You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I need to use Microsoft Graph API in my Azure App Service to manage accounts in Azure AD B2C tenant. So far I've been using traditional service principal (App Registration) in my AD B2C tenant. I had my Graph API permissions configured and I was using clientId and secret to get access token. All working fine.
Now I want to move to Managed Identity (MSI) for authentication. I've read a few articles which describe how to configure MSI to access Microsoft Graph API - this is possible at least with Powershell Azure AD or Microsoft Graph modules. My script looks more or the less like this:
$tenantId = "xxx" # This is my Azure AD B2C tenant id
$msiObjectId = "yyy" # Object ID of my Managed Identity
$graphAppId = "00000003-0000-0000-c000-000000000000" # Well-known Graph API app ID
Connect-Graph -Scopes "User.ReadWrite.All","Directory.ReadWrite.All" -TenantId $tenantId
$graph = Get-MgServicePrincipal | Where-Object { $_.AppId -eq $graphAppId }
$permission = $graph.AppRoles | Where-Object Value -Like "User.ReadWrite.All"
New-MgServicePrincipalAppRoleAssignment -AppRoleId $permission.Id -ServicePrincipalId $msiObjectId -ResourceId $graph.Id
I think this would work fine if we want to set up Graph API access to normal Azure AD tenant to which MSI also belongs. However in my scenario I'm getting the following error: Resource 'xxx' does not exist or one of its queried reference-property objects are not present.
where 'xxx' is my Managed Identity object id. This error actually makes sense - my MSI exists in my normal Azure AD where I have my Azure subscription and all Azure resources, while I'm trying to give access to use Graph API in a different (B2C) tenant.
Is my scenario actually possible to achieve at all with Azure AD B2C? Is there a way to somehow register my MSI also in B2C so that I can set up proper appRole for Graph API correctly? AB#7433
The text was updated successfully, but these errors were encountered:
Uh oh!
There was an error while loading. Please reload this page.
I need to use Microsoft Graph API in my Azure App Service to manage accounts in Azure AD B2C tenant. So far I've been using traditional service principal (App Registration) in my AD B2C tenant. I had my Graph API permissions configured and I was using clientId and secret to get access token. All working fine.
Now I want to move to Managed Identity (MSI) for authentication. I've read a few articles which describe how to configure MSI to access Microsoft Graph API - this is possible at least with Powershell Azure AD or Microsoft Graph modules. My script looks more or the less like this:
I think this would work fine if we want to set up Graph API access to normal Azure AD tenant to which MSI also belongs. However in my scenario I'm getting the following error:
Resource 'xxx' does not exist or one of its queried reference-property objects are not present.
where 'xxx' is my Managed Identity object id. This error actually makes sense - my MSI exists in my normal Azure AD where I have my Azure subscription and all Azure resources, while I'm trying to give access to use Graph API in a different (B2C) tenant.
Is my scenario actually possible to achieve at all with Azure AD B2C? Is there a way to somehow register my MSI also in B2C so that I can set up proper appRole for Graph API correctly?
AB#7433
The text was updated successfully, but these errors were encountered: