<p>What you need here are the <a href="https://docs.microsoft.com/en-us/cli/azure/ad/app/permission?view=azure-cli-latest#commands" rel="nofollow noreferrer">az ad app permission</a> commands.</p>

<p>Here is a complete example (assuming powershell):</p>

<pre><code>$apiId = "00000002-0000-0000-c000-000000000000" # Windows Azure Active Directory 
$apiPermissionsId = "78c8a3c8-a07e-4b9e-af1b-b5ccab50a175" # Directory.ReadWrite.All
$spn = az ad sp create-for-rbac --role="Owner" --name blah | ConvertFrom-Json 
az ad app permission add --id $spn.appId --api $apiId --api-permissions ("{0}=Scope" -f $apiPermissionsId)
az ad app permission grant --id $spn.appId --api $apiId
az ad app permission admin-consent --id $spn.appId
</code></pre>

<p>For reference, Microsoft has <a href="https://blogs.msdn.microsoft.com/aaddevsup/2018/06/06/guid-table-for-windows-azure-active-directory-permissions/" rel="nofollow noreferrer">a list</a> of the GUIDs used for various applications.</p>

<p>On some occasions I have been unable to find documentation for the magic GUIDs required for a particular app/permission, in which case I would resort to adding them through the portal manually (Azure Active Directory ➔ App Registrations ➔ Required Permissions) and then reading the JSON manifest back to reveal the required GUIDs which can then be plugged into automation.</p>

CC BY-SA 4.0
2019-11-27T18:16:17.280Z
@RichardSlater did this answer, answer your question?
030
CC BY-SA 4.0
2019-11-27T18:17:52.307Z
I haven’t tried it yet, but it was only answered seven hours ago.
Richard Slater
CC BY-SA 4.0
2019-11-27T10:58:09.197Z
2019-11-27T13:45:55.527Z
2019-11-27T13:45:55.527Z
Douglas Brand-Williamson
<p>I am trying to provision a user in <a href="https://azure.microsoft.com/en-gb/services/active-directory/" rel="nofollow noreferrer">Azure Active Directory</a> using <a href="https://www.terraform.io/docs/providers/azuread/index.html" rel="nofollow noreferrer">Terraform's AzureAD provider</a>.  At the top of the <a href="https://www.terraform.io/docs/providers/azuread/r/user.html" rel="nofollow noreferrer"><code>azuread_user</code> documentation</a>, it states:</p>

<blockquote>
  <p><strong>NOTE</strong>: If you're authenticating using a Service Principal then it must have permissions to <code>Directory.ReadWrite.All</code> within the <code>Windows Azure Active Directory API</code>.</p>
</blockquote>

<p>I have created the Azure Active Directory User using the <code>az</code> command line:</p>

<pre><code>az ad sp create-for-rbac --role="Owner" --scopes=$SubscriptionUrl --name $PrincipalName
</code></pre>

<p>However, this doesn't have <code>Directory.ReadWrite.All</code> permissions, as that would be a fairly insane security risk.</p>

<p>How can I add the <code>Directory.*</code> permissions to the Service Principal using the <a href="https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest" rel="nofollow noreferrer"><code>az</code> command line</a> (by preference) or even the <a href="https://docs.microsoft.com/en-us/powershell/azure/?view=azps-3.0.0" rel="nofollow noreferrer">Azure Powershell Cmdlets</a>, I would even be willing to craft a WebRequest if that would help me solve the problem!</p>

<azure><security><permissions><active-directory>
Assign Directory Read/Write Privileges to Azure Service Principal from the command line?
Richard Slater
# Assign Directory Read/Write Privileges to Azure Service Principal from the command line?

(Asked by: username_0 on 2019-11-20)

I am trying to provision a user in Azure Active Directory using Terraform's AzureAD provider.  At the top of the azuread_user documentation, it states:

NOTE: If you're authenticating using a Service Principal then it must have permissions to Directory.ReadWrite.All within the Windows Azure Active Directory API.

I have created the Azure Active Directory User using the az command line:
az ad sp create-for-rbac --role="Owner" --scopes=$SubscriptionUrl --name $PrincipalName

However, this doesn't have Directory.ReadWrite.All permissions, as that would be a fairly insane security risk.
How can I add the Directory.* permissions to the Service Principal using the az command line (by preference) or even the Azure Powershell Cmdlets, I would even be willing to craft a WebRequest if that would help me solve the problem!

**Tags:** azure, security, permissions, active-directory


---

## 1 answers

### Answer by username_1 on 2019-11-27. Score: 2

What you need here are the az ad app permission commands.
Here is a complete example (assuming powershell):
$apiId = "00000002-0000-0000-c000-000000000000" # Windows Azure Active Directory 
$apiPermissionsId = "78c8a3c8-a07e-4b9e-af1b-b5ccab50a175" # Directory.ReadWrite.All
$spn = az ad sp create-for-rbac --role="Owner" --name blah | ConvertFrom-Json 
az ad app permission add --id $spn.appId --api $apiId --api-permissions ("{0}=Scope" -f $apiPermissionsId)
az ad app permission grant --id $spn.appId --api $apiId
az ad app permission admin-consent --id $spn.appId

For reference, Microsoft has a list of the GUIDs used for various applications.
On some occasions I have been unable to find documentation for the magic GUIDs required for a particular app/permission, in which case I would resort to adding them through the portal manually (Azure Active Directory ➔ App Registrations ➔ Required Permissions) and then reading the JSON manifest back to reveal the required GUIDs which can then be plugged into automation.

> **Comments:**
> **username_2**: @RichardSlater did this answer, answer your question?  
> **username_0**: I haven’t tried it yet, but it was only answered seven hours ago.  

---

