My VSTS Service Connection needs to be allowed to add a reply url to an azure ad application

user_297189 0
Viewed 347

We are using VSTS/Azure DevOps to build and deploy our web services to Azure.

In the release step we use the Azure CLI build task to set up the environment for the web service. The build task uses a Service Connection to be authorized to do these actions.

The build task can create web services and deployment slots without issue, but when I try to instruct it to add a new reply url to the Azure AD application the web app uses to authenticate users, i see the following:

az ad app update --id 3e5a96e9-7311-4f92-869b-fbb5bbe8e41f --reply-urls http://mytestapp.azurewebsites.net 
ERROR: Insufficient privileges to complete the operation.

The service connection used is an Azure RM service connection using a Service Principal. Is this correct? I'm guessing there is there a permission I need to set on the service principal, but which one?

azure-active-directory azure-devops azure permissions
2 Answers
user_95414480

If you're looking to follow the least privileges principle and not assign the highest possible privilege available (as per your comment), I see 3 possible options that could work for you -

  1. Owner for only a specific application (and NOT the Owner/Global Administrator for entire Azure AD)

    You can add the user as Owner for only the specific application, which they need to manage (in your case, change reply URL's for).

    Pro: Obviously the good thing about this approach is that this user gets to manage the app registration for only this particular application and none of the others in your Azure AD.

    How: Go to "App Registrations" in Azure AD and navigate to the specific application. Now click on "Settings" and select "Owners"

enter image description here

  1. Application Administrator Role

    This one is a little more generic and a higher privilege in comparison to single application owner, as it gives the user access to manage application registrations for all applications.

    Pro: Role is specific to only managing application registrations. It helps in a scenario where all applications need to be managed by this user.

    How: Go to "Users" in your Azure AD and then select the specific user. Now go to "Directory Role" and add "Application Administrator Role"

enter image description here

  1. Application Developer Role

    This one is very similar to option 2 i.e. "Application administrator". Difference being that "Application developer" gets permissions for only those applications which they are developing, so the registration was done by them.

    Pro: Good for user that is about to create and manage registrations for multiple applications.

    How: Very similar to option 2 above.

More information about all the available roles and granular permissions that are used by these roles in Microsoft Docs:

Available Roles

user_101303850
Related