","link":"https:\/\/lieben.nu\/liebensraum\/2024\/07\/sharepoint-online-and-azure-datafactory-using-managed-identity\/","title":{"rendered":"Sharepoint Online and Azure Datafactory using Managed Identity"},"content":{"rendered":"\n

Let’s face it, Microsoft’s documentation on using Sharepoint as a data source (or sink) in ADF is pretty bad.<\/a> And it doesn’t even describe how to use the Managed Identity of ADF, who still wants to register separate app credentials? Noooooo you don’t.<\/p>\n\n\n\n

So here’s an example how to use Managed Identity to read a json file from a given SpO site, using minimal permissions given to ADF.<\/p>\n\n\n\n

    \n
  1. Enable MI in datafactory, I’m assuming you know how to do this.<\/li>\n\n\n\n
  2. Give ADF Sites.Selected Graph permissions, e.g. like this:<\/li>\n<\/ol>\n\n\n
    \nParam(\n    [Parameter(Mandatory=$true)][String]$displayName=\"{NAMEOFADFINSTANCE}\",\n    [Parameter(Mandatory=$true)][String]$role=\"Sites.Selected\"\n)\nConnect-AzureAD \n$Msi = (Get-AzureADServicePrincipal -Filter \"displayName eq '$displayName'\")\nStart-Sleep -Seconds 10\n$baseSPN = Get-AzureADServicePrincipal -Filter \"appId eq '00000003-0000-0000-c000-000000000000'\"\n$AppRole = $baseSPN.AppRoles | Where-Object {$_.Value -eq $role -and $_.AllowedMemberTypes -contains \"Application\"}\nNew-AzureAdServiceAppRoleAssignment -ObjectId $Msi.ObjectId -PrincipalId $Msi.ObjectId -ResourceId $baseSPN.ObjectId -Id $AppRole.Id\n$Msi.AppId\n<\/pre><\/div>\n\n\n
      \n
    1. Go to https:\/\/yourtenant.sharepoint.com\/sites\/yoursite\/_api\/site\/id and copy the Edm Guid:<\/li>\n<\/ol>\n\n\n\n
      \"get<\/a><\/figure>\n\n\n\n
        \n
      1. Go to https:\/\/developer.microsoft.com\/en-us\/graph\/graph-explorer. Log in at the top right using a user with sufficient permissions (Sites.FullControl.All), set the mode to POST, add the EDM guid in the URL and create the request body as follows (the id in the body can be found back in step 2, $Msi.AppId)<\/li>\n<\/ol>\n\n\n\n
        \"authorize<\/a><\/figure>\n\n\n\n
          \n
        1. Create a REST linked service in ADF with Managed Identity auth:<\/li>\n<\/ol>\n\n\n\n
          \"create<\/a><\/figure>\n\n\n\n
            \n
          1. Create data source in ADF of type REST<\/li>\n<\/ol>\n\n\n\n
            \"\"<\/a><\/figure>\n\n\n\n
              \n
            1. Replace the “uri” with the direct url of the file you want to read (or use an alternative method). Example uri:
              https:\/\/graph.microsoft.com\/v1.0\/sites\/ee614b6d-de15-4101-1c12-14e4cd3186a9\/drive\/root:\/General\/Input_files\/test.json:\/content<\/a><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"
              Let’s face it, Microsoft’s documentation on using Sharepoint as a data source (or sink) in ADF is pretty bad. And it doesn’t even describe how to use the Managed Identity of ADF, who still wants to register separate app credentials? Noooooo you don’t. So here’s an example how to use Managed Identity to read a … Continue reading Sharepoint Online and Azure Datafactory using Managed Identity<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":4194,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[10,13,21,44],"tags":[],"class_list":["post-4187","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-factory","category-entraid","category-identity","category-sharepoint-online"],"_links":{"self":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/4187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/comments?post=4187"}],"version-history":[{"count":0,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/4187\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/media\/4194"}],"wp:attachment":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/media?parent=4187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/categories?post=4187"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/tags?post=4187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}