How to set Microsoft Graph API permissions on Azure Managed Service Identity with bicep template

Question

I have a requirement to set Microsoft Graph API permissions on Azure Managed Service Identity with bicep template to automate the deployment. Also I don't have access to azure portal to configure anything manual

Answer 1

Hi @Suwani , please try the following and let me know if it works for you.

You can use the Microsoft.Authorization/roleAssignments resource type. Here is an example Bicep template that sets the User.Read.All permission on a system-assigned managed identity:

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
  name: guid(subscription().id, 'Microsoft.Authorization', 'roleAssignments', 'myRoleAssignment')
  properties: {
    principalId: identity.principalId
    roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/18d7d88d-d35e-4fb5-a5c3-7773c20a72d9' // Role ID for User.Read.All
    scope: '/providers/Microsoft.Web/sites/${webAppName}'
  }
}

In this example, the roleAssignment resource assigns the User.Read.All role to the system-assigned managed identity of a web app. The principalId property is set to the principalId of the managed identity, and the roleDefinitionId property is set to the ID of the User.Read.All role. The scope property is set to the resource ID of the web app.

You can modify this template to set different permissions or to assign roles to user-assigned managed identities. You can also use this template to assign roles to other Azure resources, such as virtual machines or storage accounts, by changing the scope property to the resource ID of the target resource.

Once you have created the Bicep template, you can deploy it using the Azure CLI or Azure PowerShell. Here is an example command to deploy the template using the Azure CLI:

az deployment group create --resource-group <resource-group-name> --template-file <path-to-template-file> --parameters <path-to-parameters-file>

Replace <resource-group-name> with the name of the resource group where you want to deploy the template, <path-to-template-file> with the path to the Bicep template file, and <path-to-parameters-file> with the path to the parameters file (if you have one).

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James