How can I programmatically register an App in Azure AD using logic app?

2
votes

I would like to build a flow for App registration using Azure Logic App (for automation)

How can I auto register the App in Azure AD? Making a REST API call should be easy and straight forward, anyone knows how to do a POST for app registration?

Few examples would be much appreciated.

Ref: https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/api/entity-and-complex-type-reference#application-entity

Any other way beside the REST API that is supported by an azure logic app is also more than welcome!

1
azureazure-active-directoryazure-logic-apps

1 Answers

4
votes

REST API to use for Registering Azure AD App

  • Azure AD Graph API (https://graph.windows.net) - Application Entity

    POST https://graph.windows.net/{your tenantID}/applications?api-version=1.6

  • Microsoft Graph API (https://graph.microsoft.com) - Create Application API

    POST https://graph.microsoft.com/beta/applications

Azure AD Graph API is the older one and for most operations newer Microsoft Graph API is recommended. Read more about that here Microsoft Graph or the Azure AD Graph.

Application registration scenario although is still in beta for the newer Microsoft Graph API so it would not be recommended for production applications. So I have shown the screenshots and detailed steps further with Azure AD Graph API. At a later point though, once Microsoft Graph API stable version supports app registration, you can change to make use of Microsof Graph API.

High Level Steps

  1. Your logic app needs enough permissions first to be able to register an application with Azure AD.

    • Enable Managed Identity for Logic App
    • Assign required app role assignment for your logic app's managed identity to be able to call graph api. (You will need to find Graph API's Service Principal Id to do this step first)

  2. Add HTTP action to your logic app that will make graph API call

    • Make a post call to graph API
    • Set appropriate headers and body as per your app registration requirement
    • Choose Managed Identity for Authentication
    • Set Audience to https://graph.windows.net or https://graph.microsoft.com as per the API you call.

Detailed Steps

  1. Go to your Logic App in Azure Portal > Identity > now turn on the System Assigned Identity

    enter image description here

  2. Once Managed Identity is enabled you should get an object id. I'll call it LogicApp.Identity.ObjectId

    enter image description here

  3. Now go to Azure Portal > Azure AD > Enterprise applications > Select Microsoft Applications in dropdown for Application Type > Filter it using application id for Azure AD Graph API (00000002-0000-0000-c000-000000000000). In case you're trying to call Microsoft Graph API (search for 00000003-0000-0000-c000-000000000000)

    Now note the objectId for the service principal. Let's call this one Graph.ObjectId

    enter image description here

  4. Run PowerShell command to create a new app role assignment.

    New-AzureADServiceAppRoleAssignment -ObjectId LogicApp.Identity.ObjectId -PrincipalId LogicApp.Identity.ObjectId -Id "824c81eb-e3f8-4ee6-8f6d-de7f50d565b7" -ResourceId "Graph.ObjectId"

    If you run into a Authorization_RequestDenied error at this step, please look at my note about a known issue at the end. You should be good to continue as permission would still get added.

    Please note that I have used 824c81eb-e3f8-4ee6-8f6d-de7f50d565b7 as the app role to be assigned, which corresponds to Application.ReadWrite.OwnedBy application permission for Windows Azure Active Directory i.e. Manage apps that this app creates or owns

    enter image description here

    You could choose a different application permission/role in case you want to change that part. In case you use Microsoft Graph API instead, you can find the permissions from here - Microsoft Graph Permissions Reference - e.g. Application.ReadWrite.All or Application.ReadWrite.OwnedBy

  5. Now go to your Logic App and add HTTP Action.

    Notice the URI, Method, Headers and Body (I have used a very simple JSON, but you can change that as per your requirement)

    Also notice the Authentication is set to Managed Identity and Audience is set to https://graph.windows.net (which can become https://graph.microsoft.com if you call Microsoft Graph API instead)

    enter image description here

  6. Now try running the logic app and HTTP action should succeed, registering a new Azure AD application as per your JSON.

    enter image description here

    In case you get a bad request error - issue is probably with the Graph API call inputs, like URI, header or body.

    In case you get a Forbidden or Unauthorized error - Issue is with following earlier steps to assign application permission to Logic app identity, so check back on those steps.

On running the PowerShell script described in Step 4 above, you may run into a known issue, where it throws an error code Authorization_RequestDenied.

I have given more information about this issue here in Assigning Microsoft Graph permissions to Azure Managed Service Identity and it's also available in this GitHub issue - Executing the New-AzureAdServiceAppRoleAssignment step returns a Forbidden error.

So even though you get this error intermittently, actual role assignment should get created and you should be good to proceed.