Azure / Azure/azure-powershell
Get-AzADApplication -OwnedApplication only works when a User Principal is signed in
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
When I issue `Get-AzAdApplication -OwnedApplication` when I'm signed in as a Service Principal, I get the following error:
`/me request is only valid with delegated authentication flow.` This means it's not possible to for example use this command in a script that runs under a Managed Identity.
The reason this error occurs is because the cmdlet unconditionally uses the URI `https://graph.microsoft.com/v1.0/me/ownedObjects/$/Microsoft.Graph.Application`, which indeed will not work when a Service Principal is logged in.
Instead the cmdlet should use the account context to check whether a Service Principal is logged in, and if so the cmdlet should extract the appId from the context and use the URI `https://graph.microsoft.com/v1.0/servicePrincipals(appId='{appId}')/ownedObjects/microsoft.graph.application?$count=true` (with a header `ConsistencyLevel: eventual` to make it an [advanced query](https://learn.microsoft.com/en-us/graph/aad-advanced-queries?tabs=http)).
This will result in the same information provided by the `/me` URI, but will work for Service Principals.
### Issue script & Debug output
```PowerShell
PS C:\data> $DebugPreference='Continue'
PS C:\data> Get-AzAdApplication -OwnedApplication
DEBUG: [CmdletBeginProcessing]: Starting command
DEBUG: CmdletBeginProcessing:
DEBUG: CmdletProcessRecordStart:
DEBUG: Client side pagination is enabled for this cmdlet
DEBUG: CmdletGetPipeline:
DEBUG: CmdletBeforeAPICall:
DEBUG: URLCreated: /me/ownedObjects/$/Microsoft.Graph.Application
DEBUG: RequestCreated: /v1.0/me/ownedObjects/$/Microsoft.Graph.Application
DEBUG: HeaderParametersAdded:
DEBUG: ============================ HTTP REQUEST ============================
HTTP Method:
GET
Absolute Uri:
https://graph.microsoft.com/v1.0/me/ownedObjects/$/Microsoft.Graph.Application
Headers:
x-ms-unique-id : 3
x-ms-client-request-id : fa9a175f-0e1a-48b7-8459-f4757fc1bc64
CommandName : .
FullCommandName : Get-AzADUserOwnedApplication_List
ParameterSetName : __AllParameterSets
User-Agent : AzurePowershell/v9.7.1,PSVersion/v7.3.5,Az.MSGraph/6.6.1
Body:
DEBUG: BeforeCall:
DEBUG: ============================ HTTP RESPONSE ============================
Status Code:
BadRequest
Headers:
Transfer-Encoding : chunked
Strict-Transport-Security : max-age=31536000
request-id : 8c24e402-3482-411a-abba-c45412c4d870
client-request-id : 8c24e402-3482-411a-abba-c45412c4d870
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"West Europe","Slice":"E","Ring":"5","ScaleUnit":"000","RoleInstance":"AM1PEPF000105AC"}}
Date : Thu, 06 Jul 2023 09:33:24 GMT
Body:
{
"error": {
"code": "BadRequest",
"message": "/me request is only valid with delegated authentication flow.",
"innerError": {
"date": "2023-07-06T09:33:25",
"request-id": "8c24e402-3482-411a-abba-c45412c4d870",
"client-request-id": "8c24e402-3482-411a-abba-c45412c4d870"
}
}
}
DEBUG: ResponseCreated:
DEBUG: BeforeResponseDispatch:
Get-AzADUserOwnedApplication_List: C:\Users\oskamj\Documents\PowerShell\Modules\Az.Resources\6.6.1\MSGraph.Autorest\custom\Get-AzADApplication.ps1:206
Line |
206 | [System.Array]$apps = . Az.MSGraph.internal\Get-AzADUserO …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| /me request is only valid with delegated authentication flow.
DEBUG: [Finally]: Getting exception 'Microsoft.Azure.Commands.Common.Exceptions.AzPSCloudException: InternalException' from response
DEBUG: Finally:
DEBUG: CmdletAfterAPICall:
DEBUG: [CmdletProcessRecordAsyncEnd]: Finish HTTP process
DEBUG: CmdletProcessRecordAsyncEnd:
DEBUG: CmdletProcessRecordEnd:
DEBUG: AzureQoSEvent: Module: Az.Resources:6.6.1; CommandName: Get-AzADApplication; PSVersion: 7.3.5; IsSuccess: False; Duration: 00:00:00.0649827; Exception: InternalException;
PS C:\data>
```
### Environment data
```PowerShell
PS C:\data> $PSVersionTable
Name Value
---- -----
PSVersion 7.3.5
PSEdition Core
GitCommitId 7.3.5
OS Microsoft Windows 10.0.22621
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```
### Module versions
```PowerShell
PS C:\data> Get-Module Az*
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 2.12.4 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzConte…
Script 6.6.1 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, G…
```
### Error output
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.