►
From YouTube: Azure AD App Security: Safeguarding Service Principals for Smooth & Secure Automation – April 2023
Description
This month’s in-depth topic: Mastering Azure AD App Security: Safeguarding Service Principals for Smooth and Secure Automation. Specifically, permissions for DevOps and automation – background Services or Daemon applications. Descriptions and demos on: Service or daemon applications, app only vs delegated access, application vs service principal, app only permissions and Key Vault, app only access token, Microsoft Graph app permissions, Azure Active Directory scoping, no Graph app permissions, “user administrator” directory role, Custom role, Microsoft 365 scoping.
Topic presenter and call host - Marcus Carvalho (Microsoft). Call delivered on April 20, 2023. Questions addressed live and in chat throughout the call.
Agenda
00:00 – Intro - Marcus Carvalho (Microsoft)
03:09 – Topic – Mastering Azure AD App Security: Safeguarding Service Principals for Smooth and Secure Automation – Marcus Carvalho (Microsoft)
52:31 – Closing
Learn more
• See the full blog post for this call in the Microsoft 365 platform community blog - https://aka.ms/community/blog
• Microsoft 365 Unified Sample gallery - https://aka.ms/community/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/community/videos
• Microsoft 365 Platform Community - http://aka.ms/community/home
• Mark your calendar for next call on April 20th at 9:00am PT. Download the recurrent invite for this call | https://aka.ms/IDDevCommunityCalendar
A
B
First
things:
first,
so
we're
going
we're
recording
the
call,
so
other
people
can
join
us
and
and
watch
that
later
you
see
the
link
for
the
recordings
at
the
end
of
the
session,
so
there
will
be
a
link
there
and
a
bunch
of
links
that
you
see
around
many
times.
This
causes
designer
for
developers
who
wants
to
implement
our
interests,
implemented,
Microsoft,
identity
platform
Solutions.
We
will
address
topics
that
you
submit
using
the
community
discussion
and
the
the
the
form
that
we
have.
B
The
feedback
form
that
we
should
make
that
you
submit
when
you
join
us.
This
is
not
a
support
channel,
so
we're
going
to
use
our
stacker.
Should
we
use
stuck
overflow
to
ask
your
questions
and
get
support
from.
We
have
the
origin
that
monitors
that
stack
Overflow
for
the
subject.
One
thing
that
is
new
this
month:
we
well
not
this
month,
I
think
and
we
now
have
one
or
two
months
already.
B
B
If
it's
not
coming
out
today,
it
will
come
tomorrow
or
worst
case
on
Monday,
but
we
expect
that
to
to
be
released
today
and
the
links
for
social
media
so
where
you
can
see
the
announcement
for
them
for
the
upcoming
calls
and
see
what's
coming
up
owned
on
next
months
and
and
how
things
are
going.
So
this
is
just
a
reminder,
so
that's
the
recording
for
our
community
call.
So
if
you
don't
have
the
the
link
for
the
community
call
in
your
calendar,
so
you
should
have
the
invite.
B
B
There
is
a
page
for
events
where
you
can
find
all
the
events
for
all
identity
related
audience,
developer,
related
events
that
we
have
up
up
and
going.
We
had
a
Microsoft
graphs
call
this
week
or
a
workshop.
This
week
we
have
an
adfs
migration
neck
Workshop
next
week
there
is
an
identity,
developer,
Workshop
coming
on
beginning
of
May,
so
a
bunch
of
things
you
can
check
the
page
to
to
be
updated.
So,
let's
get
started.
B
Let's
get
into
the
session
itself,
where
we're
going
to
to
talk
about
the
service,
about
service
principles
and
automation,
let's
give
a
little
bit
of
introduction,
so
we
can
set
the
stage
when
we
start
we
can
start
moving
around
and
and
seeing
how
we
can
do
this.
So
the
scenario
we're
going
to
cover
on
this.
B
So
basically,
what
we're
going
to
address
today
are
services
or
demon
applications,
so
applications
that
run
on
the
background
or
run
on
schedule
or
usually
in
summary,
they
don't
have
a
user
log
it
in
right,
so
they
run
in
the
background
or
say
so,
this
type
of
applications.
They
are
common,
you
commonly
use
it
in
devops
and
areas
and
all
kinds
of
automation,
tasks,
integration
systems,
integration,
security,
interactions
between
applications,
batch
processing,
data,
integration,
resource
provisioning,
managing
resources
at
scale
in
Cloud
applications
deploying
for
secure
as
a
code
monitor
assistant
performance.
