{"id":5794,"date":"2021-10-03T11:32:25","date_gmt":"2021-10-03T10:32:25","guid":{"rendered":"https:\/\/rakhesh.com\/?p=5794"},"modified":"2021-10-03T11:38:37","modified_gmt":"2021-10-03T10:38:37","slug":"delegating-app-registration-admin-consent-permissions-in-azure-ad","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/azure\/delegating-app-registration-admin-consent-permissions-in-azure-ad\/","title":{"rendered":"Delegating App Registration Admin Consent permissions in Azure AD"},"content":{"rendered":"

Was trying to find out if there’s a way of letting others in our firm create App Registrations and add permissions to them, but limit what permissions they can admin consent to. You know, maybe allow them to admin consent delegated permissions but not application permissions. Or even allow application permissions but not certain type of application permissions. Typically you need to be either a Global Admin or a Privileged Role Admin<\/a> to be able to do this, and that gives out a lot more permissions than needed.<\/p>\n

Looks like the ability to do this was released about a year ago<\/a>. What you need to do is:<\/p>\n

    \n
  1. Create app consent policies as detailed in this link <\/a>(this is what defines what consents someone can do), and<\/li>\n
  2. Add these consent policies to custom roles that you create as detailed in this link<\/a> (this is what applies the app consent policies to users & groups who have that custom role).<\/li>\n<\/ol>\n

    All of this needs to be done via PowerShell, and some of these even require the AzureADPreview<\/code> module (even though it’s been a year since release of this feature).<\/p>\n

