Is it possible to delegate user management for an enterprise app to a regular user account?

Question

I tried adding a staff member as an Owner of the application and sending them a direct link to the enterprise apps "Users and groups" page, but they get an error "You do not have access" "User has no admin roles. Current directory do not allow non admin users to access portal".

Is there another interface that users have access to achieve delegating this task?

Answer 1

Hello @Sam Hall · Thank you for reaching out.

Since the AppRoles are being assigned to the users, at the minimum it would require User Administrator role assigned to the users who will be performing App Role assignments.

Another way of doing this is via Graph Api with below delegated permissions along with minimum User Administrator role:

• AppRoleAssignment.ReadWrite.All
• Directory.AccessAsUser.All

Request:

POST https://graph.microsoft.com/v1.0/servicePrincipals/f47a6776-bca7-4f2e-bc6c-eec59d058e3e/appRoleAssignments

Content-type: application/json

{
"principalId": "6cad4079-4e79-4a3f-9efb-ea30a14bdb26",
"principalType": "User",
"appRoleId":"454dc4c2-8176-498e-99df-8c4efcde41ef",
"resourceId":"f47a6776-bca7-4f2e-bc6c-eec59d058e3e"
}

Where,
"principalId": Object_ID_of_the_user,
"principalType": "User",
"appRoleId":"Object_ID_of_appRole, which can be fetched from App Manifest",
"resourceId": Object_ID_of_the_servicePrinicipal

Read more: https://learn.microsoft.com/en-us/graph/api/resources/approleassignment?view=graph-rest-1.0

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.