B
So
a
lot
of
different
things
that
happen,
but
these
things
don't
really
have
a
user
connected
to
it.
So
it's
a
task
that
runs
process
data
and
then
the
or
run
an
action
that
do
something
and
that
that's
how
it
works.
Because
of
that,
so
the
key
factor
or
a
key
formation,
is
that
we
don't
have
user
user
context
on
this
scenario.
So
we
don't
know.
B
Actually
there
is
no
user
running
anything,
and
that
is
the
main
difference
of
what
are
you
calling
app
only
versus
delegated
access
right
on
an
app
only
scenario?
We
will
have
the
information
in
the
in
the
tokens
about
the
application
and
the
rows
or
the
details
about
the
application
itself.
We
don't
have
anything
related
to
the
user
on
a
delegated
access.
The
application
token
has
not
only
application
information,
but
mostly
user
information,
so
who
the
user
is
which
eventually,
which
groups
is.
They
are
they're
part
of
what
roles
the
user
is.
B
Member
of
what
is
the
application
that
is
connecting?
What
is
the
target
audience
for
the
application?
That's
the
main
main
thing
here,
because
that's
where
the
difference
starts
and
where
the
challenges
become
more
notice,
another
important
concept
just
to
set
the
stage.
So
there
are
probably
a
lot
of
you
already
know
about
that,
but
just
to
set
stage
in
Azure
AG.
B
There
are
two
types
of
application
objects:
one
is
the
application
itself
that
represents
the
web
API
or
the
web
application
that
wants
to
access
resources
or
is
the
resource
that
will
be
accessed
right.
So,
but
this
is
majorly
a
template.
There's
no
security
information
related
to
the
application.
You
will
see.
You
will
find
the
application
registration
in
the
Microsoft
Center
admin
Center
under
operations,
and
that's
where
these
object
resides.
B
The
service
principle
is
bound
to
the
to
the
application
object.
So
it
represents
the
identity
of
the
application.
So
that's
the
security
part
of
it.
It's
easy
to
authenticate
and
authorize
the
application
to
access
other
resources.
It
actually
control
access
to
resources,
because
that's
where
the
identity
of
the
app
gets
together
delegated
with
the
user
permission
and
ensure
that
only
authorized
applications
have
access
to
these
service
Facebook.
The
name
is,
is
a
bit
misleading,
but
in
the
entire
domain
portal
admin
Center,
we
will
have
it
under
Enterprise
application.
B
So
what
you
see
under
Enterprise
applications
are
actually
the
service
brings
most
if
you're,
using
graph
or
Powershell
or
any
other
management.
You
won't
see
Enterprise
applications,
you
see
service
principle
and
you
see
an
application
and
that's
what
we're
going
to
do
with
the
demos
right.
The
main
we're
going
to
do
a
lot
of
demos
to
understand
what
how
these
things
work
and
what
is
ThinkPad.
B
What
about
our
only
permissions
so
app
only
permissions
are
the
way
that
the
application
tries
to
get
information
about
who
is
accessing
or
what
the
application
can
do
at
a
resource
application.
Let's
say
this
way
right.
This
information
may
be
in
the
token
already
like
the
most
common
thing
that
you
probably
heard
of
is
what
we
call
up
rows.
So
we
know
the
ID
of
the
application
that
is
calling.
We
know
what
rows.
B
This
application
is
remembered
off
to
access
a
specific
resource,
I'm
using
keyboards,
because
it's
a
quite
common
scenario
and
that
we
will
illustrate
what
we're
going
to
talk
about
and
when
we
start
to
to
think
about
least
privilege
and
scoping
permissions
later
later.
Today,
in
key
vote,
you
have
the
option
to
get
an
access
token
for
an
Azure
ID
to
Azure
key
vote
right,
so
that
service
you
can
request
Azure,
ID
and
access
token
for
this
service,
and
you
send
the
access
token
to
that
service.
B
But
that
service
has
a
separate
database
where
it
does
check
the
permissions
that
that
your
service
principle
has
your
application
has.
So
we
will
look
into
an
external
system
I'm
representing
that
as
another
database,
but
that
could
be
something
it's
an
internal
thing
that
Kevo
does
but
could
be
your
application,
checking
a
database
or
a
configuration
file
to
check
if
that
application
is
authorized
to
do
something
in
case
of
key
votes.
