Azure / Azure/azure-cli

`az ad app owner add` appears to rely on deprecated `graph.windows.net`

Open
#20,066 5 comments 2 reactions 1 assignee Claimed by @jiasli View on GitHub
act-identity-squad customer-reported feature-request Graph
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

We've been struggling to get a Service Principal, which is an Owner on an App Registration, to add other Owners to that App Registration.

The Service Principal has an admin-consented AppRoleAssignment to Microsoft Graph's `Application.ReadWrite.OwnedBy`. However, when running `az ad app owner add` we were faced with an insufficient permissions error.

We have resolved that error by creating an admin-consented AppRoleAssignment to **Windows AAD Graph**'s `Application.ReadWrite.OwnedBy` too. We can't do that through the portal anymore, as that control is grey'd out because the [AAD Graph has been deprecated](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/update-your-applications-to-use-microsoft-authentication-library/ba-p/1257363) and goes out of support in June 2022.

This command seems to be quietly falling out of support. In the short term, could the documentation be updated to inform users that they will have to have Windows Graph permissions to make it work?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.