azure-functions-managed-identity.sh

# az login
# check: az resource list | grep <your azure function name>
# If not available you also need to change subscription
# az account set --subscritipon <sub id, find this in portal, or by az account list>

webAppName="<your azure functions name here>"

spId=$(az resource list -n $webAppName --query [*].identity.principalId --out tsv)

graphResourceId=$(az ad sp list --display-name "Microsoft Graph" --query [0].id --out tsv)

appRoleId=$(az ad sp list --display-name "Microsoft Graph" --query "[0].appRoles[?value=='Group.Read.All' && contains(allowedMemberTypes, 'Application')].id" --output tsv)

uri=https://graph.microsoft.com/beta/servicePrincipals/$spId/appRoleAssignments

body="{'principalId':'$spId','resourceId':'$graphResourceId','appRoleId':'$appRoleId'}"

echo $uri
echo $body
az rest --method post --uri $uri --body $body --headers "Content-Type=application/json"


echo az rest --method post --uri $uri --body $body --headers "Content-Type=application/json"