Question 105808 in Azure Question posted in
The official documentation to get you started can be found here.

Azure – What permissions are needed to read /write external collaboration policies?

I’ve written a powershell script that allows me to query azure for my azure ad policies like this:

Connect-AzureAD
$currentpolicy = Get-AzureADPolicy -All $true | ?{$_.Type -eq 'B2BManagementPolicy'} | select -First 1
$currentpolicy
$newPolicyValue = @("{`"B2BManagementPolicy`":{`"InvitationsAllowedAndBlockedDomainsPolicy`":{`"AllowedDomains`": [`"a.com`",`"b.org`",`"c.org`",`"d.com`"],`"BlockedDomains`": []}}}")

}
#update existing. This works. tested.
Set-AzureADPolicy -Definition $newPolicyValue -Id $currentpolicy.Id

This works because I’m signing in with an account that’s got "owner" / global admin permissions. Now we wnat to try to figure out the specific permissions that are needed and just assign those to a new AD app registration.

I’ve created a service principal with a cert, and I changed my code like this:

Connect-AzureAD -TenantId $tid -ApplicationId $appid -CertificateThumbprint $thumb
$currentpolicy = Get-AzureADPolicy -All $true | ?{$_.Type -eq 'B2BManagementPolicy'} | select -First 1
$currentpolicy

I didn’t add any specific permissions yet, and so when I run my script, I see the following error:

Get-AzureADPolicy : Error occurred while executing GetPolicies
Code: Authorization_RequestDenied
Message: Insufficient privileges to complete the operation.
InnerError:
  RequestId: d88cd5d5-f8c9-4a4d-928b-986e0d5c25eb
  DateTimeStamp: Thu, 16 Jun 2022 19:06:45 GMT
HttpStatusCode: Forbidden
HttpStatusDescription: Forbidden
HttpResponseStatus: Completed
At C:UsersmeDocumentssrctestsetPolicy.ps1:4 char:18
+ $currentpolicy = Get-AzureADPolicy -All $true | ?{$_.Type -eq 'B2BMan ...
+                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-AzureADPolicy], ApiException
    + FullyQualifiedErrorId : Microsoft.Open.MSGraphBeta.Client.ApiException,Microsoft.Open.MSGraphBeta.PowerShell.GetPolicy

Ideally, we want to use MS Graph permissions to do this. So i’ve been poking around in Azure, under the "API Permissions" for this application registration, but so far I haven’t figured out which permission I need to add.

PS I know that the AzureADPreview and AzureAD is going away. But so far, it’s the only way that I can automate these tasks. I have another stack question open about how to get this entire thing working via Graph

EDIT 1

I’ve tried the following permissions and none of them work so far…

enter image description here

EDIT 2

I’ve granted Policy.Read.All and now I can read the policies. Now it fails trying to update the existing policy.

It’d be nice to know specificially which read permission is needed so I don’t have to grant all.

As far as write permissions, I’ve granted everything that comes up when I search for "policy" but none of them allow me to write!

EDIT 3

I’ve added the policy.readwrite.applicationconfiguration but that doesn’t allow me to write. I’m still get the insufficient privleges error when I try to call Set-AzureADPolicy.

enter image description here

Tags:

2

Answers


  1. 0

    Thanks for reaching out , with the help you read access , you will only able to get the data ,if you want to add or update you should have write permission as well , please add permission Policy.ReadWrite.ApplicationConfiguration and try again .
    enter image description here

    ref doc – https://learn.microsoft.com/en-us/graph/api/tenantappmanagementpolicy-update?view=graph-rest-beta&tabs=http

    Edit 2

    Update policy is available for PowerShell 2.0 preview enter image description here

    To update you need to use
    Set-AzureADPolicy -ObjectId -DisplayName

    To learn more about Set-AzureADPolicy, please checkout – https://learn.microsoft.com/en-us/powershell/module/azuread/set-azureadpolicy?view=azureadps-2.0-preview&viewFallbackFrom=azureadps-2.0

    Thanks

    Login or Signup to reply.
  2. 0

    I don’t know if you have found an answer, but as this is one of the first results that came up, I will add my findings.

    I could get nowhere from giving specific permissions to the Service Principal but adding the Security Administrator role to the app did the trick. I didn’t want to give the service principal so much access, but I tried a lot of roles and permission combinations, and none were sufficient.

    Apparently, the documentation states that the least privileged role that is able to configure B2B external collaboration settings is the Global Administrator. Although for this case specifically, of changing the B2BManagementPolicy via PowerShell with a service principal, the Security Administration role was enough in my testing.

    Looking at the actions that this role can perform I suspect it’s because it has access to microsoft.directory/policies/basic/update, but I can’t be sure.

    Note: When adding a role to an App registration in Azure AD you need to search for its name when selecting the members, as they don’t show by default.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search