Azure / Azure/azure-cli

[Feature Request] Provide native commands for `appRoleAssignment` API

Open
#22,768 3 comments 1 reaction 1 assignee Claimed by @jiasli View on GitHub
act-identity-squad Auto-Assign Feature Candidate feature-request Graph
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Related command**
`az ad app permission admin-consent`

**Is your feature request related to a problem? Please describe.**
Currently `az ad app permission admin-consent` uses "internal, deprecated, and unsupported" API at https://main.iam.ad.ext.azure.com/ to grand admin consent:

https://github.com/Azure/azure-cli/blob/710c821b2920df504ae037e7b05763193b051a30/src/azure-cli/azure/cli/command_modules/role/custom.py#L928-L938

This API doesn't work on clouds other than `AzureCloud`, such as `AzureChinaCloud`, dogfood or Azure Stack.

Even though Graph team is working on an equivalent API on Microsoft Graph API, there is no ETA.

The alternative supported way is to utilize [`appRoleAssignment`](https://learn.microsoft.com/en-us/graph/api/resources/approleassignment?view=graph-rest-1.0) API to grant application permissions, even though there is still some feature gap between `appRoleAssignment` API and the old API.

Examples for using `az rest` to call `appRoleAssignment` API was previously given in https://github.com/Azure/azure-cli/issues/12137#issuecomment-596567479.

Still, it will be better if we can have native commands for `appRoleAssignment` API.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.