How to update azure app registrations app property?

1
votes

Updating app service in Microsoft azure app enterprise application doesn't reflect the changes in App Registration.

  1. Add owner in the app service under Enterprise application
  2. Check the App registration and go to app service then the owners didn't update the list Tried to restart the app service but it doesn't work.

Expectation: can be able to modify access permission under app registration

Result: Some actions may be disabled due to your permissions. To request access, contact the application owner(s) or your administrator.

1
azureazure-active-directory
The enterprise application is different from app registration, if you want to add Owner to app registration, why not add it directly in the app registration -> select your app -> Owners? – Joy Wang-MSFT
What do you mean app service under Enterprise application and access permission under app registration? – Joy Wang-MSFT

1 Answers

3
votes

The description/definition of an app (listed under "App registrations") and the instance of an app in an Azure AD tenant (listed under "Enterprise apps") are modeled as two separate things which can be controlled independently [see note 1]. A user can be made owner of one and not the other, or of both.

In a typical use case, the app developer is made owner of the app under "App registrations". This user can mange the app's credentials and redirect URLs, change which permissions the app asks for (but not which permissions it is granted), define the app's roles (but not assign users/groups to these roles), etc. The app's business owner in a given tenant (remember that one app can be used in many different tenants, by many different organizations) is made owner of the app under "Enterprise apps". This user can control access to the app, assign users and groups to roles in the app, etc.

It sounds like in your case, the same user is taking on both roles. In this case, you would simply make that user owner in both "App registrations" and "Enterprise apps".

Note: Under the covers, an "app registration" corresponds to an Application object, and an "enterprise app" corresponds to a ServicePrincipal object. This is how it's represented in Azure AD PowerShell, Azure AD Graph API, and the Microsoft Graph API (beta). For a given app which is registered in your tenant, doing Get-AzureADApplication will return the "app registration", while Get-AzureADServicePrincipal will return the "enterprise app". Similarly, Get-AzureADApplicationOwner will return the owners of the app registration, and Get-AzureADServicePrincipalOwner will return the owners of the enterprise app.