`az ad app permission grant` not working or usable as expected #12137

dmprantz · 2020-02-11T19:18:39Z

Describe the bug
"az ad app permission grant" only seems to grant a single scope. If I call it successive times, the existing scope is overwritten. This behaviour is not clearly documented, nor is the way to grant. multiple scopes.

"az ad app permission admin-consent" appears to be non-functional. How can admin consent be granted without three key pieces of information, AppID, APIID, and Scope? What is this doing? How can a single scope be granted at the application level?

I would also consider it a bug that "az ad app permission grant" cannot be used to grant application type scopes.

To Reproduce
Try to execute the above commands. "az ad app permission admin-consent" is not documented in any way that makes sense. "az ad app permission grant" seems to work, but successive calls over-write your work.

Expected behavior
There should be a single command that allows you to grant individual (or comma separated lists) of scopes for an API to an app. That same command should have a flag for Delegated vs Application Type. It should not overwrite itself. Worst case, if there have to be two commands, the one used to grant admin-consent to the application type should allow appropriate parameters.

Documentation of these calls should be clear and concise.

Environment summary
Windows 10. Installed via downloaded MSI for x64. cmd.exe shell.

C:\Program Files\Microsoft SDKs\Azure.NET SDK\v2.9\bin>az --version
azure-cli 2.0.81

command-modules-nspkg 2.0.3
core 2.0.81
nspkg 3.0.4
telemetry 1.0.4

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\dpomerantz.azure\cliextensions'

Python (Windows) 3.6.6 (v3.6.6:4cf1f54eb7, Jun 27 2018, 02:47:15) [MSC v.1900 32 bit (Intel)]

arrownj · 2020-02-12T01:26:10Z

Hi @jiasli , could you please help take a look at this ?

yonzhan · 2020-02-12T01:52:41Z

add to S166.

dmprantz · 2020-03-09T11:50:28Z

This was pushed to a future release. How many times is it going to get pushed before being addressed and resolved. Is any one able to comment on a commitment that this will be resolved with a definitive timeline?

jiasli · 2020-03-09T14:31:08Z

az ad app permission admin-consent is the old way of granting all Application Permissions and Delegated Permissions to an app at the same time. It calls an internal API:

azure-cli/src/azure-cli/azure/cli/command_modules/role/custom.py

Line 893 in 1c0e9c3

    
           url = 'https://main.iam.ad.ext.azure.com/api/RegisteredApplications/{}/Consent?onBehalfOfAll=true'.format(

⚠ It can only be called by a user, not a service principal.
⚠ It fails in Cloud Shell, because main.iam.ad.ext.azure.com is an endpoint not supported by Cloud Shell.
⚠ We will deprecate it in the future.

For example, we can call it with app's Application ID:

az ad app permission admin-consent --id 46eb4122-bd2b-4f54-af7b-6d79b46ee31a

Before:

After:

Grant Delegated Permissions

To grant Delegated Permissions, we recommend using az ad app permission grant. If multiple scopes are needed, separate them with spaces and surround the scopes with quotes: "a b". For example, to grant MS Graph (whose Application ID is 00000003-0000-0000-c000-000000000000) Delegated Permission to my app (Application ID 46eb4122-bd2b-4f54-af7b-6d79b46ee31a):

# Line breaks for legibility only, same for following commands
az ad app permission grant --id 46eb4122-bd2b-4f54-af7b-6d79b46ee31a 
                           --api 00000003-0000-0000-c000-000000000000
                           --scope "Directory.Read.All Directory.ReadWrite.All"

Grant Application Permissions

To grant Application Permissions, we can use any of these 2 APIs:

{principalId}/appRoleAssignments

# URL contains principalId
az rest --method POST 
        --uri https://graph.microsoft.com/v1.0/servicePrincipals/8aaa6158-7450-4407-ba08-61377f23d05f/appRoleAssignments
        --body '{
          "principalId": "8aaa6158-7450-4407-ba08-61377f23d05f",
          "resourceId": "a3efc889-f1b7-4532-9e01-91e32d1039f4",
          "appRoleId": "19dbc75e-c2e2-444c-a770-ec69d8559fc7"
        }'

