Azure / Azure/azure-cli

Azure CLI app cannot be found in app registrations nor enterprise apps

Open
#28,628 10 comments 5 reactions 1 assignee Assigned to @isra-fel View on GitHub
act-identity-squad ARM Auto-Assign Azure CLI Team customer-reported feature-request
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 22h
Merged PRs (30d)
64

Description

**Related command**

```sh
az account get-access-token --output json --resource "https://graph.microsoft.com"
```

**Is your feature request related to a problem? Please describe.**

I see a strange behaviour by following these steps:
1. Sign into the tenant via Azure CLI
2. Request an access token for the Microsoft Graph API via the Azure CLI: `az account get-access-token --output json --resource "https://graph.microsoft.com"`
3. The token generation is successful and can be decoded in https://jwt.ms/
4. The app ID (`appid` claim) for the Azure CLI that is present in the token cannot be found in Entra ID for that tenant (not in app registrations nor in entreprise apps)

**Describe the solution you'd like**

From my understanding, the Azure CLI is an Entra ID app that relies on a standard approach to interact with exposed APIs on behalf of users.

Additional permissions cannot be granted via the Portal and this leads to problems with other Microsoft solutions, such as the Graph SDK using Azure CLI credentials. Such SDKs might need additional permissions (for example, `Mail.Send` for the Graph API), however it doesn't seem the delegated permission can be granted to the Azure CLI.

Is this just an issue with the Azure Portal, or is this scenario not possible at all?

**Describe alternatives you've considered**

A separate app registration can be created with delegated permissions, but this defeats the purpose of the Azure CLI credential.

**Additional context**

For ease of understanding and following the trail of thought, here is the [associated issue in the Microsoft Graph SDK repo](https://github.com/microsoftgraph/msgraph-sdk-java/issues/1900).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.