azurepowershellpermissions

how I can make an service principal as an App Registration Owner with azure portal or PowerShell?


so the background as follows:

for installation and deployment process we need to modify a customer created App Registration. but we get not the right Application.ReadWriteAll but we could get Application.ReadWrite.OwnedBy.

I know that if creating an Graph Api Call (excecuted with Postman) as shown below it worked, because Creator is automatically the Owner. .

 HTTP-Post Request:
https://graph.microsoft.com/v1.0/applications   
with body:
     {
      "displayName": "AppRegName"
    }

But I need to solution with standard tool like azure portal or powershell and I found no way to assign or remove a service principal as owner to an App Registration.

Is there a way to to do this with powershell?

The authentifiaction with an service principal i dont't know how I can do it?

I think after I can create an App Registration with
$appRegistration = New-AzADApplication -DisplayName "AppRegCreatebyPS" but I very unexperinced in using powershell. So how I can tell powershell to use the service principal authentitification for creating App Registrations?

A short extra question:

Can I remove later the owner role for the service principal and how can I do it?

Thanks for all Readers And I hope someone can give me a hint.


Solution

  • You can create App registration, Service Principal for App registration, Add application owner and remove application owner all from PowerShell AzureAD module.

    Command to install Azure AD module in PowerShell:

    Install-Module AzureAD
    

    You can use the below commands :

    #Connect to Azure AD 
    Connect-AzureAD
    
    #Create Azure AD app Registration
    $appRegistration = New-AzureADApplication -DisplayName "AppRegCreatebyPS"
    
    # Create A service Principal for the above app Registration
    New-AzureADServicePrincipal -AccountEnabled $true -AppId $appRegistration.AppId -AppRoleAssignmentRequired $true -DisplayName $appRegistration.DisplayName
    
    # get objectid for the service principal
    $serviceprincipal= Get-AzureADServicePrincipal -Filter "DisplayName eq 'AppRegCreatebyPS'"
    
    #Get the old app registration for whom you want set owner
    $oldappregistration = Get-AzureADApplication -Filter "DisplayName eq 'Postman'"
    
    #add service principal to the application owner of old app registration
    Add-AzureADApplicationOwner -ObjectId $oldappregistration.ObjectId -RefObjectId $serviceprincipal.ObjectId
    
    # verify the owner for the old app registration
    Get-AzureADApplicationOwner -ObjectId $oldappregistration.ObjectId
    
    #remove the owner for the old app registration
    Remove-AzureADApplicationOwner -ObjectId $oldappregistration.ObjectId -OwnerId $serviceprincipal.ObjectId
    

    enter image description here

    Reference:

    Cmdlts for Azure AD module reference