az ad app permission admin-consent for sovereign cloud

[karataliu]

Is your feature request related to a problem? Please describe.

azure-cli/src/azure-cli/azure/cli/command_modules/role/custom.py

Line 875 in 98007ca

raise CLIError('This command is not yet supported on sovereign clouds')

Describe the solution you'd like
Support az ad app permission admin-consent in sovereign cloud

Describe alternatives you've considered

Additional context

[yonzhan]

@jiasli new feature request, plan later.

[udayansarma]

I see that the all the az CLI command is doing is a post to the endpoint below. If that endpoint or equivalent exists in the sovereign cloud I don't see that this is a huge amount of work. Also, if that endpoint is available then we should be able to leverage that in the interim without having to go through the portal.
On another though if we are able to consent using the Azure portal then there must be an API available to accomplish it.
Any thoughts?
https://main.iam.ad.ext.azure.com/api/RegisteredApplications/{}/Consent?onBehalfOfAll=true'.format(
application.app_id)

[jiasli]

az ad app permission admin-consent will be deprecated soon in the future, because as @udayansarma said, it is calling an AAD internal API:

azure-cli/src/azure-cli/azure/cli/command_modules/role/custom.py

Lines 905 to 907 in 4c28536

	url = 'https://main.iam.ad.ext.azure.com/api/RegisteredApplications/{}/Consent?onBehalfOfAll=true'.format(
	application.app_id)
	send_raw_request(cmd.cli_ctx, 'post', url, resource='74658136-14ec-4630-ad9b-26e160ff0fc6')

For the new way of granting admin permissions, please check #12137 (comment) for a temporary solution with az rest and Microsoft Graph.