This
is
done
by
what
they
call
key
vote
policies,
our
access
policies.
B
B
B
Well,
if
the
key
vote
scenario
get
clear.
So
let's
talk
a
bit
about
how
do
we
get
our
app
only
access
tokens
and
that's
we're
going
to
move
to
to
the
demo,
so
the
Powershell
script
is
there
just
for
your
reference,
so
I'll
actually
do
it
live
and
let's
see
how
this
goes.
So
let
me
share
my
screen
first.
B
So
this
is
the
key
vote
screen
still
just
for
reference
where
we're
going.
We
were
talking
about
that
a
minute
ago.
So
that's
how
you
set
the
an
access
policy
and
then
you
just
take
a
service
principle
and
give
access
to
a
key,
and
we
just
need
an
access
token
to
do
that.
Let's
do
that
then.
So,
let's
do
some
configuration
here.
We
will
start
with
an
application
fresh,
so
we're
going
to
create
an
application.
B
Right
so
we
do
have
some
interesting
information
here.
I
will
actually
show
you
something
to
I'll
talk
about
the
permissions
first,
so
you
see
that
we
do
have
by
default
user.read
permission,
but
because
our
scenario
is
about
application,
only
permissions
that
doesn't
matter
right.
So
we
don't
have
any
application
permissions
assigned
to
this
application
and
that's
what
we
want.
B
B
Let
me
copy
and
paste
this
somewhere,
so
I
don't
lose
it
okay,
so
we
should
be
good.
So
that's
what
we
need.
Let's
go
to
Powershell
now,
so
we're
using
msrps
because
just
to
record
to
request
access
tokens
in
an
easier
way,
and
so
you
can
see
the
access
token
is
a
Powershell
implementation
of
the
install
Library
we're
going
to
use
the
the
client
credential
scenario.
So
that's
my
tenant
ID.
B
B
And
an
important
thing,
so
one
very
important
scenario
here:
one
topic
here
is
that
we
need
to
to
set
a
scope
for
MSO,
so
in
MSO
or
in
Azure
ID.
Every
time
you
request
a
token,
you
need
to
tell
what
is
the
scope
and
for
application
only
permissions.
This
scope
is
always
dot
default
right,
so
dot
Defoe
actually
tells
Azure
AG
to
issue
an
application
token.
So
that's
what's
happening
behind
the
scenes.
So
give
a
token
for
that
application.
It
doesn't
matter
what
permissions
are
set
or
if
you
have
permissions,
they
will
come
with.
B
If
you
don't
have
permissions,
because
that's
where
our
scenario,
you
won't
have
anything,
another
important
thing
is
that
the
first
part
of
the
request
tells
what
is
the
resource
you're
trying
to
connect
in
this
case
we're
requesting
graph.
So
in
the
keyboard
example,
you
would
use
the
keyboard
endpoints
or
the
key
vote
identifier,
so
you
would
get
a
token
for
key
vote
in
our
case,
we're
going
to
request
a
token
for
graph
with
the
standard
set
of
permissions
that
you
remember
is
known
right.
We
don't
have
any
permissions.
B
And
if
I
didn't
make
anything
wrong,
it
does
all
right,
we
will
be
able
to
see
d-axis
and
there
you
go
right,
so
stop
it.
No
permissions
were
set
and
I
just
requested
some
an
access
token
for
Azure
Ag
and
that's
the
key
thing
from
what
we're
going
to
do
for
now
out
right.
So
there's
no,
no
permissions
specific
for
that
application.
My
application
just
requested
a
token
for
a
graph
and
I
and
I
was
given
a
token
for
graph.
B
I
have
a
coordination
problem
today
with
copying.
Please
there
you
go
right,
so
I
requested
a
token
for
graph
and
that's
what
I
got
so
the
audience
for
that
access
token
is
graph.
If
you
play
around
here,
you
see
the
app
IG
and
the
display
name
are
actually
my
client
ones.
There
are
other
some
other
things
here,
but,
to
be
honest,
it
doesn't
really
matter
for
us.
This
token
is
actually
meant
to
be
consumed
by
graph.
No
other
application
that
receives
these
tokens
should
do
anything
with
that,
because
they
are
not
meant
to
it.
B
So
it
doesn't
matter,
that's
graph
problem.
What
is
it's
going
to
do
with
that?
Okay,
so
graph
will
decide
when
it
receives
a
token.
