Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

MS Graph (AAD) provider for bicep #7724

Open
spmanjunath opened this issue Jul 27, 2022 · 40 comments
Open

MS Graph (AAD) provider for bicep #7724

spmanjunath opened this issue Jul 27, 2022 · 40 comments
Labels
enhancement New feature or request story: extensibility
Milestone
Committed Backlog

Comments

@spmanjunath
Copy link

There appears to be no clean way of registering a new application (App registration) in Azure AD using Bicep. The suggested alternate approach involves using,

  • DeploymentScripts
  • UserIdentity having the necessary permission to create the App registration

For the above approach, the User identity should be created beforehand which defeats the purpose (of enveloping everything related to app deployment in a Bicep file) as it need to be created manually, or, through Powershell scripts.

I see a similar request as part of ARM, was wondering if this feature can be considered for future implementation by Bicep team.

Note: It appears that Terraform supports similar requirement.
@spmanjunath spmanjunath added the enhancement New feature or request label Jul 27, 2022
@ghost ghost added the Needs: Triage 🔍 label Jul 27, 2022
@alex-frankel
Copy link
Collaborator

We are working on an MS Graph (AAD) provider for Bicep so you can create App registrations and other AAD objects, but don't have a clear ETA atm.

Related to #6864

@alex-frankel alex-frankel added this to the Committed Backlog milestone Jul 27, 2022
@alex-frankel alex-frankel changed the title Provisioning of App registration and its permissions using Bicep MS Graph (AAD) provider for bicep Jul 27, 2022
@rajeshkamal5050 rajeshkamal5050 mentioned this issue Aug 23, 2022
Open
1 task
@alex-frankel alex-frankel mentioned this issue Oct 12, 2022
Closed
@cwe1ss
Copy link

cwe1ss commented Oct 21, 2022

We are working on an MS Graph (AAD) provider for Bicep so you can create App registrations and other AAD objects, but don't have a clear ETA atm.

Related to #6864

This is fantastic news. Will this also allow us to reference/query existing AAD objects? (E.g. to set the SQL Server AAD admin to an existing AAD group)

@alex-frankel
Copy link
Collaborator

We are working on an MS Graph (AAD) provider for Bicep so you can create App registrations and other AAD objects, but don't have a clear ETA atm.
Related to #6864

This is fantastic news. Will this also allow us to reference/query existing AAD objects? (E.g. to set the SQL Server AAD admin to an existing AAD group)

Yes, we will support existing references for AAD objects, which will be semantically equivalent to existing for Azure resources.

@Agger1995
Copy link

I am very happy to have found this issue, and hope to see it implemented at some point. This would be such a huge quality of life update for us! We are currently limited to manually creating certain AAD resources prior to deploying our Azure infrastructure.
Do you know whether the MS Graph provider will have support for creating group assignments?

@alex-frankel
Copy link
Collaborator

Yes -- service principal, group, and group assignment CRUD are the three Graph objects we are focused on in the first iteration. It's possible we will be able to support more than that, but those three are the priority.

@Sdelausnay
Copy link

Hi,

Also following this tread. Is there already an estimated time this will be released?

@ChristopherGLewis
Copy link
Contributor

I've got a demo in GitHub of how to use DeploymentScripts in bicep - the sample uses a PowerShell script to grab a Role Definition's GUID, but with minimal effort this could be converted to your usage scenario.

BicepDeploymentScripts

It basically creates a User Assigned Identity, grants the UAI reader to the subscription, assigns that to the DeploymentScript, and then finally runs a PowerShell script to query Azure to get the specified role's GUID.

@alex-frankel alex-frankel mentioned this issue Dec 8, 2022
Open
@alex-frankel alex-frankel mentioned this issue Jan 27, 2023
Closed
@vinvli
Copy link

vinvli commented Feb 3, 2023

Hi,

Also following this tread. Is there already an estimated time this will be released?

Also very interested in knowing when this will be available. We want to use it to create Azure Service Bus queues and create/assign the appropriate group/ service principal to it using bicep.

@alex-frankel
Copy link
Collaborator

We are still closing on some design details, so we can't give a confident ETA yet. Will share more details as we have them.

@alex-frankel alex-frankel mentioned this issue Mar 1, 2023
Closed
@Grant-Rc
Copy link

Grant-Rc commented Mar 7, 2023

This would be great to support the azure landing zones that we are implanting atm. Can do alot in the bicep modules apart from created the AAD groups for the RBAK roles

@josdeweger
Copy link

We have worked around this for now using a deployment script, but really keen to be able to entirely do this in Bicep. Any news?

@alex-frankel alex-frankel mentioned this issue May 1, 2023
Closed
12 tasks
@aucampia aucampia mentioned this issue May 5, 2023
Open
@TechWatching TechWatching mentioned this issue May 23, 2023
Open
@ms-sambell
Copy link

Hey team,

This was discussed in the last Bicep meeting. When is it going live?

