1

I've seen posts like this one where there is confusion on exactly what permission is required to allow a ServicePrincipal to call Get-AzureRmRoleAssignment when logging in using Login-AzureRmAccount.

In my case if I call Get-AzureRmRoleAssignment with the -debug flag I can capture the following error in the body of the HTTP response:

Body:
{
  "odata.error": {
    "code": "Authorization_RequestDenied",
    "message": {
      "lang": "en",
      "value": "Insufficient privileges to complete the operation."
    }
  }
}

I have set perms for the application as follows... first the Azure AD access:

Azure AD perms

And then the Microsoft Graph access:

MS Graph perms

This still gives the authZ failure error. I have even tried an experiment where I gave the app ALL perms for each API, and that still did not work.

What's missing? What perms EXACTLY are needed to allow read only programmatic access to list the role assignments with this call?

Dana Epp
  • 509
  • 1
  • 5
  • 13

1 Answers1

0

First, as I answered in that case, Get-AzureRmRoleAssignmentdoesn't only needs read access for role assignment with Azure REST API permission but also needs Read directory data permission with Azure AD Graph API. After adding permissions,

Add AAD Graph API Permission:

You also need to click Grant permissions button to do admin consent.

enter image description here

Add Azure REST API Persmssions:

Also, before adding AAD graph API permissions for your sp, ensure your sp has permissions with Azure REST API by assigning a role (E.g. A Contributor Role) to it from Subscriptions RBAC(IAM).

enter image description here

I test this and succeeded.

Community
  • 1
  • 1
Wayne Yang
  • 9,016
  • 2
  • 20
  • 40
  • I already have "Reader" role for the subscription. Are you seeing you must have Contributor role for the subscription to use this? – Dana Epp Apr 10 '18 at 17:28
  • Actually, I figured this out. The trick is that after altering the perms you have to hit Grant Permissions AGAIN. It doesn't explicitly do that after the add. – Dana Epp Apr 10 '18 at 17:35
  • Hi,@DanaEpp . That's what I mean about `Grant permissions`. After adding permissions, you need to hit this button to do admin consent. – Wayne Yang Apr 11 '18 at 02:04