microsoftgraph / microsoftgraph/msgraph-bicep-types

GDAP support

Open
#111 27 comments 1 reaction 1 assignee View on GitHub

@shenglol is already working on this.

Since May 23, 2024.

enhancement triaged
Dominant language
TypeScript
Stars
80
Forks
15
Avg merge
1h 21m
Merged PRs (30d)
3

Description

Is your feature request related to a problem? Please describe.
I would guess this is expected behavior that you cannot deploy Graph resources via GDAP. I will not explain what is GDAP in detail but in short in partner tenant and customer tenant. The partner tenant has group for example like AdminAgent. Via GDAP that group is given Entra access (for example User Administrator). In that group we have a user from the partner tenant. We also have service principal that can login to customer tenant by doing on behalf of that user so inherits its permissions on customer Entra tenant. This kind of login (via the service principal) works when we deploy Azure resources to the customer tenant. It also works if we do Graph operations via PowerShell. When we connect to the customer tenant with connect-azaccount we use -AccessToken property by providing access token that is valid. We also provide -GraphAccessToken but when I try to deploy Bicep template with Graph resources I get:

 |  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | 06:39:52 - Error: Code=InvalidTemplateDeployment; Message=The template
     | deployment 'azDeploy-240523063910-lz-ms-graph-test' is not valid
     | according to the validation procedure. The tracking id is
     | '30a48908-9bc7-4a24-bd7a-1dec585d5dab'. See inner errors for details. 
     | 06:39:52 - Error: Code=AuthenticationFailed; Message=Authentication
     | failed.  The deployment validation failed

As GDAP is common scenario for authenticating to customers by Cloud Solution Providers (CSPs) I think it is valid request that the Graph deployment supports it. Preferably should be possible with using the -GraphAccessToken -AccessToken parameters in connect-azaccount cmdlet.

Describe the solution you'd like
A clear and concise description of what you want to happen.

Additional context
Add any other context or screenshots about the feature request here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.