We are using VSTS/Azure DevOps to build and deploy our web services to Azure.
In the release step we use the Azure CLI build task to set up the environment for the web service. The build task uses a Service Connection to be authorized to do these actions.
The build task can create web services and deployment slots without issue, but when I try to instruct it to add a new reply url to the Azure AD application the web app uses to authenticate users, i see the following:
az ad app update --id 3e5a96e9-7311-4f92-869b-fbb5bbe8e41f --reply-urls http://mytestapp.azurewebsites.net
ERROR: Insufficient privileges to complete the operation.
The service connection used is an Azure RM service connection using a Service Principal. Is this correct? I'm guessing there is there a permission I need to set on the service principal, but which one?
Jayendran is correct. The user must be a member of Global Admin role in the directory because the Reply URL is added in the app registration.
You may also need to grant permissions to the app itself.
https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-v1-integrate-apps-with-azure-ad
If you're looking to follow the least privileges principle and not assign the highest possible privilege available (as per your comment), I see 3 possible options that could work for you -
Owner for only a specific application (and NOT the Owner/Global Administrator for entire Azure AD)
You can add the user as Owner for only the specific application, which they need to manage (in your case, change reply URL's for).
Pro: Obviously the good thing about this approach is that this user gets to manage the app registration for only this particular application and none of the others in your Azure AD.
How: Go to "App Registrations" in Azure AD and navigate to the specific application. Now click on "Settings" and select "Owners"
Application Administrator Role
This one is a little more generic and a higher privilege in comparison to single application owner, as it gives the user access to manage application registrations for all applications.
Pro: Role is specific to only managing application registrations. It helps in a scenario where all applications need to be managed by this user.
How: Go to "Users" in your Azure AD and then select the specific user. Now go to "Directory Role" and add "Application Administrator Role"
Application Developer Role
This one is very similar to option 2 i.e. "Application administrator". Difference being that "Application developer" gets permissions for only those applications which they are developing, so the registration was done by them.
Pro: Good for user that is about to create and manage registrations for multiple applications.
How: Very similar to option 2 above.
More information about all the available roles and granular permissions that are used by these roles in Microsoft Docs:
Available Roles
Related
I have a rather (hopefully) theoretical question regarding the secure usage of Service Pricipals in Azure (Enterprise Applications)
Introduction
we currently deploy our DevOps Code via Azure Service Principals.
AppRegistration/Enterprise App is created
Secret is generated
Permission (i.e. Contributor) to the Ressource Group is granted in Azure
Service Connection is made in Devops
everything works fine.
Assumption
By default the Service Principal (Enterprise Application) is not restricted to a specific user/group (Assignment Required => "no").
My assumption is now, that every user in the AAD-Tenant is able to login to the Enterprise Application as well.
I i.e. do this by using the "Graph Powershell API"-EnterpriseApp.
I can either use a Secret or use my User Credentials to access the Service Principal and its permissions
Security issue?
coming back to our DevOps configuration:
The Service Principal has Contributor Permission on the dedicated Resource Group
Assignment Required is set to no (default configuration)
if I (as a malicious user) have the Application ID, i could simply logon to the Service Principal and receive the Token.
Question:
With this token and my login to the App, do i also have the Contributor Permissions of the App and could now manipulate the whole Resource Group?
Since i'm not an Azure Developer - but only an Azure AD Admin - my knowledge regarding this is limited,
so i'm not able to test it.
Can someone maybe either provide code or prove that my assumptions are wrong or correct?!
Thanks
Yes, the SPN can manage the resources within the resource group if it has Contributor - it is no different than a normal (human) identity.
Consider if the SPN actually needs Contributor or if you can limit it with another role or even make a custom role.
Furthermore, monitor the sign-ins using the Azure AD sign-in logs:
https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-all-sign-ins
You can also use CanNotDelete resource lock, which means that the service principal cannot delete resource as it is only Contributor:
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json
You might want to look into the Conditional Access to strengthen your environment:
https://learn.microsoft.com/en-us/azure/active-directory/develop/workload-identities-overview
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/workload-identity
https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-create-azure-ad-roles-and-resource-roles-review
Take a look here:
https://infosecwriteups.com/a-lab-for-practicing-azure-service-principal-abuse-bd000e6c48eb
https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/disable-user-sign-in-portal
https://learn.microsoft.com/en-us/powershell/module/az.accounts/connect-azaccount?view=azps-9.3.0#example-3-connect-to-azure-using-a-service-principal-account
My assumption is now, that every user in the AAD-Tenant is able to login to the Enterprise Application as well.
No. They would need the client secret or the rights to generate a new one. Which requires that they are owners of the App Registration. In the App Registration on the Owners tab it says:
The users listed here can view and edit this application registration. Additionally, any user (may not be listed here) with administrative privileges to manage any application (e.g., Global Administrator, Cloud App Administrator etc.) can view and edit the application registrations.
My Azure account is under company's AD, and once i tried to create an App using Azure Devops, when trying to create New Service connection, this error pops up,
What permission do my account needs to perform this action ?
