Azure Active Directory appRoleAssignments "Permission being assigned was not found on application"

user_3315744 0
Viewed 964

I am trying to assign a user to the azure active directory application through graph API. As per the documentation I have assigned the permission to my application and granted the admin consent. The following permissions are given to the application.

enter image description here My graph API requests details ares

https://graph.microsoft.com/v1.0/users/user-id/appRoleAssignments

Request Body

{
    "appRoleId": "00000000-0000-0000-0000-000000000000",
    "principalId": "user-id",
    "principalType": "User",
    "resourceId": "objectId-of-service-principal"
}

The response from AD API still mentioning Permission being assigned was not found on application what other permissions do I need to give to the application to make the request work properly?

microsoft-graph-api azure-active-directory azure
2 Answers

I can reproduce your issue on my side, it was caused by the wrong appRoleId you provided, the appRoleId should be the id of the appRole (defined on the resource service principal) to assign to the user, if you have not defined it, please follow this doc to denfine it.

enter image description here

To find appRoleId, navigate to Azure Active Directory in the portal -> App registrations -> find the AD App you defined the appRole -> Manifest -> appRoles -> get the id like below, it is the appRoleId.

enter image description here

Then test the API with it again, it works fine.

enter image description here

user_94556590

I also faced the same issue but in my case, it's not related to appRoleId it is because of resourceId. I am using object ID as resourceId from App registrations itself, we need to get the object Id of the application from enterprise applications

Enterprise Applications -> Your Application where App role is defined -> overview -> ObjectId
user_121291320
Related