azure-active-directoryazure-cliaz

Add members to Azure Enterprise App through CLI

We have an enterprise application in our Azure AD tenant for provisioning users to another SaaS platform. Currently it is only setup with the option "Sync only assigned users and groups" since we do not want the whole directory brought over.

My question is simple, is there a way to use the az-cli (currently have version 2.0.60 installed) to add users to that enterprise application?

I checked out the:

I would expect there would be a simple role assignment command to run that adds a user by upn/objectId to the enterprise application.

Everyone in my team are using Mac's and we could use PowerShellCore if that has better support.

Thanks!

Solution

  • It seems you could not do that via Azure CLI, my workaround is to use powershell to do that.

    Everyone in my team are using Mac's and we could use PowerShellCore if that has better support.

    First, you need to install the AzureAD.Standard.Preview powershell module which supports powershell core, you can understand the module is an equivalent of AzureAD module in powershell core, they have the same usage, it is a preview version, for more details see this link.

    Then try the command New-AzureADUserAppRoleAssignment as below, this sample assigns a user to an application with default app role id.

    New-AzureADUserAppRoleAssignment -ObjectId "<user objectid>" -PrincipalId "<user objectid>" -ResourceId "<service principal objectid(i.e. Enterprise Application objectid)>" -Id ([Guid]::Empty)

    enter image description here

    Check in the portal:

    enter image description here

    If you want to assign a user to a specific app role within an application, try the command below.

    $username = "<You user's UPN>"
$app_name = "<Your App's display name>"
$app_role_name = "<App role display name>"

# Get the user to assign, and the service principal for the app to assign to
$user = Get-AzureADUser -ObjectId "$username"
$sp = Get-AzureADServicePrincipal -Filter "displayName eq '$app_name'"
$appRole = $sp.AppRoles | Where-Object { $_.DisplayName -eq $app_role_name }

#Assign the user to the app role
New-AzureADUserAppRoleAssignment -ObjectId $user.ObjectId -PrincipalId $user.ObjectId -ResourceId $sp.ObjectId -Id $appRole.Id