How to allow users to be able to add Enterprise application without making them global administrator

Question

I want to allow a user to allow creating new application in Microsoft active directory without making them Global administrator .Or how to make them application administrator

Answer 1

Hi,

One method would be to assign the user Cloud Application Administrator role via portal -- Azure Active Directory -- Roles and administrators -- Cloud Application Administrator -- Add assignments. Please see article below for more detailed information on various options:

Delegate app registration permissions in Azure Active Directory

https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-app-roles

If the above was helpful please click Accept Answer.

Thanks.

-TP

Answer 2

@A K

Thank you for posting your question on MIcrosoft Q&A.

There are some built-in roles that you can assign to users with which users can create new applications in Azure AD.

Application Administrator:

Users in this role can create and manage all aspects of enterprise applications, application registrations, and application proxy settings. Note that users assigned to this role are not added as owners when creating new application registrations or enterprise applications.

This role also grants the ability to consent for delegated permissions and application permissions, with the exception of application permissions for Microsoft Graph.

Cloud Application Administrator:

Users in this role have the same permissions as the Application Administrator role, excluding the ability to manage application proxy. This role grants the ability to create and manage all aspects of enterprise applications and application registrations. Users assigned to this role are not added as owners when creating new application registrations or enterprise applications.

This role also grants the ability to consent for delegated permissions and application permissions, with the exception of application permissions for Microsoft Graph.

Apart from these 2 roles if you are looking to give only specific permissions to user's for creating an application, then you can make use of custom roles in Azure AD.

You can create a custom role using below permission,

microsoft.directory/applications/create

microsoft.directory/applications/createAsOwner

You can refer below article to get more information on Azure AD custom roles.

https://learn.microsoft.com/en-us/azure/active-directory/roles/custom-create

Let me know if you have any further questions

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 3

Hi, One method would be to assign the user Cloud Application Administrator role via portal -- Azure Active Directory -- Roles and administrators -- Cloud Application Administrator -- Add assignments. Please see article below for more detailed information on various options: Delegate app registration permissions in Azure Active Directory https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-app-roles If the above was helpful please click Accept Answer. Thanks. -TP

Thank you TP for your answer.