What are the required permissions for Get-AzureADServicePrincipal?

user_313414 0
Viewed 932

I am trying to run a PowerShell script for assigning appRoles from a DevOps service principal.

The DevOps service principal has the following permissions assigned and admin consented:

  • Application.Read.All
  • AppRoleAssignment.ReadWrite.All
  • User.Read

It fails on the step where it gets the service principal which is the owner of the roles to assign:

$sp = Get-AzureADServicePrincipal -filter "displayName eq '$AppName'"

with the error message:

Error occurred while executing GetServicePrincipals 
Code: Authorization_RequestDenied
Message: Insufficient privileges to complete the operation.
RequestId: a8fadf67-94d6-40ec-ad88-6562cf9f6d80
DateTimeStamp: Tue, 23 Jun 2020 16:51:36 GMT
HttpStatusCode: Forbidden
HttpStatusDescription: Forbidden
HttpResponseStatus: Completed

I expected Application.Read.All to grant this permission, since the resource I am searching for is an Application.

What permission do I need to run this line of script, and where is this documented? I am applying the principle of least-privilege and don't want to give the Devops sp an administrative role. I only want to apply the specific permission required to do the job.

azure-active-directory
1 Answers

I notice that you assigned a permission User.Read which only exists in Delegated permissions. So I guess the other 2 permissions Application.Read.All and AppRoleAssignment.ReadWrite.All you configured are also Delegated permissions.

But now you are run Get-AzureADServicePrincipal from a service principal, that means it needs Application permissions (no user here).

And when I track this cmd via Fiddler4, the backend request is GET https://graph.windows.net/exxxxx4e-bd27-40d5-8459-23xxxxa757fb/servicePrincipals?api-version=1.6&%24filter=displayName%20eq%20%27xxxx%27

graph.windows.net is for Azure AD Graph and graph.microsoft.com is for Microsoft Graph.

So it is calling Azure AD Graph instead of Microsoft Graph. What you need are Application permissions of Azure AD Graph.

Based on my test, Application.ReadWrite.All and Directory.Read.All can meet your needs. If you don't want the service principal to have the write permission, you can choose Directory.Read.All.

enter image description here

user_105217390
Related