    So let’s get cracking!<\/p>\n

    First, install\/ enable the preview module and connect to AzureAD.<\/p>\n

    Remove-Module AzureAD -ErrorAction SilentlyContinue\r\nImport-Module AzureADPreview\r\nConnect-AzureAD<\/pre>\n
    After that, if you want to see the existing app consent policies you can do so with the following cmdlet:<\/p>\n
    Get-AzureADMSPermissionGrantPolicy | ft Id, DisplayName, Description<\/pre>\n
    Here’s what the default output looks like:<\/p>\n
    \"\"<\/p>\n
    Creating a new app consent policy<\/h3>\n
    Creating a new app consent policy is via the New-AzureADMSPermissionGrantPolicy<\/code> cmdlet to create a policy and then the New-AzureADMSPermissionGrantConditionSet<\/code> to add permissions to that policy.<\/p>\n
    Let’s make an app consent policy that allows consent to delegated permissions only. This one’s very simple:<\/p>\n
    New-AzureADMSPermissionGrantPolicy `\r\n    -Id \"mytenant-all-delegated-permissions\" `\r\n    -DisplayName \"All delegated permissions, for any client app\" `\r\n    -Description \"Permissions consentable by Application Administrators (Level 1)\"\r\n\r\nNew-AzureADMSPermissionGrantConditionSet `\r\n    -PolicyId \"mytenant-all-delegated-permissions\" `\r\n    -ConditionSetType \"includes\" `\r\n    -PermissionType \"delegated\"<\/pre>\n
    \"\"<\/p>\n
    Note the Id (mytenant-all-delegated-permissions<\/code>). We need it later.<\/p>\n
    Let’s also make an app consent policy that allows consent to any application permissions; but not a few critical ones<\/em>. For example: I don’t want someone to be able to consent to an application permission that lets them modify roles… that would be silly after all as anyone who can do this consent will be able to escalate themselves to the Global Admin role for instance. :)<\/p>\n
    The official document<\/a> has an example like the one below where they exclude certain delegated permissions:<\/p>\n
    New-AzureADMSPermissionGrantConditionSet -PolicyId \"test1\" -ConditionSetType \"excludes\" -PermissionType \"delegated\" -Permissions @(\"8b590330-0eb2-45d0-baca-a00ecf7e7b87\", \"dac1c8fa-e6e4-47b8-a128-599660b8cd5c\", \"f6db0cc3-88cd-4c74-a374-3d8c7cc4c50b\") -ResourceApplication \"ec8d61c9-1cb2-4edb-afb0-bcda85645555\" -PermissionClassification \"low\" -ClientApplicationsFromVerifiedPublisherOnly $true -ClientApplicationIds @(\"4a6c40ea-edc1-4202-8620-dd4060ee6583\", \"17a961bd-e743-4e6f-8097-d7e6612999a7\") -ClientApplicationTenantIds @(\"17a961bd-e743-4e6f-8097-d7e6612999a8\", \"17a961bd-e743-4e6f-8097-d7e6612999a9\", \"17a961bd-e743-4e6f-8097-d7e6612999a0\") -ClientApplicationPublisherIds @(\"verifiedpublishermpnid\")\r\n\r\n\t\t\tId                                          : 0f81cce0-a766-4db6-a7e2-4e5f10f6abf8\r\n\t\t\tPermissionType                              : delegated\r\n\t\t\tPermissionClassification                    : low\r\n\t\t\tResourceApplication                         : ec8d61c9-1cb2-4edb-afb0-bcda85645555\r\n\t\t\tPermissions                                 : {8b590330-0eb2-45d0-baca-a00ecf7e7b87, dac1c8fa-e6e4-47b8-a128-599660b8cd5c, \r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t  f6db0cc3-88cd-4c74-a374-3d8c7cc4c50b}\r\n\t\t\tClientApplicationIds                        : {4a6c40ea-edc1-4202-8620-dd4060ee6583, 17a961bd-e743-4e6f-8097-d7e6612999a7}\r\n\t\t\tClientApplicationTenantIds                  : {17a961bd-e743-4e6f-8097-d7e6612999a8, 17a961bd-e743-4e6f-8097-d7e6612999a9, 17a961bd-e743-4e6f-8097-d7e6612999a0}\r\n\t\t\tClientApplicationPublisherIds               : {verifiedpublishermpnid}\r\n\t\t\tClientApplicationsFromVerifiedPublisherOnly : True<\/pre>\n
    How do you get those permission ids though? The document simply says -Permissions<\/code> are “The identifier of the resource application to scope consent operation down to. It could be @(\"All\") or a list of permission ids.<\/code>” Not very helpful.<\/p>\n
    The app consent document<\/a> is slightly more helpful.<\/p>\n
    \"\"<\/p>\n
    Hmm, so it’s in the ServicePrincipal object of the API. I am interested in the Graph API so lets dig into that.<\/p>\n
    First I’ll search for the ServicePrincipal object and filter to any with the words “Graph” in it:<\/p>\n
    Get-AzureADServicePrincipal -All $true | ?{ $_.DisplayName -match \"Graph\" }\r\n\r\nObjectId                             AppId                                DisplayName\r\n--------                             -----                                -----------\r\n2362f192-9721-4089-b2c9-6acf3e9ce553 d88a361a-d488-4271-a13f-a83df7dd99c2 IDML Graph Resolver Service and CAD\r\n2f4d6758-e00b-4037-a933-8b5224f00489 765fe668-04e7-42ba-aec0-2c96f1d8b652 Exchange Office Graph Client for AAD - Noninteractive\r\n327ba63b-334e-4004-bb30-20a607de4098 00000003-0000-0000-c000-000000000000 Microsoft Graph\r\n57943d81-ce4c-4a80-ae3f-56ce03c6a8fd 6da466b6-1d13-4a2c-97bd-51a99e8d4d74 Exchange Office Graph Client for AAD - Interactive\r\n68420e79-2754-4dbd-9819-7049a2820601 4bfd5d66-9285-44a1-bb14-14953e8cdf5e Audit GraphAPI Application\r\n895b3d4b-d0b6-4102-8e01-d19ad243a7df 0bf30f3b-4a52-48df-9a82-234910c4a086 Microsoft Graph Change Tracking\r\n9479fa7c-c94a-4c73-8599-92b762ac0029 ab3be6b7-f5df-413d-ac2d-abf1e3fd9c0b Microsoft Teams Graph Service\r\n9b00ad24-77e1-4d53-be39-19e1bf08aa0d ba23cd2a-306c-48f2-9d62-d3ecd372dfe4 OfficeGraph\r\nbea6ee98-3321-47f5-aff4-4f4844c68c35 56c1da01-2129-48f7-9355-af6d59d42766 Graph Connector Service\r\n<\/pre>\n
    I think Microsoft Graph<\/code> is what I am looking for? Let’s expand that:<\/p>\n
    Get-AzureADServicePrincipal -ObjectId 327ba63b-334e-4004-bb30-20a607de4098 | fl *\r\n\r\n\r\nDeletionTimestamp                  :\r\nObjectId                           : 327ba63b-334e-4004-bb30-20a607de4098\r\nObjectType                         : ServicePrincipal\r\nAccountEnabled                     : true\r\nAddIns                             : {}\r\nAlternativeNames                   : {}\r\nAppDisplayName                     : Microsoft Graph\r\nAppId                              : 00000003-0000-0000-c000-000000000000\r\nAppOwnerTenantId                   : f8cdef31-a31e-4b4a-93e4-5f571e91255a\r\nAppRoleAssignmentRequired          : False\r\nAppRoles                           : {class AppRole {\r\n                                       AllowedMemberTypes: System.Collections.Generic.List`1[System.String]\r\n                                       Description: Allows the app to read online meeting artifacts in your organization, without a signed-in user.\r\n                                       DisplayName: Read online meeting artifacts\r\n                                       Id: df01ed3b-eb61-4eca-9965-6b3d789751b2\r\n                                       IsEnabled: True\r\n                                       Value: OnlineMeetingArtifact.Read.All\r\n                                     }\r\n                                     , class AppRole {\r\n... <snip> ...