{resourceId}/appRoleAssignedTo

# URL contains resourceId
az rest --method POST 
        --uri https://graph.microsoft.com/v1.0/servicePrincipals/a3efc889-f1b7-4532-9e01-91e32d1039f4/appRoleAssignedTo
        --body '{
          "principalId": "8aaa6158-7450-4407-ba08-61377f23d05f",
          "resourceId": "a3efc889-f1b7-4532-9e01-91e32d1039f4",
          "appRoleId": "19dbc75e-c2e2-444c-a770-ec69d8559fc7"
        }'

principalId (8aaa6158-7450-4407-ba08-61377f23d05f) is the objectId of the assigned client service principal. Service principal is also called Managed application in local directory or Enterprise Application.

You may get it from Azure Portal:

Or query principalId with Application ID:

> az ad sp show --id 46eb4122-bd2b-4f54-af7b-6d79b46ee31a --query "objectId" --output tsv
8aaa6158-7450-4407-ba08-61377f23d05f

resourceId (a3efc889-f1b7-4532-9e01-91e32d1039f4) is the objectId of the resource service principal. In this case it is for MS Graph's service principal. It varies in different tenants (directories). Retrieve it with MS Graph's Application ID:

$ az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "objectId" --output tsv
a3efc889-f1b7-4532-9e01-91e32d1039f4

appRoleId (19dbc75e-c2e2-444c-a770-ec69d8559fc7) is the ID of the permission. In this case, it is for Directory.ReadWrite.All. Retrieve it with MS Graph's Application ID:

> az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "appRoles[?value=='Directory.ReadWrite.All']"
[
  {
    "allowedMemberTypes": [
      "Application"
    ],
    "description": "Allows the app to read and write data in your organization's directory, such as users, and groups, without a signed-in user.  Does not allow user or group deletion.",
    "displayName": "Read and write directory data",
    "id": "19dbc75e-c2e2-444c-a770-ec69d8559fc7",
    "isEnabled": true,
    "value": "Directory.ReadWrite.All"
  }
]

You may also use F12 Developer Tools of the browser to capture network trace to check related ID conversions. (Quite complicated I admit.)

dmprantz · 2020-03-09T14:36:43Z

Thanks for all of the detailed information! I'll take some time and digest this, and come back if I have any further questions on this. I understand a bit more on the delays though.

jiasli · 2020-03-09T15:41:13Z

Hi @dmprantz , thanks a lot for your understanding. We have been working tightly with AAD team on this feature. Don't hesitate to let us know if there are any concerns.

jiasli · 2020-03-09T17:04:33Z

For the granting app (or service principal, which you use to log in and grant permissions to another service principal),

Directory.ReadWrite.All is needed for granting Delegated Permissions
AppRoleAssignment.ReadWrite.All is needed for granting Application Permissions

⚠ Keep in mind that AppRoleAssignment.ReadWrite.All is extremely privileged, as it allows granting any app-only permission, including RoleManagement.ReadWrite.Directory, which can then be used to give anyone (or any app) even higher privileges up to and including Company Administrator (i.e. Global Admin).

If you use az ad command, make sure the permission is given under Azure Active Directory Graph, since az ad internally uses AD Graph API. If you use az rest --uri https://graph.microsoft.com/, the permission should be given under Microsoft Graph.

Reference: https://winsmarts.com/how-to-grant-admin-consent-to-an-api-programmatically-e32f4a100e9d

fume · 2020-04-10T15:32:53Z

Hi @jiasli ,using the az ad app permission grant command to grand Delegated Permission is giving us a 404 NotFound error (like microsoftgraph/microsoft-graph-docs#12797, but we are NOT using a Service Principal). In our case the Delegated Permission is from Microsoft Graph (Directory.ReadWrite.All). Can you please clarify HOW to grant Delegated Permissions programmatically?

fume · 2020-04-10T17:36:47Z

I found a solution.
BEFORE invoking the az ad app permission grant, the Service Principal for your App Registration MUST exists (that's why you get the 404 NotFound!). So, invoking the az ad sp create --id <yourAppId> before the az ad app permission grant will fix everything.

