How to add Entra app registration using azd

[ngruson]

I was looking into adding the creation of Entra app registrations to my azd config.
This could be done using a deployment script with a user-assigned identity.
But then the question becomes: how do I assign Graph permissions to the identity so that it is allowed to create an app registration?

https://reginbald.medium.com/creating-app-registration-with-arm-bicep-b1d48a287abb
This article describes how to make a Graph REST call to add a role assignment for the role Application Administrator.

How should I do this with azd?
I could create a separate user-assigned identity myself that is not tied to any azd environment and add the proper Graph permissions.
But that wouldn't be as clean as I would want it to be since that would be a resource that is not described in my azd files.

resource identity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
  name: identityName
  location: location
}

resource appRegistration 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
  name: name
  location: location
  tags: tags
  kind: 'AzureCLI'
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: { '${identity.id}': {} }
  }
  properties: {
    azCliVersion: '2.9.1'
    retentionInterval: 'P1D'
    arguments: name
    scriptContent: '''
      APPREGNAME=$1
      az login --identity
      clientid=$(az ad app create --display-name $APPREGNAME --query appId --output tsv)
      '''
  }
}

[matthewfitzmaurice]

Does the following help?
https://learn.microsoft.com/en-us/graph/templates/overview-bicep-templates-for-graph
https://learn.microsoft.com/en-us/graph/templates/quickstart-create-bicep-interactive-mode?tabs=CLI
I'm having trouble getting them to work though..

[rajeshkamal5050]

@ngruson @matthewfitzmaurice Support has been added for Microsoft Graph resources - initially for core Microsoft Entra ID resources in Bicep Please refer to this update for docs, blogpost etc. (Azure/bicep#7724 (comment))

[ngruson]

@ngruson @matthewfitzmaurice Support has been added for Microsoft Graph resources - initially for core Microsoft Entra ID resources in Bicep Please refer to this update for docs, blogpost etc. (Azure/bicep#7724 (comment))

I've tried to use the above to create an Entra app registration as part of my deployment.
Also, I've upgraded to the latest versions of both the Bicep CLI and azd.

extension microsoftGraphV1_0

var resourceToken = uniqueString(resourceGroup().id)

resource appRegistration 'Microsoft.Graph/applications@v1.0' = {
  displayName: 'MyEntraApp'
  uniqueName: 'appreg-${resourceToken}'
}

The extension is configured in bicepconfig.json which I added to the root of my solution:

{
  "analyzers": {
    "core": {
      "rules": {
        "no-unused-params": {
          "level": "warning"
        }
      }
    }
  },
  "experimentalFeaturesEnabled": {
    "assertions": true,
    "testFramework": true,
    "extensibility": true
  },
  "extensions": {
    "microsoftGraphV1_0": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:0.1.8-preview"
  }
}

When I run azd up, I get the following error:

Error BCP104: The referenced module has errors.
Error BCP400: Fetching types from the registry requires enabling EXPERIMENTAL feature "ExtensionRegistry".

However, when I run the Bicep in isolation outside of azd, it does work and the app registration is created.

az deployment group create --resource-group rg-bicep-issue --template-file main.bicep

Question:
Is bicepconfig.json being taken into account by azd?

[craigofnz]

I've been able to the graph extension working interactively from the command-line with New-AzSubscriptionDeployment, but but not wrapped up all pretty and nice with azd. It seems related to whether my access permissions are carried across from either or the other.

Is anyone else seeing this? Or do you have graph resources working through azd ?

[craigofnz]

azd config set alpha.all off

Scratch that, I disabled alpha features and losing deployment stacks resolves that, except that it loses deployment stacks features .

Same as: Azure/deployment-stacks#169

[vhvb1989]

@wbreza FYI

[vhvb1989]

Can you share more context for your use case? I would like to understand better what you are trying to build.

It is a little confusing to me why would you like to create one Identity with access to create and manage other identities. Most Tenants would flag an App Registration which has an elevated role, like the System Admin.

Usually, if you need an identity to interact with your Azure resources within a Subscription, it is recommended to use a User Managed Identity, as that identity supports OIDC and it is scoped to subscription level. You want to use App Registration when you want/need access to EntraId (Tenant level access), for example, to read User's data.