Why is “Application permissions” disabled in Azure AD's “Request API permissions”?

26
votes

I'm trying to give a console app permission to call an API in Azure AD.

When I go to "Add permissions," "application permissions" is grayed out and I can only select "delegated permissions."

My understanding is that application permissions is right for the console app because it runs on the back-end and users don't sign into it.

From the help text for "application permissions":

Your application runs as a background service or daemon without a signed-in user.

The help text for "delegated permissions":

Your application needs to access the API as the signed-in user.

Why is "application permissions" disabled?

Azure's "Request API permissions" dialog with a disabled "application permission" button

2
azureazure-active-directoryazure-ad-b2b
Have you defined app permissions in the appRoles array for the API? – juunas
You have to create tenant in azure portal. Permission grayed out because you have created application without creating tenant. Let me know if you have any more query – Md Farid Uddin Kiron
@MdFaridUddinKiron I definitely have a tenant...I don't think that's the issue. – Eric Eskildsen
@juunas No, I'll check the docs using those keywords. – Eric Eskildsen

2 Answers

30
votes

Per my understanding, you are exposing your custom api protected by Azure AD. If so, you need to define the application permission by editing the manifest of your api app.

enter image description here

manifest:

"appRoles": [
        {
            "allowedMemberTypes": [
                "Application"
            ],
            "description": "Apps that have this role have the ability to invoke my API",
            "displayName": "Can invoke my API",
            "id": "fc803414-3c61-4ebc-a5e5-cd1675c14bbb",
            "isEnabled": true,
            "lang": null,
            "origin": "Application",
            "value": "myTestRole"
        }
    ]

Then the application permission will show up.

enter image description here

1
votes

you actually don't give it permissions that way. It's really confusing. Instead you add your registered app to your subscription and apply a reader role, sort of through IAM. See here:

https://medium.com/@crlmas07/programmatic-access-to-azure-portal-d925ea90831e