Azure – how to give Azure Service Principal the same rights as the own user

azureazure-active-directory

I'm researching Azure and wanted to use a Service Principal when logging in through Azure CLI instead of authenticating through the web login method. I created a Service Principal with az ad sp create-for-rbac with the scope on the root of my subscription and role 'Owner'. I can succesfully login using the Service Principal but when I try to do az ad sp list, I get the error that I don't have enough privileges:
azure.graphrbac.models.graph_error.GraphErrorException: Insufficient privileges to complete the operation.

When I look at the Access control (IAM) tab in my subscription blade in the portal, I can see the Service Principal is Owner, and my own account is both Owner and Service administrator.

Is there a way to give the Service Principal exactly the same rights as my own account has?

Best Answer

Apparently giving an SP the 'Owner' role is not enough. You have the give it the 'Directory Readers' role. This is not possible using the Azure CLI or Portal though. You have to use the Azure AD Graph API, easiest way to do this is using https://graphexplorer.azurewebsites.net/.

Second caveat is, you can't use the graphexplorer site using your own Azure account (in my case I had a simple personal Azure setup with only myself as admin), but you have to create a user in your Azure AD. I gave it the Global Administrator role just to be sure, I'm not certain what the minimum role would be to be able to use the Graph API.

Now, the steps to add give the SP the Directory Readers role are a bit long to explain here, I found them here: https://lnx.azurewebsites.net/directory-roles-for-azure-ad-service-principal/

Not sure why this needs to be so convoluted and why this is not to be found in the documentation.

Related Solutions

Azure ADConnect – authentication error re: Office 365, Azure

This was resolved by enabling Forms Based authentication on our Intranet Global Authentication policy on our ADFS server, following the below instructions.

https://blogs.msdn.microsoft.com/josrod/2014/10/15/enabled-forms-based-authentication-in-adfs-3-0/

Azure cli not able login using command line option

When your account is Microsoft account(such as *@outlook.com, *@hotmail.com), you will get the error log. The root reason is Microsoft account does not support non-interactive login. It is also unsafe for you to login Azure with your account directly.

If you plan to manage your app or service with Azure CLI 2.0, you should run it under an Azure Active Directory (AAD) service principal rather than your own credentials. Please refer to the following steps to create service principal.

1.Login to Azure.

2.Use az ad sp create-for-rbac to create the service principal.

az ad sp create-for-rbac --name {appId} --password "{strong password}"

Example

az ad sp create-for-rbac --name shuiexample --password "Password012!!"

You could get result like below:

{
  "appId": "bca24913-026d-4020-b9f1-add600bf9045",
  "displayName": "shuiexample1234",
  "name": "http://shuiexample1234",
  "password": "*******",
  "tenant": "*******"
}

3.Sign in using the service principal using the following:

$appID="bca24913-026d-4020-b9f1-add600bf9045"
$password="******"
$tenant="*******"
az login --service-principal -u $appID --password $password --tenant $tenant

More information about this please refer to this link.

Best Answer

Related Solutions

Azure ADConnect – authentication error re: Office 365, Azure

Azure cli not able login using command line option

Related Topic