msiam_access role

Question

I have a question about the msiam_access role for users in Azure Active Directory. Is this role assigned to all users by default, or does it depend on the application they are using? What is the purpose of this role and how does it affect the management of enterprise app roles?

I read in the documentation that “You can only add new roles after msiam_access for the patch operation”. What does this mean and how can I do it?
https://learn.microsoft.com/en-us/azure/active-directory/develop/enterprise-app-role-management#add-roles

Answer 1

Hi @Pooja Nair (MINDTREE LIMITED)

Is this role assigned to all users by default, or does it depend on the application they are using? What is the purpose of this role and how does it affect the management of enterprise app roles?

It looks like you are trying to configure appRole for your enterprise application, this role is not assigned to all users, it should be assigned to the users used to access the protected API, users assigned this role will be able to access the protected web API, if a user who has not been granted this role attempts to access the protected Web API, they will be blocked and a 403 error will be returned.

I read in the documentation that “You can only add new roles after msiam_access for the patch operation”. What does this mean and how can I do it?

This means that if you are adding a new appRole to an enterprise application, then you need to copy the previously created appRole into the request body, otherwise the new appRole will overwrite the previously created appRole. This operation is often called a patch operation.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.