azure cli equivalent of Add-AzureADDirectoryRoleMember

user_339070 0
Viewed 284

I am trying to assign Azure AD Roles (not Azure roles) e.g. Directory Writers to a service principal.

The only documentation i found was using powershell at https://docs.microsoft.com/en-us/powershell/module/azuread/add-azureaddirectoryrolemember?view=azureadps-2.0 and command Add-AzureADDirectoryRoleMember

I am looking for and azure cli version of the same. Does it exist?

an example would also be nice, say

ApplicationId: 3213b664-175c-46ca-944b-247c58abcda5
Object ID: c79e0a39-44cd-475c-8bc4-1f679f85afdd
Directory Writers: 9360feb5-f418-4baa-8175-e2a00bac4301

Thanks.

azure-cli azure-active-directory azure powershell
1 Answers

There is not a built-in cmd in Azure CLI to assign AAD directory role.

Here is a workaround which uses Microsoft Graph API (reference here).

$Body = @{ 
    "roleDefinitionId" = "{directory role id}"; 
    "principalId"      = "{service principal object id}"; 
    "directoryScopeId" = "/"
} | ConvertTo-Json -Compress
    
$Body = $Body.Replace('"', '\"')

az rest -m post -u "https://graph.microsoft.com/beta/roleManagement/directory/roleAssignments" -b "$Body"

For how to get the {directory role id}, you can also use Microsoft Graph API List directoryRoles with a filter.

user_105217390
Related