Open Ellestad1995 opened 2 months ago
Thanks @Ellestad1995.
Preliminary investigation suggests that the Graph Bicep Extension is missing the RoleManagement.ReadWrite.Directory
delegated permission to enable this scenario.
@Ellestad1995 Follow up question on the scenario. Are you also expecting to be able to assign this role assignable group to an Entra ID role, using Bicep? Does this mean you also need Entra role assignment and/or PIM for Groups?
@dkershaw10 Thanks for following up. For now I'm only concerned about creating a group which can be role assignable. Assigning roles to the groups would be great, but I guess that needs to be handled some other way for now.
Yes - it will need to be handled outside of Bicep for now :( However, if you do want to manage the role assignments (like is possible for Azure roles) then I recommend you upvote (thumbs-up) #123.
I'd love for this to be implemented but sadly the documentation states that it's not currently supported.
@abunnyuk Totally understand and I would love this to be fixed too. Please go ahead and upvote this issue. This is a Microsoft Graph platform issue that we are working on with a partner team. More comments like this will help prioritize the work for our partner team.
Bicep version Run
bicep --version
via the Bicep CLI,az bicep version
via the AZ CLIResource and API version Which Microsoft.Graph resource and API version has the issue?
Auth flow Is the deployment interactive (e.g. with a signed in user) or automated (e.g. with an application)?
Deployment details If it's related to deployment failures, please provide the deployment correlation id, Microsoft Graph client request id, and deployment timestamp if applicable.
Describe the bug
For
Microsoft.Graph/groups
resource type when using the propertyisAssignableToRole
set totrue
, which requires an additional permission for the signed in user/service principal fails even tough the permission is granted.From the Groups doc: https://learn.microsoft.com/en-us/graph/templates/reference/groups?view=graph-bicep-1.0
The service principal I'm using is granted the following Microsoft Graph permissions:
It works fine to deploy a group without the property
isAssignableToRole
set totrue
. That would mean the permissions are in effect I would believe?In addition to the Microsoft Graph permissions the service principal have the Entra ID role
Privileged Role Administrator
which is also a prerequisite.To Reproduce
Microsoft.Graph/groups
resource:Additional context Add any other context about the problem here. For example, what permissions does the identity have if it's a permission issue?