Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to assign role to App Registration #103705

Closed
ogiel opened this issue Jan 11, 2023 · 7 comments
Closed

Unable to assign role to App Registration #103705

ogiel opened this issue Jan 11, 2023 · 7 comments

Comments

@ogiel
Copy link

ogiel commented Jan 11, 2023

Unclear how to assign Azure Digital Twins Data Owner role to App Registration.

Hey Microsoft, I think it is unclear in the current docs how to assign roles to an App Registration, and there are pictures that try to show how it should look like but the important part is cut out.

From the docs under heading Create role assignment:
"In this section, you'll create a role assignment for the App Registration on the Azure Digital Twins instance."
It then suggests the Azure Digital Twins Data Owner role.
However, when following the steps in the next to images, there is no option to actually assign this role to the App Registration. It only shows users and managed identities under the member tab, and there is no managed identity option in the App Registration resource itself (like how it works with other resources).

Under Verify role assignments there is another screenshot that just shows the tab Role assigment, but it does not show how that App Registration has been selected.

I am building a React app with MSAL and ADT and getting Unauthorized errors, I think this might be the issue I can nowhere find how to add App Registrations as roles from within other resources than the App Registration itself.

I think this page could be improved by giving some more information about this issue and not cropping the screenshots.

EDIT: Assigning the role through CLI works even though the same action is not possible through UI. Unfortunately I am still getting the same 401 Unauthorized error.


Document Details

Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

@YashikaTyagii
Copy link
Contributor

@fuchio
Thanks for your feedback! We will investigate and update as appropriate.

@baanders
Copy link
Contributor

#assign:baanders

@baanders
Copy link
Contributor

Hi @fuchio, thank you for your feedback! I will add some more information, here and in the document.

Here are the steps:

  1. On the Role tab, select the role of Azure Digital Twins Data Owner. (This is the page that has a screenshot in the document currently)
    image

  2. On the "Members" tab, assign access to User, group, or service principal. Then, use + Select members to open the pane on the right, where you can search for the app registration by its name or Client ID, and select it to add the role. (I will add this screenshot to the document)
    image

  3. On the Review + assign tab, select the Review + assign button to finish the role assignment.
    image

@baanders
Copy link
Contributor

I am adding to the document in this pull request (PR): https://github.com/MicrosoftDocs/azure-docs-pr/pull/223660

Since the PR addresses the issue, I'll have Git automatically close this issue when the PR is merged.
However, feel free to continue the conversation here and we can reopen if needed.

Thank you!

@baanders
Copy link
Contributor

@fuchio: Also, if you continue to see authorization errors after adding the role and would like some help digging into your solution, I'd like to suggest the Microsoft Q&A forum for Azure Digital Twins. This is Azure’s preferred destination for community support, and is attended by Microsoft Engineers, Azure Most Valuable Professionals (MVPs), and our expert community. It’s a good place to post questions that might be solution-specific.

@mghibli2
Copy link

Thanks a lot. This was the solution. However, i had to search on registered app name, not id.

@baanders
Copy link
Contributor

baanders commented Jul 9, 2024

Thanks for the reply and additional information! I've confirmed that it appears to work better using the app name, so I'll update the instructions to recommend searching by name.
That work is being done in this PR: https://github.com/MicrosoftDocs/azure-docs-pr/pull/280353

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants