Managed Identity - improved

[LuiseFreese]

tried to take into account your requested changes.

[marcduiker]

@LuiseFreese can you update the Link Checker workflow to add this https://graph.microsoft.com.* to the arguments to exclude the graph.microsoft.com links to be checked?

azure-functions-university/.github/workflows/code-tour-and-links-watcher.yml

Line 29 in 4662089

args: --verbose --no-progress --exclude-mail --exclude-loopback --exclude "https?://localhost.*" "https://sandbox.api.sap.com.*" "https://azure-university-app-config.*" "https://192.168.7.108.*" -- "**/*.md"

[marcduiker]

@LuiseFreese can you update the Link Checker workflow to add this https://graph.microsoft.com.* to the arguments to exclude the graph.microsoft.com links to be checked?

azure-functions-university/.github/workflows/code-tour-and-links-watcher.yml

Line 29 in 4662089

args: --verbose --no-progress --exclude-mail --exclude-loopback --exclude "https?://localhost.*" "https://sandbox.api.sap.com.*" "https://azure-university-app-config.*" "https://192.168.7.108.*" -- "**/*.md"

Needs to be in quotes in the yaml so "https://graph.microsoft.com.*" 😅

[marcduiker]

Added mostly some formatting and style changes. Still have to review exercise 4. Could you also add some lines like: Use the PowerShell terminal and type: followed by the instructions you already have. Because to novice users it might not be clear if az cli or PowerShell code should go in the function or in a local terminal.

[marcduiker]

I'm a PowerShell n00b. I see two usages of assigning variables here. Lines 152 and 153 are wrapping the output of the az commands in a $( ... ). This is not used when assigning the variables for graphId and appRoleId. Why this difference? Is it due to the tsv output formatting?

[LuiseFreese]

PrincipalId is the Object ID of the system-assigned Managed Identity to which we want to assign the app role.
and we get this with $principalId = $(az resource list -n $webAppName --query [*].identity.principalId --out tsv) while $webappName is the name of our function app. We need the PrincipalId in the body of the REST call:

$body = "{'principalId':'$principalId','resourceId':'$graphResourceId','appRoleId':'$appRoleId'}"

graphID is the application ID of Microsoft Graph API exposed on AAD, its value is 00000003-0000-0000-c000-000000000000. We get this with $graphId = az ad sp list --query "[?appDisplayName=='Microsoft Graph'].appId | [0]" --all and we need it to get the appRoleId.

The appRoleId is the particular scope, like Group.Read or Teams.Create.

Does this make sense to you?

[marcduiker]

I don't understand this part: (that's later needed for --api)

[LuiseFreese]

I can delete this... it was more a comment for myself... the syntax for adding permissions is

az ad app permission add --id <ID goes here> --api <api like Graph goes here> --api-permissions <permission scope like Group.Read goes here>=Scope
Does that make sense to you?