Assigning Microsoft Graph permissions to Azure Managed Service Identity

Question

I\'m trying to assign permissions to an Azure Managed Service Identity for my Azure Logic App, but am running into errors.

I\'m using the 2.0.1.16 version of the Azu

Answer 1

Currently the behavior hasn't been changed yet.

• First time bogus authentication error
• 2nd time Bad Request

However you can now also confirm the changes being applied through the new beta endpoint of MS Graph, after executing the Powershell commands.

navigate to https://developer.microsoft.com/en-us/graph/graph-explorer & authenticate with your user (should be indicated in the left sidebar)

You can then query the applied roles through: https://graph.microsoft.com/beta/servicePrincipals/{msi.ObjId}/appRoleAssignedTo

Answer 2

Initial Setup

I setup a new logic app named "test" in my trial subscription just like you have explained above and enabled the MSI for it through workflow settings. Then I used the exact same PowerShell commands that you have above.

Explanation of two most important things that are happening

1. First Run - Even though you get error with Code: Authorization_RequestDenied, the operation of adding new role assignments has actually done it's work. New permissions have been added. (I'll give a little evidence on this in section below)

2. Subsequent Runs after the first run - You get an error with Code: Request_BadRequest, because the permissions/role assignments you're trying to add had already been added in the first run.

Evidence

1. PowerShell Scripts exactly from your post.

2. These queries worked for me only from Azure AD Graph Explorer (and NOT the new Microsoft Graph Explorer). Also, queries are case sensitive, so even a small difference will effect.

   You can basically look at the role assignments for the Service Principal, before and after running your PowerShell script the first time to see that the required permissions actually get added (I created a new logic app with nothing in it and just MSI enabled to test this part)

Azure AD Graph Query:

Azure AD Graph Query: https://graph.windows.net/{tenant Id}/servicePrincipals/{MSI Service Principal ID}/appRoleAssignments
    
{MSI Service Principal ID} is 8d87a1f9-fab0-45a9-a6f3-1e93b2d99b52 in your case.

Role Assignments for the MSI Service Principal BEFORE the first run of New-AzureADServiceAppRoleAssignment using above query.

Role Assignments for the MSI Service Principal AFTER the first run of New-AzureADServiceAppRoleAssignment using above query.

Another SO Post which is related but slightly different

This SO post mentions almost the same PowerShell scripts that you are using. Interesting thing being it looks like scripts worked without error for many people as well. But notice the last comment by user Olandese