|
| 1 | +--- |
| 2 | +title: Assign a managed identity to an application role using Azure CLI - Azure AD |
| 3 | +description: Step-by-step instructions for assigning a managed identity access to another application's role, using Azure CLI. |
| 4 | +services: active-directory |
| 5 | +documentationcenter: |
| 6 | +author: christoc |
| 7 | +manager: |
| 8 | +editor: |
| 9 | + |
| 10 | +ms.service: active-directory |
| 11 | +ms.subservice: msi |
| 12 | +ms.devlang: na |
| 13 | +ms.topic: how-to |
| 14 | +ms.tgt_pltfrm: na |
| 15 | +ms.workload: identity |
| 16 | +ms.date: 11/03/2021 |
| 17 | +ms.author: christoc |
| 18 | +ms.collection: M365-identity-device-management |
| 19 | +ms.custom: devx-track-azurepowershell |
| 20 | +--- |
| 21 | + |
| 22 | +# Assign a managed identity access to an application role using Azure CLI |
| 23 | + |
| 24 | +Managed identities for Azure resources provide Azure services with an identity in Azure Active Directory. They work without needing credentials in your code. Azure services use this identity to authenticate to services that support Azure AD authentication. Application roles provide a form of role-based access control, and allow a service to implement authorization rules. |
| 25 | + |
| 26 | +In this article, you learn how to assign a managed identity to an application role exposed by another application using Azure CLI. |
| 27 | + |
| 28 | +## Prerequisites |
| 29 | + |
| 30 | +- If you're unfamiliar with managed identities for Azure resources, check out the [overview section](overview.md). **Be sure to review the [difference between a system-assigned and user-assigned managed identity](overview.md#managed-identity-types)**. |
| 31 | + |
| 32 | +[!INCLUDE [azure-cli-prepare-your-environment-no-header.md](../../../includes/azure-cli-prepare-your-environment-no-header.md)] |
| 33 | + |
| 34 | +## Assign a managed identity access to another application's app role |
| 35 | + |
| 36 | +1. Enable managed identity on an Azure resource, [such as an Azure VM](qs-configure-cli-windows-vm.md). |
| 37 | + |
| 38 | +1. Find the object ID of the managed identity's service principal. |
| 39 | + |
| 40 | + **For a system-assigned managed identity**, you can find the object ID on the Azure portal on the resource's **Identity** page. You can also use the following script to find the object ID. You'll need the resource ID of the resource you created in step 1, which is available in the Azure portal on the resource's **Properties** page. |
| 41 | + |
| 42 | + ```azurecli |
| 43 | + resourceIdWithManagedIdentity="/subscriptions/{my subscription ID}/resourceGroups/{my resource group name}/providers/Microsoft.Compute/virtualMachines/{my virtual machine name}" |
| 44 | + |
| 45 | + oidForMI=$(az resource show --ids $resourceIdWithManagedIdentity --query "identity.principalId" -o tsv | tr -d '[:space:]') |
| 46 | + echo "object id for managed identity is: $oidForMI" |
| 47 | + ``` |
| 48 | +
|
| 49 | + **For a user-assigned managed identity**, you can find the managed identity's object ID on the Azure portal on the resource's **Overview** page. You can also use the following script to find the object ID. You'll need the resource ID of the user-assigned managed identity. |
| 50 | +
|
| 51 | + ```azurecli |
| 52 | + userManagedIdentityResourceId="/subscriptions/{my subscription ID}/resourceGroups/{my resource group name}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{my managed identity name}" |
| 53 | + |
| 54 | + oidForMI=$(az resource show --id $userManagedIdentityResourceId --query "properties.principalId" -o tsv | tr -d '[:space:]') |
| 55 | + echo "object id for managed identity is: $oidForMI" |
| 56 | + ``` |
| 57 | +
|
| 58 | +1. Create a new application registration to represent the service that your managed identity will send a request to. If the API or service that exposes the app role grant to the managed identity already has a service principal in your Azure AD tenant, skip this step. |
| 59 | +
|
| 60 | +1. Find the object ID of the service application's service principal. You can find this using the Azure portal. Go to Azure Active Directory and open the **Enterprise applications** page, then find the application and look for the **Object ID**. You can also find the service principal's object ID by its display name using the following script: |
| 61 | +
|
| 62 | + ```azurecli |
| 63 | + appName="{name for your application}" |
| 64 | + serverSPOID=$(az ad sp list --filter "displayName eq 'My App'" --query '[0].objectId' -o tsv | tr -d '[:space:]') |
| 65 | + echo "object id for server service principal is: $serverSPOID" |
| 66 | + ``` |
| 67 | +
|
| 68 | + > [!NOTE] |
| 69 | + > Display names for applications are not unique, so you should verify that you obtain the correct application's service principal. |
| 70 | +
|
| 71 | + Alternatively you can find the Object ID by the unique Application ID for your application registration: |
| 72 | +
|
| 73 | + ```azurecli |
| 74 | + appID="{application id for your application}" |
| 75 | + serverSPOID=$(az ad sp list --filter "appId eq '$appID'" --query '[0].objectId' -o tsv | tr -d '[:space:]') |
| 76 | + echo "object id for server service principal is: $serverSPOID" |
| 77 | + ``` |
| 78 | +
|
| 79 | +1. Add an [app role](../develop/howto-add-app-roles-in-azure-ad-apps.md) to the application you created in step 3. You can create the role using the Azure portal or using Microsoft Graph. For example, you could add an app role like this: |
| 80 | +
|
| 81 | + ```json |
| 82 | + { |
| 83 | + "allowedMemberTypes": [ |
| 84 | + "Application" |
| 85 | + ], |
| 86 | + "displayName": "Read data from MyApi", |
| 87 | + "id": "0566419e-bb95-4d9d-a4f8-ed9a0f147fa6", |
| 88 | + "isEnabled": true, |
| 89 | + "description": "Allow the application to read data as itself.", |
| 90 | + "value": "MyApi.Read.All" |
| 91 | + } |
| 92 | + ``` |
| 93 | +
|
| 94 | +1. Assign the app role to the managed identity. You'll need the following information to assign the app role: |
| 95 | + * `managedIdentityObjectId`: the object ID of the managed identity's service principal, which you found in step 2. |
| 96 | + * `serverServicePrincipalObjectId`: the object ID of the server application's service principal, which you found in step 4. |
| 97 | + * `appRoleId`: the ID of the app role exposed by the server app, which you generated in step 5 - in the example, the app role ID is `0566419e-bb95-4d9d-a4f8-ed9a0f147fa6`. |
| 98 | + |
| 99 | + Execute the following script to add the role assignment. Note that this functionality is not directly exposed on the Azure CLI and that a REST command is used here instead: |
| 100 | +
|
| 101 | + ```azurecli |
| 102 | + roleguid="0566419e-bb95-4d9d-a4f8-ed9a0f147fa6" |
| 103 | + az rest -m POST -u https://graph.microsoft.com/beta/servicePrincipals/$oidForMI/appRoleAssignments -b "{\"principalId\": \"$oidForMI\", \"resourceId\": \"$serverSPOID\",\"appRoleId\": \"$roleguid\"}" |
| 104 | + ``` |
| 105 | +
|
| 106 | +## Next steps |
| 107 | +
|
| 108 | +- [Managed identity for Azure resources overview](overview.md) |
| 109 | +- To enable managed identity on an Azure VM, see [Configure managed identities for Azure resources on an Azure VM using PowerShell](qs-configure-cli-windows-vm.md). |
0 commit comments