so the background as follows:
for installation and deployment process we need to modify a customer created App Registration.
but we get not the right Application.ReadWriteAll
but we could get Application.ReadWrite.OwnedBy
.
I know that if creating an Graph Api Call (excecuted with Postman) as shown below it worked, because Creator is automatically the Owner. .
HTTP-Post Request:
https://graph.microsoft.com/v1.0/applications
with body:
{
"displayName": "AppRegName"
}
But I need to solution with standard tool like azure portal or powershell and I found no way to assign or remove a service principal as owner to an App Registration.
Is there a way to to do this with powershell?
The authentifiaction with an service principal i dont't know how I can do it?
I think after I can create an App Registration with
$appRegistration = New-AzADApplication -DisplayName "AppRegCreatebyPS"
but I very unexperinced in using powershell.
So how I can tell powershell to use the service principal authentitification for creating App Registrations?
A short extra question:
Can I remove later the owner role for the service principal and how can I do it?
Thanks for all Readers And I hope someone can give me a hint.
You can create App registration, Service Principal for App registration, Add application owner and remove application owner all from PowerShell AzureAD module.
Command to install Azure AD module in PowerShell:
Install-Module AzureAD
You can use the below commands :
#Connect to Azure AD
Connect-AzureAD
#Create Azure AD app Registration
$appRegistration = New-AzureADApplication -DisplayName "AppRegCreatebyPS"
# Create A service Principal for the above app Registration
New-AzureADServicePrincipal -AccountEnabled $true -AppId $appRegistration.AppId -AppRoleAssignmentRequired $true -DisplayName $appRegistration.DisplayName
# get objectid for the service principal
$serviceprincipal= Get-AzureADServicePrincipal -Filter "DisplayName eq 'AppRegCreatebyPS'"
#Get the old app registration for whom you want set owner
$oldappregistration = Get-AzureADApplication -Filter "DisplayName eq 'Postman'"
#add service principal to the application owner of old app registration
Add-AzureADApplicationOwner -ObjectId $oldappregistration.ObjectId -RefObjectId $serviceprincipal.ObjectId
# verify the owner for the old app registration
Get-AzureADApplicationOwner -ObjectId $oldappregistration.ObjectId
#remove the owner for the old app registration
Remove-AzureADApplicationOwner -ObjectId $oldappregistration.ObjectId -OwnerId $serviceprincipal.ObjectId
Reference: