Answers: <p>What you need here are the <a href="https://docs.microsoft.com/en-us/cli/azure/ad/app/permission?view=azure-cli-latest#commands" rel="nofollow noreferrer">az ad app permission</a> commands.</p>
  
  <p>Here is a complete example (assuming powershell):</p>
  
  <pre><code>$apiId = "00000002-0000-0000-c000-000000000000" # Windows Azure Active Directory 
  $apiPermissionsId = "78c8a3c8-a07e-4b9e-af1b-b5ccab50a175" # Directory.ReadWrite.All
  $spn = az ad sp create-for-rbac --role="Owner" --name blah | ConvertFrom-Json 
  az ad app permission add --id $spn.appId --api $apiId --api-permissions ("{0}=Scope" -f $apiPermissionsId)
  az ad app permission grant --id $spn.appId --api $apiId
  az ad app permission admin-consent --id $spn.appId
  </code></pre>
  
  <p>For reference, Microsoft has <a href="https://blogs.msdn.microsoft.com/aaddevsup/2018/06/06/guid-table-for-windows-azure-active-directory-permissions/" rel="nofollow noreferrer">a list</a> of the GUIDs used for various applications.</p>
  
  <p>On some occasions I have been unable to find documentation for the magic GUIDs required for a particular app/permission, in which case I would resort to adding them through the portal manually (Azure Active Directory ➔ App Registrations ➔ Required Permissions) and then reading the JSON manifest back to reveal the required GUIDs which can then be plugged into automation.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-11-27T18:16:17.280Z
Answers: @RichardSlater did this answer, answer your question?
Answers: 030
Answers: CC BY-SA 4.0
Answers: 2019-11-27T18:17:52.307Z
Answers: I haven’t tried it yet, but it was only answered seven hours ago.
Answers: Richard Slater
Answers: CC BY-SA 4.0
Answers: 2019-11-27T10:58:09.197Z
Answers: 2019-11-27T13:45:55.527Z
Answers: 2019-11-27T13:45:55.527Z
Answers: Douglas Brand-Williamson
Body: <p>I am trying to provision a user in <a href="https://azure.microsoft.com/en-gb/services/active-directory/" rel="nofollow noreferrer">Azure Active Directory</a> using <a href="https://www.terraform.io/docs/providers/azuread/index.html" rel="nofollow noreferrer">Terraform's AzureAD provider</a>.  At the top of the <a href="https://www.terraform.io/docs/providers/azuread/r/user.html" rel="nofollow noreferrer"><code>azuread_user</code> documentation</a>, it states:</p>
  
  <blockquote>
    <p><strong>NOTE</strong>: If you're authenticating using a Service Principal then it must have permissions to <code>Directory.ReadWrite.All</code> within the <code>Windows Azure Active Directory API</code>.</p>
  </blockquote>
  
  <p>I have created the Azure Active Directory User using the <code>az</code> command line:</p>
  
  <pre><code>az ad sp create-for-rbac --role="Owner" --scopes=$SubscriptionUrl --name $PrincipalName
  </code></pre>
  
  <p>However, this doesn't have <code>Directory.ReadWrite.All</code> permissions, as that would be a fairly insane security risk.</p>
  
  <p>How can I add the <code>Directory.*</code> permissions to the Service Principal using the <a href="https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest" rel="nofollow noreferrer"><code>az</code> command line</a> (by preference) or even the <a href="https://docs.microsoft.com/en-us/powershell/azure/?view=azps-3.0.0" rel="nofollow noreferrer">Azure Powershell Cmdlets</a>, I would even be willing to craft a WebRequest if that would help me solve the problem!</p>
  
Tags: <azure><security><permissions><active-directory>
Title: Assign Directory Read/Write Privileges to Azure Service Principal from the command line?
UserDisplayName: Richard Slater
ThreadText: # Assign Directory Read/Write Privileges to Azure Service Principal from the command line?
  
  (Asked by: username_0 on 2019-11-20)
  
  I am trying to provision a user in [Azure Active Directory](https://azure.microsoft.com/en-gb/services/active-directory/) using [Terraform's AzureAD provider](https://www.terraform.io/docs/providers/azuread/index.html). At the top of the [`azuread_user` documentation](https://www.terraform.io/docs/providers/azuread/r/user.html), it states:
  
  > **NOTE**: If you're authenticating using a Service Principal then it must have permissions to `Directory.ReadWrite.All` within the `Windows Azure Active Directory API`.
  
  I have created the Azure Active Directory User using the `az` command line:
  
  ```
  az ad sp create-for-rbac --role="Owner" --scopes=$SubscriptionUrl --name $PrincipalName
  
  ```
  
  However, this doesn't have `Directory.ReadWrite.All` permissions, as that would be a fairly insane security risk.
  
  How can I add the `Directory.*` permissions to the Service Principal using the [`az` command line](https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest) (by preference) or even the [Azure Powershell Cmdlets](https://docs.microsoft.com/en-us/powershell/azure/?view=azps-3.0.0), I would even be willing to craft a WebRequest if that would help me solve the problem!
  
  **Tags:** azure, security, permissions, active-directory
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-11-27. Score: 2
  
  What you need here are the [az ad app permission](https://docs.microsoft.com/en-us/cli/azure/ad/app/permission?view=azure-cli-latest#commands) commands.
  
  Here is a complete example (assuming powershell):
  
  ```
  $apiId = "00000002-0000-0000-c000-000000000000" # Windows Azure Active Directory 
  $apiPermissionsId = "78c8a3c8-a07e-4b9e-af1b-b5ccab50a175" # Directory.ReadWrite.All
  $spn = az ad sp create-for-rbac --role="Owner" --name blah | ConvertFrom-Json 
  az ad app permission add --id $spn.appId --api $apiId --api-permissions ("{0}=Scope" -f $apiPermissionsId)
  az ad app permission grant --id $spn.appId --api $apiId
  az ad app permission admin-consent --id $spn.appId
  
  ```
  
  For reference, Microsoft has [a list](https://blogs.msdn.microsoft.com/aaddevsup/2018/06/06/guid-table-for-windows-azure-active-directory-permissions/) of the GUIDs used for various applications.
  
  On some occasions I have been unable to find documentation for the magic GUIDs required for a particular app/permission, in which case I would resort to adding them through the portal manually (Azure Active Directory ➔ App Registrations ➔ Required Permissions) and then reading the JSON manifest back to reveal the required GUIDs which can then be plugged into automation.
  
  > **Comments:**
  > **username_2**: @username_0 did this answer, answer your question?  
  > **username_0**: I haven’t tried it yet, but it was only answered seven hours ago.  
  
  ---
  
  