@alex-frankel
Copy link
Collaborator

Last ETA I heard was September. @stephaniezyen can confirm.

@MaluSiv
Copy link

MaluSiv commented Jul 31, 2023

Following this thread.Any ETA?

@NSimpragaVolur
Copy link

Also following this. I think anyone using Bicep is extremely keen on having support for managing AAD with it too.

@alex-frankel
Copy link
Collaborator

ETA is 9/15.

@NSimpragaVolur - it's my understanding that MSGraph/AAD/EntraID are all synonyms, but I could have that wrong. Is there specific functionality you are expecting that is not captured on this issue?

@pamelafox
Copy link
Member

(Personally) I am hoping to replace these scripts with Bicep:

https://github.com/microsoft/sample-app-aoai-chatGPT/blob/main/scripts/auth_init.py
https://github.com/microsoft/sample-app-aoai-chatGPT/blob/main/scripts/auth_update.py

It uses the REST API to create a Graph application, add a client secret, and store the resulting app ID / client ID / client secret (to feed into Bicep). It then updates redirect URI.

So I am hoping the 9/15 Bicep will enable all that.

@SvenAelterman
Copy link

(Personally) I am hoping to replace these scripts with Bicep:

https://github.com/microsoft/sample-app-aoai-chatGPT/blob/main/scripts/auth_init.py https://github.com/microsoft/sample-app-aoai-chatGPT/blob/main/scripts/auth_update.py

It uses the REST API to create a Graph application, add a client secret, and store the resulting app ID / client ID / client secret (to feed into Bicep). It then updates redirect URI.

So I am hoping the 9/15 Bicep will enable all that.

That would be my # 1 use case too.

In addition, looking up the object ID of a user or group by UPN or name.

@jikuja
Copy link

jikuja commented Jul 31, 2023 •
edited

From monthly call:
image (I would have posted this earlier but missed capturing screenshot from live presentation)

The demo on monthly was really good: 5/5 probably will check again soon.

About MS Graph/Entra something/Azure AD/etc:

  • Azure AD == Entra ID 1
  • Azure AD related endpoints are subset of the MS Graph API 2

Footnotes

  1. https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/azure-ad-is-becoming-microsoft-entra-id/ba-p/2520436 ↩

  2. https://learn.microsoft.com/en-us/graph/overview#whats-in-microsoft-graph ↩

@dkershaw10
Copy link

dkershaw10 commented Jul 31, 2023 •
edited

Just to recap - capabilities and limitations for private preview:

  • Bicep types for:
    • Group, group membership, group ownership
    • Application
    • ServicePrincipal
    • Oauth2PermissionGrant and AppRoleAssignment
  • Bicep types for Microsoft Graph /beta version only
  • Deployment requires a signed-in user (we'll add zero-touch deployment in the private preview refresh)
  • Deployment in public cloud only

@pamelafox - yes that should be possible through a Bicep template alone.
@SvenAelterman - we won't have support for user as a bicep type in the private preview, but we can add that later. You'll be able to reference groups you create via a client provided key (just like Azure resources).

Hope this helps.

@dkershaw10
Copy link

Here's a very simple example:
image

@NSimpragaVolur
Copy link

@alex-frankel When I say AAD functionality I mean being able to reference and create AAD types, primarily Security Groups, App Registrations and Service Principals/Enterprise applications.

@pamelafox pamelafox mentioned this issue Aug 14, 2023
Closed
@jason-dou jason-dou mentioned this issue Aug 22, 2023
Merged
jason-dou added a commit that referenced this issue Aug 22, 2023
@jason-dou
Implement Microsoft Graph provider (#11595)
6862e6f 
This PR implements Microsoft Graph provider to enable Microsoft Graph
resources in Bicep, behind the feature flag `MicrosoftGraphPreview`
under `experimentalFeaturesEnabled`.

Note that this functionality is only usable if you have enrolled in the
private preview. Capabilities and signup form for private preview is
mentioned in #7724.


###### Microsoft Reviewers: [Open in
CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/Azure/bicep/pull/11595)
@franklixuefei
Copy link
Member

@alex-frankel just wanted to get an idea, when bicep officially supports this, is it just adding more types for Microsoft.Identity RP, or it is fundamentally different than what Microsoft.Identity RP does? As of today, Microsoft.Identity supports full AAD app/serviceprincipal buildout as per the doc, but only under Azure infra tenants (xME tenants). Will bicep support all tenants?

@alex-frankel
Copy link
Collaborator

@franklixuefei - the Microsft.Identity RP is only internal-facing. The MS Graph provider is the functional replacement for this provider for both internal and external users.

@shaulimaya
Copy link

So any update when and how i can create app registration for web auth using bicep?

