Add Azure AD Group to Azure AD Enterprise Application

[damienbod]

I need to add a group to an Azure AD Enterprise application (Default Access). How do I do this using Azure CLI? This is possible using the portal UI. Is this possible with Azure CLI?

Greetings Damien

[yonzhan]

add to S172

[jiasli]

Azure CLI currently doesn't have a command for Adding Azure AD Group to Azure AD Enterprise Application.

The doc Assign a user or group to an enterprise app in Azure Active Directory mentions alternatives for how to do that in Azure Portal and PowerShell.

By capturing the network trace, I saw Azure Portal is calling an internal AppRoleAssignments API.

POST https://main.iam.ad.ext.azure.com/api/ManagedApplications/60f762f9-4b9d-4819-8447-b96770d393f7/AppRoleAssignments
{
    "objectId": "60f762f9-4b9d-4819-8447-b96770d393f7",
    "applicationRoleId": "",
    "userId": "5963f50c-7c43-405c-af7e-53294de76abd",
    "groupId": null,
    "passwordSSOCredentials": null,
    "automaticManagedEnabled": false,
    "rolloverFrequencyInDays": 0
}

However, it looks a little different from appRoleAssignment in MS Graph API.

I tried this API but got an error:

$ az rest -m POST -u https://graph.microsoft.com/v1.0/users/5963f50c-7c43-405c-af7e-53294de76abd/appRoleAssignments -b '{"principalId":"5963f50c-7c43-405c-af7e-53294de76abd","resourceId":"60f762f9-4b9d-4819-8447-b96770d393f7","appRoleId":""}'
Bad Request({
  "error": {
    "code": "Request_BadRequest",
    "message": "Cannot convert a primitive value to the expected type 'Edm.Guid'. See the inner exception for more details.",
    "innerError": {
      "date": "2020-07-27T08:11:27",
      "request-id": "49ea12b5-388a-409f-b04a-c8e5c08c0957"
    }
  }
})

Let me further confirm with AAD team about how to do it with REST API.

For examples about using MS Graph API, you may check #12946.

[jiasli]

Azure CLI is now calling Microsoft Graph API (#22580). Currently there is no plan to support appRoleAssignments. This feature request is tracked by #22768. You may use az rest to directly call that API.