I have a rather (hopefully) theoretical question regarding the secure usage of Service Pricipals in Azure (Enterprise Applications)
Introduction
we currently deploy our DevOps Code via Azure Service Principals.
AppRegistration/Enterprise App is created
Secret is generated
Permission (i.e. Contributor) to the Ressource Group is granted in Azure
Service Connection is made in Devops
everything works fine.
Assumption
By default the Service Principal (Enterprise Application) is not restricted to a specific user/group (Assignment Required => "no").
My assumption is now, that every user in the AAD-Tenant is able to login to the Enterprise Application as well.
I i.e. do this by using the "Graph Powershell API"-EnterpriseApp.
I can either use a Secret or use my User Credentials to access the Service Principal and its permissions
Security issue?
coming back to our DevOps configuration:
The Service Principal has Contributor Permission on the dedicated Resource Group
Assignment Required is set to no (default configuration)
if I (as a malicious user) have the Application ID, i could simply logon to the Service Principal and receive the Token.
Question:
With this token and my login to the App, do i also have the Contributor Permissions of the App and could now manipulate the whole Resource Group?
Since i'm not an Azure Developer - but only an Azure AD Admin - my knowledge regarding this is limited,
so i'm not able to test it.
Can someone maybe either provide code or prove that my assumptions are wrong or correct?!
Thanks
Yes, the SPN can manage the resources within the resource group if it has Contributor - it is no different than a normal (human) identity.
Consider if the SPN actually needs Contributor or if you can limit it with another role or even make a custom role.
Furthermore, monitor the sign-ins using the Azure AD sign-in logs:
https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-all-sign-ins
You can also use CanNotDelete resource lock, which means that the service principal cannot delete resource as it is only Contributor:
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json
You might want to look into the Conditional Access to strengthen your environment:
https://learn.microsoft.com/en-us/azure/active-directory/develop/workload-identities-overview
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/workload-identity
https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-create-azure-ad-roles-and-resource-roles-review
Take a look here:
https://infosecwriteups.com/a-lab-for-practicing-azure-service-principal-abuse-bd000e6c48eb
https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/disable-user-sign-in-portal
https://learn.microsoft.com/en-us/powershell/module/az.accounts/connect-azaccount?view=azps-9.3.0#example-3-connect-to-azure-using-a-service-principal-account
My assumption is now, that every user in the AAD-Tenant is able to login to the Enterprise Application as well.
No. They would need the client secret or the rights to generate a new one. Which requires that they are owners of the App Registration. In the App Registration on the Owners tab it says:
The users listed here can view and edit this application registration. Additionally, any user (may not be listed here) with administrative privileges to manage any application (e.g., Global Administrator, Cloud App Administrator etc.) can view and edit the application registrations.
Related
Further to:
API Permission Issue while Azure App Registration
and
Why is "Application permissions" disabled in Azure AD's "Request API permissions"?
I cannot activate the Application Permissions button in the API permissions when I am trying to register an application in Active Directory. I have created the roles (several times) and ensured all of the properties are correct as described in both posts and in https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-app-registration - including that it the role is set for application, . I am using the default directory of my Azure account. I am the only member in my directory and am a member of global administrators.
Is there something else I am missing?
My end goal is simply to use the .Net SDK to manage the firewall on an application service using a client secret that can be distributed with an application.
Here is the manifest
Okay, so you want an app registration to manage an App Service through Azure Resource Management API as itself with client credentials flow?
In that case you don't need to assign any application permissions to your app.
You need to create the app, and then go to e.g. the App Service resource's Access Control (IAM) tab, and add the needed role to your app there.
The reason that the app permissions tab there is grey is because the Azure Service Management app registration (which you can't edit) does not define any app permissions.
When you define an app permission in the manifest, that becomes a permission that other applications could use to call your API, not Azure Resource Management API.
Is there something else I am missing?
The reason Applications Permissions is greyed out for you is because Azure Service Management API only allows Delegated Permissions i.e. this API will be always be executed in context of the signed-in user. In other words, a user (even if it is a Service Principal) must always be present when executing this API.
You mentioned that you wanted to execute Service Management API using a client secret. For that there are two things you would need to do:
As mentioned by #junnas, you will need to assign your application (which is a Service Principal) a proper Azure RBAC role on an Azure Subscription. Please see this link for more details: https://learn.microsoft.com/en-us/azure/role-based-access-control/overview.
You will need to acquire token for this Service Principal using client id and client secret. You can use ClientSecretCredential for that purpose.
We're a very small company, for unknown reasons our internal app infrastructure (based on PaaS VMs) was set up on the Azure subscription for a "personal" Windows Live account of an internal email address, with only that one user in the AD. (We also use the "correct" Azure instance, the AD is synced from the remnant of our old on-prem infrastructure and our Office 365 is based on it.)
