Identifier (Entity ID) is not provisioned correctly ... | microsoftgraph/msgraph-bicep-types

Bicep version
Bicep CLI version 0.34.1 (2e7bb7d0e9)

Resource and API version
Microsoft.Graph/servicePrincipals@v1.0

Auth flow
Executed using a bash shell script wrapper calling the az deployment group command

Deployment details
Deployment reports a successful completion.

Describe the bug
After provisioning an Application and the associated Service Principal as a SAML provider using a bicep template, the Identifier / Entity ID appears to be provisioned, both in the console and via the CLI output. However, the Test this application button in the Microsoft Entra admin center returns an error and my SAML application integration does not work.

Performing the same task with the same parameters via the Microsoft Entra admin center (GUI) works successfully.

The error received is:

AADSTS650056: Misconfigured application...

The root cause analyser declares:

Root cause: Identifier (EntityID) mismatch or missing. is not the correct identifier (EntityID) for this application.
It appears as if the Identifier is empty as there should be a value preceeding the 'is not the correct identifer. However downloading the SAML requset shows the Issuer field is present.

Under SAML-based Sign-on > Basic SAML Configuration the Identifier (Entity ID) parameter is visible and defined. However, when clicking Edit the parameter is empty and I receive the message Please enter a valid URL. If your URL has query parameters, ensure that there is a slash preceding the question mark (i.e. /?)

I then paste the same value as I'd defined in the template (and is visible in the GUI on the previous step) and save it, which completes successfully.

Running the test again genereates a different error:

Root cause: Identifier (EntityID) mismatch or missing. <my defined identifier> is not the correct identifier (EntityID) for this application.

If I use the Microsoft Entra admin center to manually create the service principal, copying and pasting the same settings that I defined in my bicep template it results in the test working correctly.

Furthermore, my application will integrate succesfully with the application created via the Microsoft Entra admin center, but not with the application created via the bicep template.

Running a diff between what is created via the bicep template files and the portal doesn't show anything obviously different that shouldn't be different/unique.

This leads me to believe that the bicep template is not correctly provisioning the Identifier (Entity ID)

I would expect the bicep template provisioning method to result in a working SAML integration, in the same manner that provisioning via the Microsoft Entra admin center does.

To Reproduce
Create Application and Service Principal using my script below:

Replace <my tenant ID> and <my application name> with your own values.

Log in to the Microsoft Entra admin center. Navigate to Enterprise Application, Single sign-on. click Test this application.

Observe the error returned and compare it with the value declared in the bicep script and visible in the Identifier (Entity ID) field

bicep script


extension microsoftGraphV1

/* TEMPLATE DESCRIPTION
Create an App registration in Microsoft Entra and the associated Enterprise Application (Service Principal) to enable sign-in to <my application name> with Microsoft 365 credentials.
*/

// other parameters defined in /environments/<env-name>.bicep

param oauth2PermissionScopesRoleID string = newGuid()
param userRoleID string = newGuid()
param misamRoleID string = newGuid()

// defined in <my application name>.<env>.bicepparam template file
param identifierUris string
param logoutUrl string
param redirectUri string
param displayName string
param uniqueName string

resource resourceApp 'Microsoft.Graph/applications@v1.0' = {
  api: {
    oauth2PermissionScopes: [
      {
        adminConsentDescription: 'Allow the application to access <my application name> on behalf of the signed-in user.'
        adminConsentDisplayName: '<my application name> Application'
        id: oauth2PermissionScopesRoleID
        isEnabled: true
        type: 'User'
        userConsentDescription: 'Allow the application to access <my application name> on your behalf.'
        userConsentDisplayName: '<my application name> Application'
        value: 'user_impersonation'
      }
    ]
  }
  appRoles: [
    {
      allowedMemberTypes: [
        'User'
      ]
      description: 'msiam_access'
      displayName: 'msiam_access'
      id: misamRoleID
      isEnabled: true
    }
    {
      allowedMemberTypes: [
        'User'
      ]
      description: 'User'
      displayName: 'User'
      id: userRoleID
      isEnabled: true
    }
  ]
  defaultRedirectUri: redirectUri
  displayName: displayName
  groupMembershipClaims: 'ApplicationGroup'
  identifierUris: [
    identifierUris
  ]
  optionalClaims: {
    saml2Token: [
      {
        name: 'groups'
      }
    ]
  }
  signInAudience: 'AzureADMyOrg'
  uniqueName: uniqueName
  web: {
    homePageUrl: 'https://account.activedirectory.windowsazure.com:444/applications/default.aspx?metadata=customappsso|ISV9.1|primary|z'
    implicitGrantSettings: {
      enableAccessTokenIssuance: false
      enableIdTokenIssuance: true
    }
    logoutUrl: logoutUrl
    redirectUris: [
      redirectUri
    ]
  }
}

resource servicePrincipal 'Microsoft.Graph/servicePrincipals@v1.0' = {
  appId: resourceApp.appId
  displayName: resourceApp.displayName
  servicePrincipalType: 'Application'
  preferredSingleSignOnMode: 'saml'
  replyUrls: [
    redirectUri
  ]
  tags: [
      'WindowsAzureActiveDirectoryCustomSingleSignOnApplication','WindowsAzureActiveDirectoryIntegratedApp'
  ]
}

// outputs
output appName string = resourceApp.displayName
output uniqueName string = resourceApp.uniqueName
output appObjectID string = resourceApp.id
output appID string = resourceApp.appId
output scopes array = resourceApp.api.oauth2PermissionScopes
output appRoles array = resourceApp.appRoles
output identifierUris array = resourceApp.identifierUris
output optionalClaims array = resourceApp.optionalClaims.saml2Token
output signInAudience string = resourceApp.signInAudience
output FederationMetadataURL string = 'https://login.microsoftonline.com/<my tenant ID>/federationmetadata/2007-06/federationmetadata.xml?appid=${resourceApp.appId}'

Identifier (Entity ID) is not provisioned correctly via Bicep template

Description

Contributor guide

First steps

Assessment

Identifier (Entity ID) is not provisioned correctly via Bicep template

Description

Contributor guide

First steps

Assessment

Get new issues in your inbox