Azure / Azure/azure-powershell

Get-AzADApplication -OwnedApplication only works when a User Principal is signed in

Open
#22,264 2 comments 0 reactions 0 assignees View on GitHub
act-identity-squad customer-reported feature-request Graph
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

When I issue `Get-AzAdApplication -OwnedApplication` when I'm signed in as a Service Principal, I get the following error:
`/me request is only valid with delegated authentication flow.` This means it's not possible to for example use this command in a script that runs under a Managed Identity.

The reason this error occurs is because the cmdlet unconditionally uses the URI `https://graph.microsoft.com/v1.0/me/ownedObjects/$/Microsoft.Graph.Application`, which indeed will not work when a Service Principal is logged in.

Instead the cmdlet should use the account context to check whether a Service Principal is logged in, and if so the cmdlet should extract the appId from the context and use the URI `https://graph.microsoft.com/v1.0/servicePrincipals(appId='{appId}')/ownedObjects/microsoft.graph.application?$count=true` (with a header `ConsistencyLevel: eventual` to make it an [advanced query](https://learn.microsoft.com/en-us/graph/aad-advanced-queries?tabs=http)).

This will result in the same information provided by the `/me` URI, but will work for Service Principals.

### Issue script & Debug output

```PowerShell
PS C:\data> $DebugPreference='Continue'
PS C:\data> Get-AzAdApplication -OwnedApplication
DEBUG: [CmdletBeginProcessing]: Starting command
DEBUG: CmdletBeginProcessing:
DEBUG: CmdletProcessRecordStart:
DEBUG: Client side pagination is enabled for this cmdlet
DEBUG: CmdletGetPipeline:
DEBUG: CmdletBeforeAPICall:
DEBUG: URLCreated: /me/ownedObjects/$/Microsoft.Graph.Application
DEBUG: RequestCreated: /v1.0/me/ownedObjects/$/Microsoft.Graph.Application
DEBUG: HeaderParametersAdded:
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://graph.microsoft.com/v1.0/me/ownedObjects/$/Microsoft.Graph.Application

Headers:
x-ms-unique-id : 3
x-ms-client-request-id : fa9a175f-0e1a-48b7-8459-f4757fc1bc64
CommandName : .
FullCommandName : Get-AzADUserOwnedApplication_List
ParameterSetName : __AllParameterSets
User-Agent : AzurePowershell/v9.7.1,PSVersion/v7.3.5,Az.MSGraph/6.6.1

Body:

DEBUG: BeforeCall:
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Transfer-Encoding : chunked
Strict-Transport-Security : max-age=31536000
request-id : 8c24e402-3482-411a-abba-c45412c4d870
client-request-id : 8c24e402-3482-411a-abba-c45412c4d870
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"West Europe","Slice":"E","Ring":"5","ScaleUnit":"000","RoleInstance":"AM1PEPF000105AC"}}
Date : Thu, 06 Jul 2023 09:33:24 GMT

Body:
{
"error": {
"code": "BadRequest",
"message": "/me request is only valid with delegated authentication flow.",
"innerError": {
"date": "2023-07-06T09:33:25",
"request-id": "8c24e402-3482-411a-abba-c45412c4d870",
"client-request-id": "8c24e402-3482-411a-abba-c45412c4d870"
}
}
}

DEBUG: ResponseCreated:
DEBUG: BeforeResponseDispatch:
Get-AzADUserOwnedApplication_List: C:\Users\oskamj\Documents\PowerShell\Modules\Az.Resources\6.6.1\MSGraph.Autorest\custom\Get-AzADApplication.ps1:206
Line |
206 | [System.Array]$apps = . Az.MSGraph.internal\Get-AzADUserO …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| /me request is only valid with delegated authentication flow.
DEBUG: [Finally]: Getting exception 'Microsoft.Azure.Commands.Common.Exceptions.AzPSCloudException: InternalException' from response
DEBUG: Finally:
DEBUG: CmdletAfterAPICall:
DEBUG: [CmdletProcessRecordAsyncEnd]: Finish HTTP process
DEBUG: CmdletProcessRecordAsyncEnd:
DEBUG: CmdletProcessRecordEnd:
DEBUG: AzureQoSEvent: Module: Az.Resources:6.6.1; CommandName: Get-AzADApplication; PSVersion: 7.3.5; IsSuccess: False; Duration: 00:00:00.0649827; Exception: InternalException;
PS C:\data>
```

### Environment data

```PowerShell
PS C:\data> $PSVersionTable

Name Value
---- -----
PSVersion 7.3.5
PSEdition Core
GitCommitId 7.3.5
OS Microsoft Windows 10.0.22621
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
PS C:\data> Get-Module Az*

ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 2.12.4 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzConte…
Script 6.6.1 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, G…
```

### Error output

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.