Azure / Azure/azure-cli

Support `EntitlementManagement` for user accounts (missing scopes)

Open
#32,733 5 comments 0 reactions 0 assignees View on GitHub
act-identity-squad customer-reported Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Related command**

Wasn't able to find an azure cli command although there is powershell: https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package-create-app

**Is your feature request related to a problem? Please describe.**

I cannot use an access token from Azure CLI to create / manage access packages

**Describe the solution you'd like**

Add `EntitlementManagement.ReadWrite.All` to the Azure CLI application

**Describe alternatives you've considered**

From what I can tell there is no way to make this work with Azure CLI currently. You have to use a different tool and then not rely on Azure CLI authentication.

There is a workaround with terraform to create an app registration and then authenticate to it using environment variables and not logging into it with the Azure CLI

**Additional context**

I have access to the catalogs / access packages but cannot use Azure CLI authentication to read them etc.
Terraform is used to create them but I can no longer use e.g. `terraform plan` locally using my own Azure CLI credentials

Related issues:
- https://github.com/Azure/azure-cli/issues/30149
- https://github.com/hashicorp/terraform-provider-azuread/issues/1818
- https://github.com/hashicorp/terraform-provider-azuread/issues/1069
- https://github.com/hashicorp/terraform-provider-azuread/issues/1169

Error messages I get in terraform when running with my Azure CLI auth:

```
│ Error: Listing access package catalogs with filter displayName eq 'ACD Subscription Access Packages'

│ with data.azuread_access_package_catalog.pim_subscription_catalog,
│ on data.tf line 90, in data "azuread_access_package_catalog" "pim_subscription_catalog":
│ 90: data "azuread_access_package_catalog" "pim_subscription_catalog" {

│ unexpected status 403 (403 Forbidden) with error: UnAuthorized: User is not
│ authorized to perform the operation. Reason: The caller is not authorized.


│ Error: No role found matching specified filter: displayName eq 'Catalog owner'

│ with data.azuread_access_package_catalog_role.owner_role,
│ on data.tf line 95, in data "azuread_access_package_catalog_role" "owner_role":
│ 95: display_name = "Catalog owner"

│ unexpected status 403 (403 Forbidden) with error: UnAuthorized: User is not
│ authorized to perform the operation. Reason: The caller is not authorized.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.