@alex-frankel
Copy link
Collaborator

Right now there is a private preview running, but last I heard signups are closed until a Private Preview refresh planned for early next year. cc @dkershaw10 as FYI.

@shaulimaya
Copy link

shaulimaya commented Dec 5, 2023 •
edited

I am creating azure managed app using biceps
So can you suggest how can I create a function with ms provider for auth? I need to create the registered application with the right web redirect url?
I think that the ama has no permissions for creating register web app in the tenant...even if i will use the scripts..
Am i missing something?

@alex-frankel
Copy link
Collaborator

alex-frankel commented Dec 6, 2023 •
edited

In order to do MS Graph operations, like create an App Registration, as part of a bicep deployment, there are now two options:

@franklixuefei
Copy link
Member

franklixuefei commented Dec 6, 2023 via email

@aucampia
Copy link

aucampia commented Dec 6, 2023 •
edited

This option would go against various recommendations from Microsoft that IaC should be declarative:

https://learn.microsoft.com/en-us/devops/deliver/what-is-infrastructure-as-code#use-declarative-definition-files

IaC should use declarative definition files if possible.

https://learn.microsoft.com/en-us/azure/well-architected/operational-excellence/infrastructure-as-code-design

Prefer declarative over imperative tools. Declarative tools and their associated files are a better overall choice for deploying and managing IaC than imperative tools.

https://microsoft.github.io/azureml-ops-accelerator/1-MLOpsFoundation/0-DevOpsOverview/9-IaaC.html#prefer-declarative-definitions

The preferred approach to IaC is to use declarative definition files where possible.

And it is possible to use declarative definition files for this:

@alex-frankel
Copy link
Collaborator

Hi @aucampia - I was only trying to spell out the options to accomplish this with Bicep today. We certainly agree that having to fallback to Deployment Scripts is not an ideal option. That is why we are working on the MS Graph provider..

Of course, the other tools you mentioned are also great options to use in conjunction with or as an alternative to bicep.

@khaliddermoumi khaliddermoumi mentioned this issue Jan 4, 2024
Open
@jongio
Copy link
Member

jongio commented Jan 9, 2024

I believe the new link is:

https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-develop?tabs=CLI#use-microsoft-graph-within-a-deployment-script

@aaronpowell aaronpowell mentioned this issue Jan 21, 2024
Closed
@Keilor2019
Copy link

Keilor2019 commented Feb 28, 2024 •
edited

Is this bicep template going to be available for Azure AD B2C ? To create app registrations there for web authentication using MSAL.

@Bandgren
Copy link

Bandgren commented Mar 5, 2024 •
edited

@dkershaw10 & @alex-frankel
How is the private preview going? We have a super nice use case for what the initial provider is supporting and we are thinking of maybe pushing our goal until may if the public preview will be public by then. Or has it been pushed back?

@frankz217
Copy link

@alex-frankel Wondering about the progress as well!

@kdambekalns
Copy link

Right now I am at the point I'd need this… bummer it's only scheduled for May!

@huajunzhao
Copy link

@alex-frankel

Is Graph provider available now for internal use? If yes, could you please share the guidance?

We're looking for a declarative approach as a replacement of Microsoft.Identity provider to provision AAD applications (add certificate, configure SN+I, etc.) on all tenants (xME and non-ME).

@dkershaw10
Copy link

@huajunzhao let's continue this conversation over email.

@dkershaw10
Copy link

Is this bicep template going to be available for Azure AD B2C ? To create app registrations there for web authentication using MSAL.

@Keilor2019 app registration is part of the private preview offering, although I think we are pivoting towards the newer Entra External ID for customers. While app config is supported, some elements around External ID apps is not yet, like Bicep types for user flows, MFA/CA policy, tenant branding, etc.

@Bandgren @frankz217 @kdambekalns - we are still on track for public preview in May. Sorry we can't deliver this sooner (I wish we could). @Bandgren - interested to learn more about your super nice use case.

@rajeshkamal5050 rajeshkamal5050 mentioned this issue Mar 22, 2024
Open
@weikanglim
Copy link

@alex-frankel @dkershaw10

There's been some customer interest around using the Graph provider for multitenant scenarios, stemming from some observations that some organizations prefer to have app registrations done in a separate tenant from the tenant that houses their Azure resources:

  1. Suppose I wanted to create an app in tenant foo, would I end up doing the following?
az login --tenant-id foo
az deployment tenant create --location westus --template-file app.bicep # Or does it matter what scope I use for the deployment here?
  1. Suppose I wanted to reference an app in tenant foo, but I'm in the context of a bicep deployment with tenant bar -- is this possible?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request story: extensibility
Projects
Bicep
Status: Todo
Milestone
Committed Backlog
Development

No branches or pull requests