This is really confusing and undocumented.

jiasli · 2020-04-11T12:03:16Z

@fume, glad to know it is solved. You may use --debug to check which request failed and fix it accordingly. BTW, We will track MS Graph related issues at microsoftgraph/docs-issue-transfer#2413.

jiasli · 2020-05-25T06:14:25Z

Update

Service Principal API of Microsoft Graph is now GA. I have updated my answer #12137 (comment) to reflect the most recent changes.

The GA APIs have some changes from this blog I provided earlier for granting Application Permissions.

In short

The subject of appRoleAssignments and appRoleAssignedTo are interchanged.
Only follow the official document and don't use the unsupported combinations.

TL;DR

We can consider the assignment as a relationship/binding between 2 service principals. There are 4 ways to create an assignment.

In the blog, the APIs are

{resourceId}/appRoleAssignments
{principalId}/appRoleAssignedTo

Now the official APIs are

We can draw a diagram like this:

Id		API	Correctness
`{principalId}`	➡	`appRoleAssignments`	(1) 🟢 Correct
	↘		(2) 🟡 Undocumented, unsupported
	↗		(3) 🟡 Undocumented, unsupported
`{resourceId}`	➡	`appRoleAssignedTo`	(4) 🟢 Correct

Ideally the same URL can be used for 4 operations:

POST to create
GET to list
GET to show, by appending the id of the assignment
DELETE to delete, by appending the id of the assignment

To use the above operations with URLs:

(1)(4): {principalId}/appRoleAssignments and {resourceId}/appRoleAssignedTo are the only official ways. All 4 operations are supported.
(2)(3): {resourceId}/appRoleAssignments and {principalId}/appRoleAssignedTo are undocumented and unsupported. They only work for an individual assignment (operation 1, 3, 4), but not GET to list (operation 2).

If we enumerate all combinations:

POST:

🟢 POST {principalId}/appRoleAssignments
🟢 POST {resourceId}/appRoleAssignedTo
🟡 POST {principalId}/appRoleAssignedTo (Unsupported)
🟡 POST {resourceId}/appRoleAssignments (Unsupported)

GET to list:

🟢 GET {principalId}/appRoleAssignments
🟢 GET {resourceId}/appRoleAssignedTo
🔴 GET {principalId}/appRoleAssignedTo (Not return the desired result)
🔴 GET {resourceId}/appRoleAssignments (Not return the desired result)

GET to show:

🟢 GET {principalId}/appRoleAssignments/id
🟢 GET {resourceId}/appRoleAssignedTo/id
🟡 GET {principalId}/appRoleAssignedTo/id (Unsupported)
🟡 GET {resourceId}/appRoleAssignments/id (Unsupported)

DELETE:

🟢 DELETE {principalId}/appRoleAssignments/id
🟢 DELETE {resourceId}/appRoleAssignedTo/id
🟡 DELETE {principalId}/appRoleAssignedTo/id (Unsupported)
🟡 DELETE {resourceId}/appRoleAssignments/id (Unsupported)

Examples

Using `{principalId}/appRoleAssignments` (1)