We're about to recruit a second developer, I want to give him some level of access to our app infrastructure but not the global admin that sharing the existing single account would provide. I've experimentally added another user to the Azure AD as a global admin (so it should have access to everything) but when I log in with that user it takes me to the portal for the default free personal Azure instance you get if there's nothing set up. If I paste in a URL for a resource in the account it's global admin for I get "You do not have access" (403). (Audit trail of the user in Azure AD shows it logged in.)
Is there an inherent restriction on this type of account (in which case I'll have to bite the bullet and migrate the infrastructure where it belongs) or should I be able to expect this user to be able to access the right portal - and if so what do I need to do to get that to happen?
Having Global Admin role in Azure AD does not give you access to Azure resources, only to manage users etc. in Azure AD.
You need to add e.g. Owner/Contributor role on the subscription to the user through the Access Control (IAM) tab.
I'm referring to the Azure documentation on Application and service principal objects in Azure Active Directory.
I would like to understand the security implications of allowing users to register an application in Azure AD.
I couldn't find any documentation that explained who and who should not have the permission to do so and for what reason.
More specifically the use case is letting the owner of an Azure subscription create an ARM Service Connection in Azure DevOps. This implies registering an app in Azure AD (for this service connection).
So my question is: are there any good reason to deny the owner of an Azure subscription the permission to register applications in Azure AD?
What are the general risks or security considerations?
Only a subscription owner can define IAM for a service principal (service connection), just because you can create them it's useless without the right permissions.
But.....
If you keep on creating principals with the similar names (not following any form of naming conversion) you are very close to making a human error by giving a wrong service principal unwanted access. This can lead to potential security incidents.
Also, as an admin you will have a lot of unused 'junk' service principals in your directory. Cleanup becomes very hard with cowboy developers -demanding for them to be retained.
We are using VSTS/Azure DevOps to build and deploy our web services to Azure.
In the release step we use the Azure CLI build task to set up the environment for the web service. The build task uses a Service Connection to be authorized to do these actions.
The build task can create web services and deployment slots without issue, but when I try to instruct it to add a new reply url to the Azure AD application the web app uses to authenticate users, i see the following:
az ad app update --id 3e5a96e9-7311-4f92-869b-fbb5bbe8e41f --reply-urls http://mytestapp.azurewebsites.net
ERROR: Insufficient privileges to complete the operation.
The service connection used is an Azure RM service connection using a Service Principal. Is this correct? I'm guessing there is there a permission I need to set on the service principal, but which one?
Jayendran is correct. The user must be a member of Global Admin role in the directory because the Reply URL is added in the app registration.
You may also need to grant permissions to the app itself.
https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-v1-integrate-apps-with-azure-ad
If you're looking to follow the least privileges principle and not assign the highest possible privilege available (as per your comment), I see 3 possible options that could work for you -
Owner for only a specific application (and NOT the Owner/Global Administrator for entire Azure AD)
You can add the user as Owner for only the specific application, which they need to manage (in your case, change reply URL's for).
Pro: Obviously the good thing about this approach is that this user gets to manage the app registration for only this particular application and none of the others in your Azure AD.
How: Go to "App Registrations" in Azure AD and navigate to the specific application. Now click on "Settings" and select "Owners"
Application Administrator Role
This one is a little more generic and a higher privilege in comparison to single application owner, as it gives the user access to manage application registrations for all applications.
Pro: Role is specific to only managing application registrations. It helps in a scenario where all applications need to be managed by this user.
How: Go to "Users" in your Azure AD and then select the specific user. Now go to "Directory Role" and add "Application Administrator Role"
Application Developer Role
This one is very similar to option 2 i.e. "Application administrator". Difference being that "Application developer" gets permissions for only those applications which they are developing, so the registration was done by them.
Pro: Good for user that is about to create and manage registrations for multiple applications.
How: Very similar to option 2 above.
More information about all the available roles and granular permissions that are used by these roles in Microsoft Docs:
Available Roles
I'd like to create a service principle to allow deployments to one or more of my resources under my subscription.
I have an MSDN subscription allowing me £40 a month on Azure.
The Azure Active Directory is maintained by my company.
I am set as a general user
I've already created a service principle with a key via the portal.
When I try to connect via the SP from Octopus Deploy I get the below message:
Unable to verify Azure Account: The client 'xxxx' with object id
'xxxx' does not have authorization to perform action
'Microsoft.Resources/subscriptions/resourcegroups/read' over scope
'/subscriptions/xxxx'.
As I now understand it, an SP sits at tenant level. So does this mean that I likely don't have any permissions to create an SP with the proper access to do what I need and I'll have to get an Admin to do it?
I'm struggling to understand this authentication method tbh. So any information to help clarify how this all fits together would be very much appreciated.
e.g.
Can I limit an SP to just my MSDN subscription?
Can I even limit it to resource groups / resources?
...
In terms of permissions Service Principal doesnt differ from a regular user. Your service principal doesnt have access to that particular subscription. You need to grant those rights to the service principal. You can use portal\powershell\cli\SDK to do that. Sample link.