Why New-MgServicePrincipalAppRoleAssignment has two very similar parameters ServicePrincipalId and PrincipalId?

Question

Why New-MgServicePrincipalAppRoleAssignment has two very similar parameters ServicePrincipalId and PrincipalId?

Vadim Bondaruk 41

I am investigating Microsoft Graph powershell module and encountered New-MgServicePrincipalAppRoleAssignment method. There are two very similar parameters ServicePrincipalId and PrincipalId. All examples that i found use the same value for both parameters. I can not figure out when these params will have different values, maybe someone could help with it?

Accepted answer

0 additional answers

Your answer

Answer 1

The New-MgServicePrincipalAppRoleAssignment method in the Microsoft Graph PowerShell module is used to assign an application role to a service principal. The confusion around ServicePrincipalId and PrincipalId parameters is understandable, as their roles are closely related but distinct.

Here's a breakdown of these parameters:

ServicePrincipalId:

This is the ID of the service principal that represents the application to which you are assigning the role. Essentially, this is the "target" application that has defined the app roles.
In Azure AD, every application registered in the directory has an associated service principal, which is its identity for use in specific instances, like within your tenant.

PrincipalId:

This refers to the object ID of the principal (which can be a user, group, or another service principal) to whom you are assigning the app role.
This parameter specifies "who" is receiving the role assignment.

In many examples, you might see the same value used for both ServicePrincipalId and PrincipalId. This typically happens in scenarios where an application (service principal) is being granted a role within itself. For instance, this is common in scenarios where an application needs to access its own API.

However, in a more general use case, these IDs would differ. For example, if you have Application A and you want to assign a role in Application A to a user or another application (Application B), then:

ServicePrincipalId would be the ID of Application A.
PrincipalId would be the ID of the user or Application B's service principal.

This distinction allows for flexible role assignments, enabling various scenarios like granting one application permissions to another, or assigning specific roles to users or groups within an application.

If this information was helpful or if you have any more questions, please let me know. Your feedback is valuable in ensuring you get the best possible assistance.

Vadim Bondaruk 41 Reputation points

2023-12-22T10:34:14.64+00:00

Hi @Carlos Solís Salazar , thanks for very detailed response.
In am looking at this article(https://learn.microsoft.com/en-us/azure/app-service/scenario-secure-app-access-microsoft-graph-as-app?tabs=azure-powershell) and there is used managedIdentityObjectId for both ServicePrincipalId and PrincipalId, but logically seems like serverServicePrincipalObjectId should be used as ServicePrincipalId, what do you think?

# Install the module. # Install-Module Microsoft.Graph -Scope CurrentUser # The tenant ID $TenantId = "11111111-1111-1111-1111-111111111111" # The name of your web app, which has a managed identity. $webAppName = "SecureWebApp-20201106120003" $resourceGroupName = "SecureWebApp-20201106120003ResourceGroup" # The name of the app role that the managed identity should be assigned to. $appRoleName = "User.Read.All" # Get the web app's managed identity's object ID. Connect-AzAccount -Tenant $TenantId $managedIdentityObjectId = (Get-AzWebApp -ResourceGroupName $resourceGroupName -Name $webAppName).identity.principalid Connect-MgGraph -TenantId $TenantId -Scopes 'Application.Read.All','AppRoleAssignment.ReadWrite.All' # Get Microsoft Graph app's service principal and app role. $serverApplicationName = "Microsoft Graph" $serverServicePrincipal = (Get-MgServicePrincipal -Filter "DisplayName eq '$serverApplicationName'") $serverServicePrincipalObjectId = $serverServicePrincipal.Id $appRoleId = ($serverServicePrincipal.AppRoles | Where-Object {$_.Value -eq $appRoleName }).Id # Assign the managed identity access to the app role. New-MgServicePrincipalAppRoleAssignment ` -ServicePrincipalId $managedIdentityObjectId ` -PrincipalId $managedIdentityObjectId ` -ResourceId $serverServicePrincipalObjectId ` -AppRoleId $appRoleId

Share via

Why New-MgServicePrincipalAppRoleAssignment has two very similar parameters ServicePrincipalId and PrincipalId?

0 additional answers

Your answer