# POST {principalId}/appRoleAssignments (1)
$ az rest --method POST --url https://graph.microsoft.com/v1.0/servicePrincipals/8aaa6158-7450-4407-ba08-61377f23d05f/appRoleAssignments --body '{"principalId": "8aaa6158-7450-4407-ba08-61377f23d05f","resourceId": "a3efc889-f1b7-4532-9e01-91e32d1039f4","appRoleId": "19dbc75e-c2e2-444c-a770-ec69d8559fc7"}'
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('8aaa6158-7450-4407-ba08-61377f23d05f')/appRoleAssignments/$entity",
  "appRoleId": "19dbc75e-c2e2-444c-a770-ec69d8559fc7",
  "createdDateTime": "2020-05-26T08:12:09.7096052Z",
  "deletedDateTime": null,
  "id": "WGGqilB0B0S6CGE3fyPQX_E14wqwY2lBhDlpweb26uo",
  "principalDisplayName": "myapp",
  "principalId": "8aaa6158-7450-4407-ba08-61377f23d05f",
  "principalType": "ServicePrincipal",
  "resourceDisplayName": "Microsoft Graph",
  "resourceId": "a3efc889-f1b7-4532-9e01-91e32d1039f4"
}

# GET {principalId}/appRoleAssignments (1) to list
$ az rest --method GET --url https://graph.microsoft.com/v1.0/servicePrincipals/8aaa6158-7450-4407-ba08-61377f23d05f/appRoleAssignments
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('8aaa6158-7450-4407-ba08-61377f23d05f')/appRoleAssignments",
  "value": [
    {
      "appRoleId": "19dbc75e-c2e2-444c-a770-ec69d8559fc7",
      "createdDateTime": "2020-05-26T08:12:09.7096052Z",
      "deletedDateTime": null,
      "id": "WGGqilB0B0S6CGE3fyPQX_E14wqwY2lBhDlpweb26uo",
      "principalDisplayName": "myapp",
      "principalId": "8aaa6158-7450-4407-ba08-61377f23d05f",
      "principalType": "ServicePrincipal",
      "resourceDisplayName": "Microsoft Graph",
      "resourceId": "a3efc889-f1b7-4532-9e01-91e32d1039f4"
    }
  ]
}

# GET {resourceId}/appRoleAssignments (3) to list doesn't return the desired assignment
$ az rest --method GET --url https://graph.microsoft.com/v1.0/servicePrincipals/a3efc889-f1b7-4532-9e01-91e32d1039f4/appRoleAssignments
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('a3efc889-f1b7-4532-9e01-91e32d1039f4')/appRoleAssignments",
  "value": []
}

# GET {resourceId}/appRoleAssignments/{id} (3) to show is unsupported, but works
$ az rest --method GET --url https://graph.microsoft.com/v1.0/servicePrincipals/a3efc889-f1b7-4532-9e01-91e32d1039f4/appRoleAssignments/WGGqilB0B0S6CGE3fyPQX_E14wqwY2lBhDlpweb26uo
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('a3efc889-f1b7-4532-9e01-91e32d1039f4')/appRoleAssignments/$entity",
  "appRoleId": "19dbc75e-c2e2-444c-a770-ec69d8559fc7",
  "createdDateTime": "2020-05-26T08:12:09.7096052Z",
  "deletedDateTime": null,
  "id": "WGGqilB0B0S6CGE3fyPQX_E14wqwY2lBhDlpweb26uo",
  "principalDisplayName": "myapp",
  "principalId": "8aaa6158-7450-4407-ba08-61377f23d05f",
  "principalType": "ServicePrincipal",
  "resourceDisplayName": "Microsoft Graph",
  "resourceId": "a3efc889-f1b7-4532-9e01-91e32d1039f4"
}

# DELETE {principalId}/appRoleAssignments/{id} (1)
$ az rest --method DELETE --url https://graph.microsoft.com/v1.0/servicePrincipals/8aaa6158-7450-4407-ba08-61377f23d05f/appRoleAssignments/WGGqilB0B0S6CGE3fyPQX0ka7r14XhdLpH3TFDkPj6I

Using `{resourceId}/appRoleAssignedTo` (4)