Thanks in advance.
You need the "Creator" permission:
Members of this role can create the service connection in the project. Contributors are added as members by default
Please find more information in the Microsoft documentation User permissions
Microsoft documentation for Manage service connections
The problem lies in not having privileges to create app registrations in the Azure Active Directory tenant. There are several roles that have permission for this operation. According to the docs it also depends on whether non-admin users can create app registrations.
Some Built-in roles that can be used are Application Administrator
Users in this role can create and manage all aspects of enterprise applications, application registrations, and application proxy settings. Note that users assigned to this role are not added as owners when creating new application registrations or enterprise applications.
or Application Developer
Users in this role can create application registrations when the "Users can register applications" setting is set to No. This role also grants permission to consent on one's own behalf when the "Users can consent to apps accessing company data on their behalf" setting is set to No. Users assigned to this role are added as owners when creating new application registrations.
Further to:
API Permission Issue while Azure App Registration
and
Why is "Application permissions" disabled in Azure AD's "Request API permissions"?
I cannot activate the Application Permissions button in the API permissions when I am trying to register an application in Active Directory. I have created the roles (several times) and ensured all of the properties are correct as described in both posts and in https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-app-registration - including that it the role is set for application, . I am using the default directory of my Azure account. I am the only member in my directory and am a member of global administrators.
Is there something else I am missing?
My end goal is simply to use the .Net SDK to manage the firewall on an application service using a client secret that can be distributed with an application.
Here is the manifest
Okay, so you want an app registration to manage an App Service through Azure Resource Management API as itself with client credentials flow?
In that case you don't need to assign any application permissions to your app.
You need to create the app, and then go to e.g. the App Service resource's Access Control (IAM) tab, and add the needed role to your app there.
The reason that the app permissions tab there is grey is because the Azure Service Management app registration (which you can't edit) does not define any app permissions.
When you define an app permission in the manifest, that becomes a permission that other applications could use to call your API, not Azure Resource Management API.
Is there something else I am missing?
The reason Applications Permissions is greyed out for you is because Azure Service Management API only allows Delegated Permissions i.e. this API will be always be executed in context of the signed-in user. In other words, a user (even if it is a Service Principal) must always be present when executing this API.
You mentioned that you wanted to execute Service Management API using a client secret. For that there are two things you would need to do:
As mentioned by #junnas, you will need to assign your application (which is a Service Principal) a proper Azure RBAC role on an Azure Subscription. Please see this link for more details: https://learn.microsoft.com/en-us/azure/role-based-access-control/overview.
You will need to acquire token for this Service Principal using client id and client secret. You can use ClientSecretCredential for that purpose.
I have a Azure For Student subscription through my university and I'm trying to work out how to deploy an Angular app to an Azure App Service using Azure Pipelines.
In my Release pipelines, in the step to deploy to an Azure App Service, I have to select a subscription. When I click Authorize I get the below error.
Seems I can't create a service connection because it requires access to Active Directory. I'm on my university's tenant so I don't have access to it.
Is there a way around this I can use Azure Pipelines if I don't have access to create accounts in Active Directory?
As the error explicityly says, There's no way to deploy this without being a Global Admin or Owner on the Azure Active Directory tenant.
Insufficient privileges to complete the operation.Ensure that the user
has permission to create an Azure Active Directory application.
This typically occurs when the system attempts to create an application in Azure AD on your behalf and this is a permission issue that may be due to the following causes:
The user has only guest permission in the directory
The user is not authorized to add applications in the directory
(1) If you only have guest permission in AAD ,please contact the admin to grant the minimum additional permissions to you. Let the admin to set Guest user permissions are limited to No.
(2) If you are the member of AAD, and just not be authorized to add applications in the directory. Go User settings, then change Users can register applications to Yes under App registrations section.
For details ,please refer to this troubleshoot document and similar ticket.
I created a Azure Active Directory via the Azure portal. Then, I registered an app in it. I can configure it, add permissions and the like via the azure portal. But the same app I created, I don't see on https://apps.dev.microsoft.com/
Shouldn't I be able to see and configure the app I made in AD at that portal, too?
The apps that appear in the Application Registration Portal are the ones where you are explicitly marked as an owner of the application. This is in contrast to the apps that appear in the Azure Portal which are all the applications registered in your tenant, independent of whether or not your are an owner.
If you are a normal user, and you create an application in the Azure Portal, you should see your application appear in a section called "Azure AD only applications"
Here is the owner information for "Email Scraper" from the Azure Portal.
However, if you are a Tenant Administrator and you create an application, you will not be marked as an owner of the application. Implicitly, Tenant Administrators are owners of all objects in the directory, and to reduce the object quota generated by admins, these explicit links are not created.
Here is an example of an app I created where I am the Tenant Administrator:
Therefore, you probably do not see your application in the App Registration Portal because you are not marked as an Owner of the application, probably because you are an Administrator who created the app, or you did not create the app to begin with. You can remedy this by simply adding yourself to the owner list in the Azure Portal.
Let me know if this helps!