Azure-cli: Support az ad app permission admin-consent being called by a service principal

[sam-cogan]

Is your feature request related to a problem? Please describe.
Based on the discussion here I understand it is not possible to have a service principal run the az ad app permission admin-consent CLI command. This is a major blocker to being able to fully automate AKS deployments that use Azure AD integration, as the apps you create for this need consent.

Describe the solution you'd like
Service Principals able to run the az ad app permission admin-consent command

Describe alternatives you've considered
The only current workaround is to run a deployment as a user, which is no good for automated CI/CD

Additional context

[psyrus]

Agreed, this single limitation is stopping our automation of the advanced networking features in AKS cluster deployments through automated pipelines... it always has to have a human in the loop for just this one step.

[jiasli]

Thank you for raising this feature request. We will look into it.

[rmcolbert]

This is also blocking CI/CD for rolling out new Azure Functions w/ RBAC

[farahgara1794]

I got the same problem to automate AkS creation using terraform

[TechnologyAnimal]

I've been making a huge push to begin leveraging AKS as the container platform of choice for my organization. Unfortunately, this issue is going to delay or possibly prevent the adoption of AKS entirely. We need to be able to have end-to-end automation for provisioning and configuring AKS. Can this issue be worked around in any way, such as making calls against the REST API?

[cloudpea]

We are unable to automate the AAD integration with our AKS cluster due to this limitation.

[MarcelT-NL]

I got the same problem to automate AkS creation using terraform

Same here. Blocks CI/CD for us with automatic nightly builds/tests

[jiasli]

Duplicate of #12137

Granting Delegated Permission and Application Permission called by a Service Principal is not supported using Microsoft Graph API with az rest.

Please check https://github.com/Azure/azure-cli/issues/12137#issuecomment-596567479 for more information.

[pmatthews05]

Want this feature too to automate using pipelines.

[sam-cogan]

FYI it is now possible to grant consent through the REST API -See here.

[pmatthews05]

@sam-cogan I saw this blog post and this is only for Delegate permissions. It was the application permissions I wanted to automate the grants for.
However, through that blog post, and bit of spare time at the weekend, I was able to understand how the App Registration / Service Principals work.

With the new permissions of AppRoleAssignment.ReadWrite.All available, it is now possible to do AppRoles as well as Oauth2Permissions.

I have put together a github project https://github.com/pmatthews05/CFAppOnlyGrantPermissions with the instructions in the readme.md file. I will get round to writing a blog post within the next week to explain the code.

[jiasli]

Hi @pmatthews05,

It was the application permissions I wanted to automate the grants for.

We do support granting Application Permissions with az rest. Please check my comment at https://github.com/Azure/azure-cli/issues/12137#issuecomment-596567479.