# POST {resourceId}/appRoleAssignments (4) 
$ az rest --method POST --url https://graph.microsoft.com/v1.0/servicePrincipals/a3efc889-f1b7-4532-9e01-91e32d1039f4/appRoleAssignedTo --body '{"principalId": "8aaa6158-7450-4407-ba08-61377f23d05f","resourceId": "a3efc889-f1b7-4532-9e01-91e32d1039f4","appRoleId": "19dbc75e-c2e2-444c-a770-ec69d8559fc7"}'
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('a3efc889-f1b7-4532-9e01-91e32d1039f4')/appRoleAssignedTo/$entity",
  "appRoleId": "19dbc75e-c2e2-444c-a770-ec69d8559fc7",
  "createdDateTime": "2020-05-26T08:13:58.8505897Z",
  "deletedDateTime": null,
  "id": "WGGqilB0B0S6CGE3fyPQX1Gp1oD6w_JCqCeCp4QUT0Y",
  "principalDisplayName": "myapp",
  "principalId": "8aaa6158-7450-4407-ba08-61377f23d05f",
  "principalType": "ServicePrincipal",
  "resourceDisplayName": "Microsoft Graph",
  "resourceId": "a3efc889-f1b7-4532-9e01-91e32d1039f4"
}

# We don't list all appRoleAssignedTo items because the list is too large

# GET {resourceId}/appRoleAssignments/{id} (4) to show
$ az rest --method GET --url https://graph.microsoft.com/v1.0/servicePrincipals/a3efc889-f1b7-4532-9e01-91e32d1039f4/appRoleAssignedTo/WGGqilB0B0S6CGE3fyPQX1Gp1oD6w_JCqCeCp4QUT0Y
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('a3efc889-f1b7-4532-9e01-91e32d1039f4')/appRoleAssignedTo/$entity",
  "appRoleId": "19dbc75e-c2e2-444c-a770-ec69d8559fc7",
  "createdDateTime": "2020-05-26T08:13:58.8505897Z",
  "deletedDateTime": null,
  "id": "WGGqilB0B0S6CGE3fyPQX1Gp1oD6w_JCqCeCp4QUT0Y",
  "principalDisplayName": "myapp",
  "principalId": "8aaa6158-7450-4407-ba08-61377f23d05f",
  "principalType": "ServicePrincipal",
  "resourceDisplayName": "Microsoft Graph",
  "resourceId": "a3efc889-f1b7-4532-9e01-91e32d1039f4"
}

# GET {principalId}/appRoleAssignedTo/{id} (2) to show is unsupported, but works
az rest --method GET --url https://graph.microsoft.com/v1.0/servicePrincipals/8aaa6158-7450-4407-ba08-61377f23d05f/appRoleAssignedTo/WGGqilB0B0S6CGE3fyPQX1Gp1oD6w_JCqCeCp4QUT0Y
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('8aaa6158-7450-4407-ba08-61377f23d05f')/appRoleAssignedTo/$entity",
  "appRoleId": "19dbc75e-c2e2-444c-a770-ec69d8559fc7",
  "createdDateTime": "2020-05-26T08:13:58.8505897Z",
  "deletedDateTime": null,
  "id": "WGGqilB0B0S6CGE3fyPQX1Gp1oD6w_JCqCeCp4QUT0Y",
  "principalDisplayName": "myapp",
  "principalId": "8aaa6158-7450-4407-ba08-61377f23d05f",
  "principalType": "ServicePrincipal",
  "resourceDisplayName": "Microsoft Graph",
  "resourceId": "a3efc889-f1b7-4532-9e01-91e32d1039f4"
}

# DELETE {resourceId}/appRoleAssignments/{id} (4) 
$ az rest --method DELETE --url https://graph.microsoft.com/v1.0/servicePrincipals/a3efc889-f1b7-4532-9e01-91e32d1039f4/appRoleAssignedTo/WGGqilB0B0S6CGE3fyPQX1Gp1oD6w_JCqCeCp4QUT0Y

However I still find the doc titles of the API appRoleAssignments and appRoleAssignedTo confusing. Will track at issue https://github.com/microsoftgraph/microsoft-graph-docs-contrib/issues/5197.

estemendoza · 2021-12-02T20:32:10Z

@jiasli Thanks for the provided info. I am having issues when running the az rest command to grant permissions.

