How to add Azure AD App as contributor to a subscription using Azure API/SDK?

Question

How to add Azure AD App as contributor to a subscription using Azure API/SDK?

Nivethitha Dhamodhara Kannan 10 Microsoft Employee

There is a management api to add role assignments to the subscription, but it's not allowing the Azure AD APP to be added as contributor to the sub, as it says the principal type "App" is not supported.

https://management.azure.com/subscriptions/b9bcd91a-e2be-484a-ae19-39183528792a/providers/Microsoft.Authorization/roleAssignments/b24988ac-6180-42a0-ab88-20f7382dd24c?api-version=2022-04-01

b24988ac-6180-42a0-ab88-20f7382dd24c - is the contributor role.

payload 
{
  "properties": {
    "roleDefinitionId": "/subscriptions/b9bcd91a-e2be-484a-ae19-39183528792a/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
    "principalId": "83c3f106-c212-409c-8275-3c399158786c",
    "principalType": "ServicePrincipal"
  }
}

2 answers

Your answer

Answer 1

Sedat SALMAN 14,180 MVP

First, find your Azure AD App's Service Principal ID.

Use the Service Principal ID for the principalId field, and set principalType as "ServicePrincipal".

{   
	"properties": {     
		"roleDefinitionId": "/subscriptions/YOUR_SUBSCRIPTION_ID/providers/Microsoft.Authorization/roleDefinitions/CONTRIBUTOR_ROLE_ID",     
		"principalId": "YOUR_SERVICE_PRINCIPAL_ID",     
		"principalType": "ServicePrincipal"   
	} 
}

Use the Azure REST API endpoint you have (or Azure SDK) to assign the role.

this is the step-by-step approach to add an Azure AD App as a contributor to a subscription:

Nivethitha Dhamodhara Kannan 10 Microsoft Employee

I got this error when I tried the API,
{
    "error": {
        "code": "RoleAssignmentUpdateNotPermitted",
        "message": "Tenant ID, application ID, principal ID, and scope are not allowed to be updated."
    }
}

Nivethitha Dhamodhara Kannan 10 Microsoft Employee

{
    "error": {
        "code": "PrincipalTypeNotSupported",
        "message": "Principals of type Application cannot validly be used in role assignments."
    }
}

This error says we can't add the Azure AD app

Answer 2

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Moderator

Hello @Nivethitha Dhamodhara Kannan , the PrincipalTypeNotSupported error encountered during the creation of a role assigment is caused by passing the Azure AD app registration (or just "application") object id as the principal id. Pass the Azure AD service principal object id instead to fix it. For more information about both models and how do they relate take a look to Application and service principal objects in Azure Active Directory.

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.

Nivethitha Dhamodhara Kannan 10 Reputation points Microsoft Employee

2023-09-14T19:28:53.2833333+00:00

Hi @Alfredo - ALFREDO REVILLA , I'm using the serviceprincipal Id by getting it from the graph api - https://graph.microsoft.com/v1.0/servicePrincipals(appId='{id}') , and still I see the above problem

Share via

How to add Azure AD App as contributor to a subscription using Azure API/SDK?

2 answers

Your answer