\r\n                                     , class AppRole {\r\n                                       AllowedMemberTypes: System.Collections.Generic.List`1[System.String]\r\n                                       Description: Allows the app to manage workforce integrations to synchronize data from Microsoft Teams Shifts, without a signed-in user.\r\n                                       DisplayName: Read and write workforce integrations\r\n                                       Id: 202bf709-e8e6-478e-bcfd-5d63c50b68e3\r\n                                       IsEnabled: True\r\n                                       Value: WorkforceIntegration.ReadWrite.All\r\n                                     }\r\n                                     ...}\r\nDisplayName                        : Microsoft Graph\r\nErrorUrl                           :\r\nHomepage                           :\r\nKeyCredentials                     : {}\r\nLogoutUrl                          :\r\nOauth2Permissions                  : {class OAuth2Permission {\r\n                                       AdminConsentDescription: Allows the app to read online meeting artifacts on behalf of the signed-in user.\r\n                                       AdminConsentDisplayName: Read user's online meeting artifacts\r\n                                       Id: 110e5abb-a10c-4b59-8b55-9b4daa4ef743\r\n                                       IsEnabled: True\r\n                                       Type: User\r\n                                       UserConsentDescription: Allows the app to read online meeting artifacts on your behalf.\r\n                                       UserConsentDisplayName: Read user's online meeting artifacts\r\n                                       Value: OnlineMeetingArtifact.Read.All\r\n                                     }\r\n                                     , class OAuth2Permission {\r\n                                       AdminConsentDescription: Allows the app to read and manage the active role-based access control (RBAC) assignments for your company's directory, on behalf of\r\n                                     the signed-in user. This includes managing active directory role membership, and reading directory role templates, directory roles and active memberships.\r\n                                       AdminConsentDisplayName: Read, update, and delete all active role assignments for your company's directory\r\n                                       Id: 8c026be3-8e26-4774-9372-8d5d6f21daff\r\n                                       IsEnabled: True\r\n                                       Type: Admin\r\n                                       UserConsentDescription: Allows the app to read and manage the active role-based access control (RBAC) assignments for your company's directory, on your\r\n                                     behalf. This includes managing active directory role membership, and reading directory role templates, directory roles and active memberships.\r\n                                       UserConsentDisplayName: Read, update, and delete all active role assignments for your company's directory\r\n                                       Value: RoleAssignmentSchedule.ReadWrite.Directory\r\n                                     }\r\n... <snip> ...\r\n                                     }\r\n                                     ...}\r\nPasswordCredentials                : {}\r\nPreferredTokenSigningKeyThumbprint :\r\nPublisherName                      : Microsoft Services\r\nReplyUrls                          : {}\r\nSamlMetadataUrl                    :\r\nServicePrincipalNames              : {00000003-0000-0000-c000-000000000000\/ags.windows.net, 00000003-0000-0000-c000-000000000000, https:\/\/canary.graph.microsoft.com, https:\/\/graph.microsoft.com...}\r\nServicePrincipalType               : Application\r\nTags                               : {}<\/pre>\n
    Yup, jackpot! Let’s look at what AppRoles<\/code> are available as I am interested in application level permissions:<\/p>\n
    (Get-AzureADServicePrincipal -ObjectId 327ba63b-334e-4004-bb30-20a607de4098).AppRoles | ft Value,DisplayName,Id\r\n\r\nValue                                                   DisplayName                                                                    Id\r\n-----                                                   -----------                                                                    --\r\nOnlineMeetingArtifact.Read.All                          Read online meeting artifacts                                                  df01ed3b-eb61-4eca-9965-6b3d789751b2\r\nAppCatalog.ReadWrite.All                                Read and write to all app catalogs                                             dc149144-f292-421e-b185-5953f2e98d7f\r\nAppCatalog.Read.All                                     Read all app catalogs                                                          e12dae10-5a57-4817-b79d-dfbec5348930\r\nWorkforceIntegration.ReadWrite.All                      Read and write workforce integrations                                          202bf709-e8e6-478e-bcfd-5d63c50b68e3\r\nPresence.ReadWrite.All                                  Read and write presence information for all users                              83cded22-8297-4ff6-a7fa-e97e9545a259\r\nTeamworkTag.ReadWrite.All                               Read and write tags in Teams                                                   a3371ca5-911d-46d6-901c-42c8c7a937d8\r\nTeamworkTag.Read.All                                    Read tags in Teams                                                             b74fd6c4-4bde-488e-9695-eeb100e4907f\r\nWindowsUpdates.ReadWrite.All                            Read and write all Windows update deployment settings                          7dd1be58-6e76-4401-bf8d-31d1e8180d5b\r\nExternalConnection.ReadWrite.OwnedBy                    Read and write external connections                                            f431331c-49a6-499f-be1c-62af19c34a9d<\/pre>\n
    Best to put them into a CSV so I can easily read in Excel:<\/p>\n
    (Get-AzureADServicePrincipal -ObjectId 327ba63b-334e-4004-bb30-20a607de4098).AppRoles | select Description,DisplayName,Value,Id | Export-Csv -NoTypeInformation appPermissions.csv<\/pre>\n
    Here’s a few I want to exclude (highlighted):<\/p>\n
    \"\"<\/p>\n
    I know the -Permissions<\/code> parameter expects an array of the Ids so let’s create that. I put all the Ids I want to exclude into a text file (called excludedIds.txt<\/code> in the snippet below). Then I read them into an array:<\/p>\n
    $excludedIds = Get-Content .\\excludedIds.txt<\/pre>\n
    Then I create the app consent policy. I learnt a bunch of things through trial and error here so I’ll summarize them below:<\/p>\n