I tried this command last year and it was working fine, i didn't have to use it these last few months but now I am getting the following error:

"code":"Authorization_RequestDenied","message":"Insufficient privileges to complete the operation.

Any idea on what this could be?

My user is Owner and trying to run this on the PowerShell console

jiasli · 2021-12-03T02:29:08Z

Hi @estemendoza, Owner is a concept of ARM RBAC. In order to call MS Graph, please make sure you have the permission shown in

estemendoza · 2021-12-03T15:45:22Z

Hi @jiasli Thanks for the links, but I am still having issues. I tried to execute it using PowerShell on the Portal and got the following error:

> az rest --method POST --uri https://graph.microsoft.com/v1.0/servicePrincipals/875f4d30-XXXX-XXXX-XXXX-XXXXXXXX/appRoleAssignedTo --body '{"principalId":"0a699965-XXXX-XXXX-XXXX-XXXXXXXXXXX","resourceId":"875f4d30-XXXX-XXXX-XXXX-XXXXXXXX","appRoleId":"5778995a-XXX-XXX-XXX-XXXXXXXXXXX"}' --headers "Content-Type=application/json"
Bad Request({"error":{"code":"BadRequest","message":"Unable to read JSON request payload. Please ensure Content-Type header is set and payload is of valid JSON format.","innerError":{"date":"2021-12-03T15:38:15","request-id":"398f4a1d-8b28-4233-abbb-360ebee96f33","client-request-id":"398f4a1d-8b28-4233-abbb-XXXXXXXX"}}})

What am I doing wrong on the command? Thanks in advance

estemendoza · 2021-12-03T19:50:23Z

@jiasli Nevermind, I needed to run the script as an Administrator, thanks for the help.

jiasli · 2021-12-06T02:21:39Z

@estemendoza, passing JSON in PowerShell requires additional quoting rules. Please see https://github.com/Azure/azure-cli/blob/dev/doc/quoting-issues-with-powershell.md.

Azure CLI doesn't need Administrator permission to run.

MartinHatchUK · 2023-03-29T11:18:56Z

@jiasli
Can I please have some clarification on this as I'm facing the exact issues but cannot get this working using the examples you provided

I'm logged into Azure CLI in a Windows Terminal (PowerShell) using a Service Principal.

I'm trying to grant admin consent for an Application Scoped API permission

Executing the following
az rest --method POST --uri https://graph.microsoft.com/v1.0/servicePrincipals/9fd6352e-9cba-4e76-9fff-74c41c0ec4fc/appRoleAssignments --body '{"principalId": "9fd6352e-9cba-4e76-9fff-74c41c0ec4fc", "resourceId": "00000003-0000-0ff1-ce00-000000000000", "appRoleId": "678536fe-1083-478a-9c59-b99265e6b0d3" }' --headers "content-type: application/json"

I get an error message:

The command failed with an unexpected error. Here is the traceback:
not enough values to unpack (expected 2, got 1)
Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 575, in shell_safe_json_parse
  File "json\__init__.py", line 359, in loads
  File "json\decoder.py", line 337, in decode
  File "json\decoder.py", line 355, in raw_decode
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 883, in send_raw_request
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 601, in shell_safe_json_parse
azure.cli.core.azclierror.InvalidArgumentValueError: Failed to parse string as JSON:
content-type: application/json
Error detail: Expecting value: line 1 column 1 (char 0)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 663, in execute
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 697, in _run_job
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 333, in __call__
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/util/custom.py", line 24, in rest_call
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 886, in send_raw_request
ValueError: not enough values to unpack (expected 2, got 1)

Yvand · 2023-03-29T11:39:19Z

@MartinHatchL365 seems related to the value of --headers, and I think you can remove that parameter completely: I do not set it in my working scenario.

