How do i assign custom app roles to a function app managed identity service principal?

Question

How do i assign custom app roles to a function app that's using managed identity service principal?

I have an app service that uses managed identity but I am unable to assign app roles (custom app roles for the API) to the service principal. I've looked in enterprise apps but app roles is not an option in the manage section and there is no manifest option. I've looked in app registrations but app services and function do not appear as registered apps.

So I have created a app registration for my app service and created custom roles for my API end points. (Not what I wanted to do but I now have custom app roles for my app)

I then need to assign the custom roles to some function apps that are also using managed identity but I am unable to assign the roles to the functions for the same reasons!

I have resorted to registering the function apps in app registration and then assigning the Custom API permissions to the new registration. I'm then using the new client id and secret in the function app. This gives me the API endpoint security that I need but This seems very wrong as I am treating the function app like an external app and not making use of the managed identity.

How can I do this using the Managed Identity of both my App Service API and my Function App rather than create app registrations for them?

Answer 1

Hello @Rob , Thank you for your question!

Yes you can assign it :

Did you try assigning the role using graph API : https://learn.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignments?view=graph-rest-1.0&tabs=http ?

I see , there is a similar discussion. https://stackoverflow.com/questions/63139515/assign-custom-role-to-azure-active-directory-system-managed-identity [ redirecting to the discussion to avoid duplication]

Please let me know if this helps.