AZ AD APP - Can't update SPA Redirect URIs

[julesblancphin]

Related command
az ad app

Is your feature request related to a problem? Please describe.
The az ad app command let's you update redirect uris but only for webapps, not SPAs. It would be beneficial if the azure CLI fully supported updating an app registration's SPA redirect URIs.

I've got an IaC pipeline to provision envs for my SPA, I need to be able to automatically update an app registration in B2C.

I have seen similar requests going as far back as 2020 but all have been ignored.

Here is a link to the https://learn.microsoft.com/en-us/cli/azure/ad/app?view=azure-cli-latest#az-ad-app-create

Describe the solution you'd like
There's an option called --web-redirect-uris, it would be nice to have one called --spa-redirect-uris

Describe alternatives you've considered
Using az rest does not work.

Doing it through the UI is not a solution either, for security reasons and the fact that it would become a manual step. It also goes against the purpose of the Azure CLI.

Additional context
The Azure CLI can be used in IaC pipelines to provision resources. As part of this, it's important to be able to automatically update an app registration's redirect URIs. This currently only is doable for webapps but not SPAs.

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• AZ AD APP - Can't update SPA redirectUris #30504
• "az ad app" no way to update spa redirect uri #25766
• Adding redirectUris for SPAs #14880
• Add redirectURI for single page application deployment in azure using Microsoft Graph API and Az rest command. #21668

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

The CLI now supports setting SPA redirect URIs via:

az ad app update --id {yourID} --set 'spa={"redirectUris": ["https://whatever.com/","https://whatever.me/"]}'

This worked using a recent Azure CLI version on Ubuntu WSL.

Reference:

• "az ad app" no way to update spa redirect uri #25766 (comment)

Solution 2:

Using the Graph API:

az rest \
  --method "patch" \
  --uri "https://graph.microsoft.com/v1.0/applications/<<object-id>>" \
  --headers "{'Content-Type': 'application/json'}" \
  --body "{'spa': {'redirectUris': [ 'https://jwt.ms', 'https://www.example.com/callbacks' ]}}"

Reference:

• "az ad app" no way to update spa redirect uri #25766 (comment)

Solution 3:

Another workaround using the Graph API:

UIREPLYURLS=`echo "[\"<your_reply_urls>\"]" | sed 's/;/\",\"/g'`
SPA_PATCH=$(printf '%s\n' "$UIREPLYURLS" | jq -c '{"spa":{"redirectUris":.}}')
az rest --method PATCH --uri "https://graph.microsoft.com/v1.0/applications/<object_id_of_the_app_registration>" --headers 'Content-Type=application/json' --body="$SPA_PATCH"

Ensure you escape quotes. If using more than one reply_url, UIREPLYURLS should look like:

["https://url01","https://url02"]

Reference:

• Adding redirectUris for SPAs #14880 (comment)

Powered by issue-sentinel

[jiasli]

Tracked by #14880. Please vote in that issue.

Using az rest does not work.

Could you provide more details on why az rest does not work?

[julesblancphin]

@jiasli #14880 has been opened for 5 years now with no sign that it'll be resolved.

az rest doesn't work for multiple reasons:

1. No documentation about what the body needs to look like, leaving the user to completely guess what it should be.
2. It overwrites the existing spa redirect URIs, increasing the complexity of the command as a user first needs to gather all the existing URIs so as to not lose them, and convert them to the appropriate format for the command to work.

Our usecase for them is pretty simple, we have a CI pipeline that provisions dedicated test environments for each feature branch in our project, and since auth is behind Azure AD B2C, we want to be able to run a command to simply add a new redirect URI, but that command turns into multiple commands to first gather the required information, and then one final az rest that doesn't work for the reasons explained above

Basically, az rest in this instance is too complex with very poor documentation support. Given the AZ command already works for --web-redirect-uris, I don't understand why it's taking 5+ years to get support for a similar command for spa-redirects