MartinHatchUK · 2023-03-29T11:41:51Z

@Yvand

If I don't use that then I get the following error message

Bad Request({"error":{"code":"BadRequest","message":"Write requests (excluding DELETE) must contain the Content-Type header declaration.","innerError":{"date":"2023-03-29T11:41:10","request-id":"9207c760-0ffc-45f9-9663-f9a88adf9a7a","client-request-id":"9207c760-0ffc-45f9-9663-f9a88adf9a7a"}}})

MartinHatchUK · 2023-03-29T12:03:54Z

@Yvand could it be that the URL is incorrect?

According to the official documentation on MS Graph, the correct endpoint is /appRoleAssignedTo and not /appRoleAssignments which is in the example above

Ref:
https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent?pivots=ms-graph#grant-admin-consent-for-application-permissions-1

Yvand · 2023-03-29T14:21:00Z

@MartinHatchL365 it looks good to me: In my script I am using endpoint /appRoleAssignments just fine...

MartinHatchUK · 2023-03-29T14:55:46Z

Does it make a difference that I'm logged in using a Service Principal?

jiasli · 2023-08-09T03:08:05Z

Another workaround is to use Microsoft Graph PowerShell SDK which is another client tool for AAD:

New-MgServicePrincipalAppRoleAssignment: https://learn.microsoft.com/en-us/powershell/microsoftgraph/tutorial-grant-app-only-api-permissions?view=graph-powershell-1.0
New-MgOauth2PermissionGrant: https://learn.microsoft.com/en-us/powershell/microsoftgraph/tutorial-grant-delegated-api-permissions?view=graph-powershell-1.0

StefH · 2024-06-27T21:03:00Z

Just a quick note (I hope I'm not confusing anyone), but on my Azure Tenant, the MS Graph (00000003-0000-0000-c000-000000000000) does not have an objectId but (only) a id.

So in my case, the code to get the correct resourceId for MS Graph is

az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "id" --output tsv

triage-new-issues bot added the triage label Feb 11, 2020

arrownj added AAD and removed triage labels Feb 12, 2020

arrownj assigned jiasli Feb 12, 2020

yonzhan added this to the S166 milestone Feb 12, 2020

yonzhan modified the milestones: S166, S167 Mar 7, 2020

jiasli modified the milestones: S167, Backlog Mar 9, 2020

jiasli added the Feature Request label Mar 9, 2020

This was referenced Mar 9, 2020

az ad app permission admin-consent --id <app-id> fails in CloudShell #8912

Closed

Support az ad app permission admin-consent being called by a service principal #10403

Closed

Grant Admin-Consent using a Service Principal #11159

Closed

jiasli mentioned this issue Mar 9, 2020

Lack of MSI Requirement documentation #10181

Closed

jiasli mentioned this issue Mar 23, 2020

Unable to assign user_impersonation permission to an App Registration’s API permissions. #11428

Closed

yonzhan closed this as completed Mar 28, 2020

henriksen mentioned this issue Mar 30, 2020

Cannot grant admin consent for an app role permission #12797

Closed

jiasli mentioned this issue May 5, 2020

[RBAC] Updates to az ad app permission list/add/delete #13325

Closed

2 tasks

jiasli mentioned this issue Jun 28, 2020

az ad app permission admin-consent for sovereign cloud #9942

Closed

mikaelweave mentioned this issue Jul 16, 2021

createProxyServiceClient: Updated app role assignment method to recommended approach microsoft/fhir-proxy#23

Closed

jiasli mentioned this issue Oct 9, 2021

Unable to add Azure Active Directory Graph permissions to an application in Azure Portal #19818

Open

michaelmaillot mentioned this issue Oct 19, 2021

Extend 'aad app add' to support granting admin consent pnp/cli-microsoft365#2563

Closed

jiasli mentioned this issue Nov 1, 2021

{Role} Change "directory administrator" to "global administrator" #20051

Merged

3 tasks

jiasli changed the title ~~az ad app grants not working or usable as expected~~ az ad app permission grant not working or usable as expected Dec 15, 2021

jiasli mentioned this issue Jan 17, 2022

[Feature Request] az ad sp create-for-rbac can show the id/objectId of the created service principal #21009

