How to manage Azure AD App Roles for Azure AD Users

Question

1: Is anyone aware of a tool that can manage the assignment of Roles for Azure AD Users (the appRoles defined in the manifest) for Enterprise Applications in Azure AD?

I am talking about how to Assign Roles (app specific) to existing Azure AD Users. It’s a very slow process using the Azure Portal for this.

Of course, we could create this tool, but would be nice if such a tool already exists. What are large organizations with many Azure AD Enterprise Apps using today?

2: Is it really best practice to manually edit the manifest file in the portal? Would make more sense to have the file (the AppRoles section) in git along the application code.

Answer 1

Is anyone aware of a tool that can manage Roles for Azure AD Users

AFAIK, there isn't any specific tool available to manage Application roles.

Overall, you should be able to use following options for add/edit/update options related to application roles and assigning permissions to existing AD Users:

NOTE: Also know in case you are dealing with a large number of users, you could consider assigning security groups to app roles instead of doing it for individual users. It's an option worth considering, although it requires an Azure AD premium license. (Update - Also see comment from Philippe Signoret at the end of this answer about assigning groups to app roles, delegating management of the assigned groups and self-service group management)

1. Azure Portal by editing application manifest json (you're aware of this already)

2. PowerShell -

   I've added a script for this one at the end. You can do this while creating a new app using New-AzureADApplication or for an existing application using Set-AzureADApplication.

   For assigning these roles to existing users, you can use New-AzureADUserAppRoleAssignment as I have shown below with the updated script.

3. Azure AD Graph API -

   You can work with AppRole Type and Application entity for managing app roles themselves. Documentation here

   You can work with AppRoleAssignment Entity for assigning these roles to existing Azure AD users etc. Documentation here

   

4. Microsoft Graph API -

   Documentation here - Please notice this is available only in beta version - so it's not yet good for production applications.

   Look here for working with App Role Assignments

For your production applications, you could read application roles from a json file (part of source control like git etc.) and feed that into one of the programmatic options like PowerShell or Azure AD Graph API.

Here is the PowerShell script. Also take a look at these SO Post where we discussed something similar but only in scope of PowerShell.

SO Post 1

SO Post 2 (This question discusses parsing json file and updating Application manifest using PowerShell)

Connect-AzureAD -TenantId <Tenant GUID>

# Create an application role of given name and description
Function CreateAppRole([string] $Name, [string] $Description)
{
    $appRole = New-Object Microsoft.Open.AzureAD.Model.AppRole
    $appRole.AllowedMemberTypes = New-Object System.Collections.Generic.List[string]
    $appRole.AllowedMemberTypes.Add("User");
    $appRole.DisplayName = $Name
    $appRole.Id = New-Guid
    $appRole.IsEnabled = $true
    $appRole.Description = $Description
    $appRole.Value = $Name;
    return $appRole
}

# ObjectId for application from App Registrations in your AzureAD
$appObjectId = "<Your Application Object Id>"
$app = Get-AzureADApplication -ObjectId $appObjectId
$appRoles = $app.AppRoles
Write-Host "App Roles before addition of new role.."
Write-Host $appRoles

$newRole = CreateAppRole -Name "MyNewApplicationRole" -Description "This is my new Application Role"
$appRoles.Add($newRole)

Set-AzureADApplication -ObjectId $app.ObjectId -AppRoles $appRoles

Once you are done with above script to add AppRole, then assigning roles to a user is pretty simple and a direct command is available. Here's a sample script for that -

# Assign the values to the variables
$username = "<You user's UPN>"
$app_name = "<Your App's display name>"
$app_role_name = "<App role display name>"

# Get the user to assign, and the service principal for the app to assign to
$user = Get-AzureADUser -ObjectId "$username"
$sp = Get-AzureADServicePrincipal -Filter "displayName eq '$app_name'"
$appRole = $sp.AppRoles | Where-Object { $_.DisplayName -eq $app_role_name }

# Assign the user to the app role
New-AzureADUserAppRoleAssignment -ObjectId $user.ObjectId -PrincipalId 
$user.ObjectId -ResourceId $sp.ObjectId -Id $appRole.Id

Answer 2

Late response but possibly better late than never, Terraform has support for this: https://www.terraform.io/docs/providers/azuread/r/application.html