Simplified Role Management: Azure REST API for User and App Registration Roles

Introduction

In modern cloud computing, managing access and permissions to resources is crucial to maintaining security and governance in Azure. To programmatically manage RBAC roles and permissions, developers can leverage the power of Azure’s REST API. Before using APIs to create and assign the custom roles to users or principals present in Azure subscription, do the below 2 steps for granting the permissions to the App Registration.

1. Whether App Registration has been assigned with a role having necessary authorization permissions to that same subscription or not, as this will be using the Secret Value (part of the four required IDs) in the REST API that generates from the App Registration itself. (Steps detailed below)
2. Check whetherAuthorization service resource provider is registered or not. If not registered, we need to register it on the Subscription Page, as shown below.

Assign the Custom RBAC Role to the Principal ID of App Registration

Follow the below steps to assign the custom RBAC role to App Registration in the portal.

1. Go To Subscription Resource -> Click on IAM in the left panel -> Click on Add custom role as below.

2. After clicking Add custom role, it will be redirected to a new page for creating a custom role. Give a sample role name in Basics Tab -> go to the Permissions Tab -> click on Add Permissions -> search for Authorization permission -> Select all below permissions as shown in the below image.

3. Click on Review+Create. So custom role will get created in the category of custom role.

4. Now, Assign the newly created custom RBAC role to the principal id of App Registration.

Click on Add role assignment.

5. Search for the custom role created in step 3 -> click Next.

6. Go to the Members Tab -> Click on Select members -> Now search for the App Registration name in the search bar for which we wanted to assign the custom role. -> click on Select -> Click on Review + assign.

Steps to Check the Service Based Resource Providers Registered

Go to Subscriptions -> Click on Resource Providers in the Left Panel -> Check Microsoft.Authorization is Registered or not.

Generate Bearer Token Using Tenant ID, Client ID & Secret Value

1. https://login.microsoftonline.com/<tenant id>/oauth2/token
2. Paste the above URL with the Tenant ID in Postman Application
3. Go to Body -> select x-www-form-urlencoded and provide the below body as Key and Value pair

Ex: Provide grant_type as Key and client_credentials as Value

4. The above API request will respond in JSON format, passing the value of the access_token key as a bearer token in all the REST API operations.

Create the Custom Role Using Azure REST API

• Use the REST API below to create the custom role, replace the value of the subscription ID and use the PUT

https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{UUID}?api-version=2022-04-01

• Use the link below to generate a new UUID, use the same API, and request body value.

Online UUID Generator Tool

• Go to Headers and provide the data below as key and value pair.

• Provide the sample API Request body below in the Body -> select raw.

Now, click on Send in the same request and get an appropriate response with the same rolename as the sample response below.

Assign the Custom Role to Principal ID Using Azure REST API

• Use the REST API below to assign the user’s custom role, replace the value of the subscription ID and use the PUT

https://management.azure.com/subscriptions/{subscriptionID}/providers/Microsoft.Authorization/roleAssignments/{UUID}?api-version=2022-04-01

• Use the link below to generate one newer UUID, use the same value in the above API, and use the UUID of created custom role for which we have used to create the role and pass the same in the request body.

Online UUID Generator Tool

• Go to Headers and provide the data below as key and value pair.

• Provide the sample API Request body below in the Body -> select raw.

• Use the object ID of any user in an organization or tenant level and replace it with the UserID for whom you will assign this created custom role in the previous step.
• Now, click Send in the same request and get an appropriate response with the same rolename as shown below.

Conclusion

Drop a query if you have any questions regarding Azure REST API and we will get back to you quickly.

About CloudThat