Open

garrytrinder mentioned this issue Mar 8, 2022

Extend aad app add with the ability to grant admin consent for API scopes pnp/cli-microsoft365#3114

Closed

jiasli mentioned this issue Jun 7, 2022

[Feature Request] Provide native commands for appRoleAssignment API #22768

Open

sam-mfb mentioned this issue Jan 5, 2023

Granting admin consent to an Application (Role) scope microsoftgraph/msgraph-sdk-powershell#1733

Closed

jiasli mentioned this issue Apr 17, 2023

az ad app permission admin-consent broken #25257

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

`az ad app permission grant` not working or usable as expected #12137

`az ad app permission grant` not working or usable as expected #12137

dmprantz commented Feb 11, 2020

arrownj commented Feb 12, 2020

yonzhan commented Feb 12, 2020

dmprantz commented Mar 9, 2020

jiasli commented Mar 9, 2020 •

edited

Loading

dmprantz commented Mar 9, 2020

jiasli commented Mar 9, 2020

jiasli commented Mar 9, 2020

fume commented Apr 10, 2020 •

edited

Loading

fume commented Apr 10, 2020

jiasli commented Apr 11, 2020 •

edited

Loading

jiasli commented May 25, 2020 •

edited

Loading

estemendoza commented Dec 2, 2021

jiasli commented Dec 3, 2021

estemendoza commented Dec 3, 2021

estemendoza commented Dec 3, 2021

jiasli commented Dec 6, 2021

MartinHatchUK commented Mar 29, 2023

Yvand commented Mar 29, 2023

MartinHatchUK commented Mar 29, 2023 •

edited

Loading

MartinHatchUK commented Mar 29, 2023

Yvand commented Mar 29, 2023

MartinHatchUK commented Mar 29, 2023

jiasli commented Aug 9, 2023

StefH commented Jun 27, 2024 •

edited

Loading

az ad app permission grant not working or usable as expected #12137

az ad app permission grant not working or usable as expected #12137

Comments

dmprantz commented Feb 11, 2020

arrownj commented Feb 12, 2020

yonzhan commented Feb 12, 2020

dmprantz commented Mar 9, 2020

jiasli commented Mar 9, 2020 • edited Loading

Grant Delegated Permissions

Grant Application Permissions

dmprantz commented Mar 9, 2020

jiasli commented Mar 9, 2020

jiasli commented Mar 9, 2020

fume commented Apr 10, 2020 • edited Loading

fume commented Apr 10, 2020

jiasli commented Apr 11, 2020 • edited Loading

jiasli commented May 25, 2020 • edited Loading

Update

In short

TL;DR

Examples

Using {principalId}/appRoleAssignments (1)

Using {resourceId}/appRoleAssignedTo (4)

estemendoza commented Dec 2, 2021

jiasli commented Dec 3, 2021

estemendoza commented Dec 3, 2021

estemendoza commented Dec 3, 2021

jiasli commented Dec 6, 2021

MartinHatchUK commented Mar 29, 2023

Yvand commented Mar 29, 2023

MartinHatchUK commented Mar 29, 2023 • edited Loading

MartinHatchUK commented Mar 29, 2023

Yvand commented Mar 29, 2023

MartinHatchUK commented Mar 29, 2023

jiasli commented Aug 9, 2023

StefH commented Jun 27, 2024 • edited Loading

`az ad app permission grant` not working or usable as expected #12137

`az ad app permission grant` not working or usable as expected #12137

jiasli commented Mar 9, 2020 •

edited

Loading

fume commented Apr 10, 2020 •

edited

Loading

jiasli commented Apr 11, 2020 •

edited

Loading

jiasli commented May 25, 2020 •

edited

Loading

Using `{principalId}/appRoleAssignments` (1)

Using `{resourceId}/appRoleAssignedTo` (4)

MartinHatchUK commented Mar 29, 2023 •

edited

Loading

StefH commented Jun 27, 2024 •

edited

Loading