Permission in AzureAD for scaling up and down with REST API - azure

Question

I have registered an application in AzureAD: AnalysisService
It has the following IDs:
Application (client) ID: ID1
Directory (tenant) ID: ID2
and I have defined the following permission it:
My aim is scaling up and down my Azure Analysis Service in logic app with the following ID
Subscription ID: ID3
In logic app I have the following request:
{
"uri": "https://management.azure.com/subscriptions/**ID3**/resourceGroups/ServerName/providers/Microsoft.AnalysisServices/servers/Model?api-version=2017-08-01",
"method": "PATCH",
"authentication": {
"tenant": "ID2",
"audience": "https://management.core.windows.net",
"clientId": "ID1",
"secret": "*sanitized*",
"type": "ActiveDirectoryOAuth"
},
"body": {
"sku": {
"capacity": 1,
"name": "S4",
"tier": "Standard"
},
"tags": {
"testKey": "testValue"
}
}
}
After sending this request I get the following error:
{
"statusCode": 403,
"headers": {
"Pragma": "no-cache",
"x-ms-failure-cause": "gateway",
"x-ms-request-id": "xxxxxx-4dea-xxx-xxxx-xxx",
"x-ms-correlation-request-id": "xxxxxxxx-4dea-xxxx-xxxx-5dea12ba0cca",
"x-ms-routing-request-id": "WESTEUROPE:20190211T181536Z:xxxxxx-4dea-4fa8-bccd-xxxxxx",
"Strict-Transport-Security": "max-age=31536000; includeSubDomains",
"X-Content-Type-Options": "nosniff",
"Connection": "close",
"Cache-Control": "no-cache",
"Date": "Mon, 11 Feb 2019 18:15:35 GMT",
"Content-Length": "413",
"Content-Type": "application/json; charset=utf-8",
"Expires": "-1"
},
"body": {
"error": {
"code": "AuthorizationFailed",
"message": "Client \"ID4\" with the object ID \"ID4\" has no permission to run the action \"Microsoft.AnalysisServices/servers/write\" over \"/subscriptions/ID3/resourceGroups/ServerName/providers/Microsoft.AnalysisServices/servers/ModelName\"."
}
}
}
what should I do more to solve this problem?
UPDATE
I have granted my service principal (which represents Azure AD application) the following specific permissions over my Analysis Services instance:
I have also control it in management studio as described here and I can see the serviceprincipal also there:
But I get still the same error message
Is the ID4, the object ID of my logic app? should I add my logic app also in IAM of my Analysis Service?

Answer 1

You should grant your service principal (which represents Azure AD application) those specific permissions: Microsoft.AnalysisServices/servers/write over your Analysis Services instance: /subscriptions/ID3/resourceGroups/ServerName/providers/Microsoft.AnalysisServices/servers/ModelName. Alternatively, you can grant those permissions on the resource group level, or subscription level.
Here's how you do it: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal.
In short: go to the resource, click IAM on the left, click + Add Role Assignment on the top of the blade and pick your role\identity. This particular permissions falls under something like Analysis Services contributor.
ps. you can always create a custom role to follow least privilege principle: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles