azure-active-directoryazure-app-registration

Updating App Registration's Configured permission without overwritten existing values

I'm trying to update the "Configured permissions" of a given App Registration (Target App), with a permission offered by another App Registration (Source App). Source App exposes an API using user_impersonation. In fact, I have several Source Apps exposing APIs, which are added in Target App's Configured permissions.

Everything goes fine when updating Target App's Configured permissions through Azure portal. It means that already added permissions remain, and Source App's exposed permission is added. However, if I try to use Graph API, Target App's Configured permissions is updated so that only Source App's exposed permission remains. Previously existing permissions are moved to "Other permissions granted for <MY_TENANT_NAME>".

To restore the previous state, I have to add again all previously existing permissions.

This is how I'm updating Target App's Configured permissions using Graph API:

$ curl --silent -X PATCH -H "Authorization: Bearer ${TOKEN}" -H "Content-Type:application/json" \
-d '{"requiredResourceAccess":[{"resourceAppId":"<SOURCE_APP_CLIENT_ID>","resourceAccess":[{"id":"<SCOPE_ID_USER_IMPERSONATION>","type": "Scope"}]}]}' \
https://graph.microsoft.com/v1.0/applications/<TARGET_APP_OBJECT_ID>

According to this link, the call above is fine.

Any suggestions on how to do the update so that Target App's Configured permission is not overwritten?

Solution

  • When using the Microsoft Graph API to update the requiredResourceAccess property, the PATCH request replaces the existing permissions with the new ones, moving the previous permissions to "Other permissions granted for <TENANT_NAME>."

    I have one TargetApp app registration with below permissions added under Configured permissions:

    enter image description here

    In SourceApp application, I exposed an API scope named user_impersonation as below:

    enter image description here

    To achieve your scenario via Graph API, you need to retrieve the current permissions, append the new ones, and then run PATCH request with the combined list.

    In my case, I used below bash script with curl requests to update app registration's configured permissions without overwriting existing permissions:

    currentPermissions=$(curl --silent -X GET -H "Authorization: Bearer ${TOKEN}" \
https://graph.microsoft.com/v1.0/applications/${TARGET_APP_OBJECT_ID} | jq '.requiredResourceAccess')

newPermission=$(jq -n \
--arg resourceAppId "${SOURCE_APP_CLIENT_ID}" \
--arg scopeId "${SCOPE_ID_USER_IMPERSONATION}" \
'{
  resourceAppId: $resourceAppId,
  resourceAccess: [{
    id: $scopeId,
    type: "Scope"
  }]
}')

updatedPermissions=$(echo "${currentPermissions}" | jq --argjson newPermission "${newPermission}" '. + [$newPermission] | unique_by(.resourceAppId)')

curl --silent -X PATCH -H "Authorization: Bearer ${TOKEN}" -H "Content-Type: application/json" \
-d '{"requiredResourceAccess":'"${updatedPermissions}"'}' \
https://graph.microsoft.com/v1.0/applications/${TARGET_APP_OBJECT_ID}

echo "Permission added successfully."

    Response:

    enter image description here

    To confirm that, I checked the same in Portal where SourceApp permission added successfully without overwriting existing permissions:

    enter image description here