Skip to content

Instantly share code, notes, and snippets.

@kevinhillinger

kevinhillinger/azure-cli.sh

Created April 13, 2024 23:15
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save kevinhillinger/7079d44c5b5925918bd89e071c738a6e to your computer and use it in GitHub Desktop.
Save kevinhillinger/7079d44c5b5925918bd89e071c738a6e to your computer and use it in GitHub Desktop.
Download ZIP
Managed identity and microsoft graph permission setup
Raw
azure-cli.sh
func_name=<the name of the function app>
# global id for Microsoft Graph
graph_name=00000003-0000-0000-c000-000000000000
graph_id=$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query id -o tsv)
managed_identity=$(az ad sp list --display-name $func_name --query '[0]' -o json)
mi_object_id=$(echo $managed_identity | jq .id -r)
mi_app_id=$(echo $managed_identity | jq .appId -r)
# optional, show available permissions for Microsoft Graph
# az ad sp show --id $graph_id
# assign application roles to the managed identity
# Application.ReadWrite.All app role to the managed identity
# SECURITY: if you get a Forbidden from this call, you don't have permissions to assign app roles
role_id="1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9"
az rest -m POST -u https://graph.microsoft.com/v1.0/servicePrincipals/$mi_object_id/appRoleAssignments -b "{\"principalId\": \"$mi_object_id\", \"resourceId\": \"$graph_id\",\"appRoleId\": \"$role_id\"}"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment