Assigning Graph roles to a managed identity

[dozer75]

I am trying to assign Graph roles to a managed identity using the bicep extension, but I can't get it to work. Unfortunately, the error returned while running the deployment is not useful at all to find the issue. I am certain it has something to do with the rights of the deployer, but I can't figure out what to assign to it and how.

The deployment is done using CD (Azure DevOps) with a managed identity.

The script that fails looks like this

extension microsoftGraphV1

param location string
param environment string

resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' = {
  name: 'mi-mysql-${environment}'
  location: location
}

resource graphServicePrincipal 'Microsoft.Graph/servicePrincipals@v1.0' existing = {
  appId: '00000003-0000-0000-c000-000000000000'
}

var graphAppRoles = [
  'User.Read.All'
  'GroupMember.Read.All'
  'Application.Read.All'
]

resource managedIdentityRoleAssignment 'Microsoft.Graph/appRoleAssignedTo@v1.0' = [
  for appRole in graphAppRoles: {
    principalId: managedIdentity.properties.principalId
    resourceId: graphServicePrincipal.id
    appRoleId: (filter(graphServicePrincipal.appRoles, role => role.value == appRole)[0]).id
  }
]

And the error I get is this

ERROR: {
  "error": {
    "code": "InvalidTemplateDeployment",
    "message": "The template deployment 'dev' is not valid according to the validation procedure. The tracking id is 'e6a3471f-327e-4df3-8abb-e758580a3cb6'. See inner errors for details.",
    "details": [
      {
        "code": "Forbidden",
        "target": "/resources/graphServicePrincipal",
        "message": "Authorization_RequestDenied: Insufficient privileges to complete the operation. Graph request-id: 78c50d73-287f-4fd9-a788-b33717c6752e (2026-06-20T15:30:10) Graph client request id: cdc45f7f-e64c-41d5-9213-cb40905261d5. Graph request timestamp: 2026-06-20T15:30:10Z."
      }
    ]
  },
  "properties": {}
}

Does someone knows what permissions I am missing here to be able to deploy this?

(As a note, I have removed everything except the service principal retrieval, but it still fails.)

[krotname]

The missing permissions are on the identity that runs the deployment, not on the managed identity you are creating.

Your error target is /resources/graphServicePrincipal, so the deployment is already failing while reading this existing resource:

resource graphServicePrincipal 'Microsoft.Graph/servicePrincipals@v1.0' existing = {
  appId: '00000003-0000-0000-c000-000000000000'
}

For Microsoft.Graph/servicePrincipals with existing, the Graph Bicep reference lists Application.Read.All as the least-privileged read permission.

Then, for creating Microsoft.Graph/appRoleAssignedTo, the reference lists this least-privileged application-permission pair:

Application.Read.All
AppRoleAssignment.ReadWrite.All

So for an Azure DevOps CD deployment that runs as a managed identity, grant Microsoft Graph application permissions to the service principal of that deployment identity:

Application.Read.All
AppRoleAssignment.ReadWrite.All

and grant admin consent for them. Azure RBAC roles like Owner/Contributor on the subscription do not cover these Microsoft Graph calls.

If you test interactively instead of app-only, the signed-in user also needs a supported Entra role. The Graph API docs list Privileged Role Administrator as the least-privileged built-in role for Microsoft Graph app-role assignments, with broader roles such as Application Administrator / Cloud Application Administrator also supported.

After the permissions are fixed, your Bicep shape looks basically right: principalId should be the managed identity service principal object id, resourceId should be the Microsoft Graph service principal object id, and appRoleId should come from graphServicePrincipal.appRoles. If the identity is created and assigned in the same deployment, a second possible failure mode is directory replication delay; a rerun or splitting identity creation and Graph assignment into separate stages can help confirm that.

Docs:

• Microsoft.Graph/servicePrincipals permissions: https://learn.microsoft.com/en-us/graph/templates/bicep/reference/serviceprincipals?view=graph-bicep-1.0
• Microsoft.Graph/appRoleAssignedTo permissions: https://learn.microsoft.com/en-us/graph/templates/bicep/reference/approleassignedto?view=graph-bicep-1.0
• Graph app role assignment API permissions/roles: https://learn.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignments?view=graph-rest-1.0

[dozer75]

Hi,

Thanks for you answer. Yes, I know it is on the service principal used by the Azure DevOps pipeline I need it (and granted them), and I have added both Application.Read.All and AppRoleAssignment.ReadWrite.All role to that, but to no avail. I even tried higher privileged permissions as well, so I really don't why this fails.

[krotname]

If those app roles are already granted, the next thing I would verify is what the deployment token actually contains. A common miss is that the portal shows roles on the service principal you expect, but the Azure DevOps job is authenticated as a different app/service principal, or the token was issued before consent/role assignment was added.

Test from the same Azure DevOps service connection / managed identity context, not from your user:

az account show
az rest --method GET --url "https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000-c000-000000000000')"

If that GET fails, Bicep will fail on the existing graphServicePrincipal read too; the problem is still the deployment identity/token, not the Bicep resource shape.

If the GET succeeds, then capture the full deployment error for the app-role assignment. The current generated Graph Bicep types are object-id based here:

• principalId = the managed identity's service principal object id, not Azure resource id or client id;
• resourceId = the Microsoft Graph service principal object id, not the Graph app id;
• appRoleId = the id of the target app role from graphServicePrincipal.appRoles.

Also check that Application.Read.All and AppRoleAssignment.ReadWrite.All are application permissions, tenant admin consent is granted, and the pipeline/service connection is exactly the principal you granted. Higher Azure RBAC or directory roles on your user will not help if the pipeline's Graph token does not carry those app roles.

Docs:

Microsoft.Graph/servicePrincipals: https://learn.microsoft.com/en-us/graph/templates/bicep/reference/serviceprincipals?view=graph-bicep-1.0
Microsoft.Graph/appRoleAssignedTo: https://learn.microsoft.com/en-us/graph/templates/bicep/reference/approleassignedto?view=graph-bicep-1.0
Graph app role assignment API: https://learn.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignments?view=graph-rest-1.0

[dozer75]

Ok, So after investigating today, it's clear that the issue is deployment stack. This module does not work with deployment stacks (which we are using) and that caused this. I tried to deploy using a ordinary deployment and it worked.