Azure / Azure/azure-cli

Fetch an access token using `az account get-access-token` for resource-A using resource-B with a scope for resource-A in its list of configured permissions?

Open
#29,071 1 comment 0 reactions 2 assignees Claimed by @jiasli View on GitHub
act-identity-squad ARM Auto-Assign Azure CLI Team customer-reported question
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Related command**
`az account get-access-token ...`

**Is your feature request related to a problem? Please describe.**
After having preauthorized the Azure CLI for an application object (resource), I often use the following command to fetch a token for the resource for the preauthorized scope(s), e.g. `user_impersonation`:

`az account get-access-token --resource api://779d25c3-6c74-4875-b5ae-ef9b5a04b1e8`

**Describe the solution you'd like**
Now consider the case, where I have configured the resource with permissions for e.g. MS Graph `User.Read`.

In that case, I would like to use Azure CLI to fetch a token for MS Graph, with `User.Read` scope, using the resource, like I would normally do using the authorization code grant flow: sign-in to the resource and specify a scope of `User.Read`, resulting in a token for MS Graph with `User.Read` scope.

**Describe alternatives you've considered**
Currently, I need to use, e.g. Postman, to fetch a token for MS Graph using the resource in the authorization code grant flow.

**Additional context**
None

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.