The
access
token,
in
our
request,
we'll
look
into
it
and
say
what
this
access
token
can
do
right.
One
thing
that
is
interesting
to
know
is
that
there
is
this
special
claim
that
we
have,
or
that
is
in
a
regular
app.
This
is
an
optional
claim
and
in
graph
that
is
it's
by
default,
there's
a
claim
called
ID
type.
That
will
tell
you
if
this
is
an
app
token
right.
B
C
B
C
D
Yeah
just
wondering
so
with
app
registrations,
you
don't
you,
don't
really
have
the
option
to
store
tags,
but
you
have
the
the
need
from
the
support
point
of
view
to
manage.
Who
is
the
owner?
Where
do
we
go
for
support
like
you
know
it
because
inevitably
you'll
end
up
with
hundreds,
if
not
thousands,
of
app
registrations,
just
wondering
if
there's
any
best
practice
advice
you
have
for
that.
B
All
right
so
I'll
take
a
question
then,
in
a
different
perspective,
so
in
or
also
open
ID
connect.
So
you
need
to
create
an
application
for
everything
right,
so
the
best
practice
is
to
split
everything.
So
if
you
have
an
API,
you
need
to
create
an
about
presentation
for
that
API.
If
you
have
something
that
calls
that
API.
B
That
needs
to
be
a
separate
app,
for
instance,
if
it
is
a
web
application
that
runs
in
the
browser,
a
JavaScript
application,
you
will
need
a
registration
if
it
is
a
native
app
another
registration
if
it
is
a
mobile
app
another
registration.
So
it's
usually
the
concept
is
that,
obviously
you
can
shortcut
this
and
just
create
one
single
app
for
everything.
Just
like
saml.
B
Does
that
doesn't
have
this
concept,
but
that's
not
a
good
practice,
because
you
do,
you
won't
be
able
to
control
which
application
can
do
different
things
right,
because
when
you
create
multiple
applications,
you
can
control,
not
only
the
user,
but
also
what
the
application
can
do.
So
imagine
that
you
have
an
application.
That
is
a
management
tool
that
you
know
that
runs
on
Windows
and
you
want
that
application
to
have
full
access
to
the
whole
management
API.
But
then
you
have
a
web
version
of
it
that
runs
on
mobile
phones.
B
That
you
want
to
restrict,
though
you
can,
they
use
the
same
API,
but
you
don't
want
them
to
access
the
same
functionality,
so
you
can
restrict
that
in
different
ways.
So,
if
you
just
shortcut,
isn't
great,
like
you
keep
reusing
applications,
so
you
wanna,
you
won't
have
this
functionality
the
more
share,
the
more
problem
you
may
have.
D
Yeah
no
I
understand
that
I
I'm,
sorry
I
might
have
missed.
I
might
have
misled
you
with
my
question.
What
I'm
asking
is
more
about
the
metadata
that
that
we
would
normally
have
so
for
pretty
much
any
object
in
Azure
in
Azure.
We
would
store
Tags
to
help
us
know.
Who,
who
does
this
object
belong
to,
and
the
problem
I
see
with
the
app
registrations?
Is
that
they
exist,
but
you
really
don't
have
any
way
to
refer
back
to
who
owns
it?
B
Gotcha,
so
for
that
specific
point,
so
there
is
the
the
ownership
concept
that
we're
going
to
talk
about
later
is
related
to
security.
So
the
owner
today
for
applications
is
more
about
who
can
manage
that
app,
but
you
do
have
tags
with
application
realizations,
although
they
are
not
in
the
UI.
You
can
change
that.
You
can
add
tags
to
the
application
and
that's
possible
there's
something
called
security
attributes
now
that
we
introduced
that
you
can
consume
and
can
mix
that
with
conditional
access
and
I'm,
pretty
sure
that
the
UI
doesn't
show
it.
B
B
It's
an
array
of
strings,
so
you
can
just
put
in
a
value
that
you
want
to
and
that
will
be
persisted
in
the
service
principle
too
perfect.
Thank
you.
Welcome
all
right.
So
one
of
the
resources
that
we
usually
consume
is
this
automation,
application
with
services
and
demons,
and
these
tasks
are
actually
Azure.
Id
objects
that
are
behind
Microsoft
graph,
so
Microsoft
graph
is
an
API
that
gives
you
access
to
a
lot
of
different
Microsoft
features
or
products
like
Microsoft,
365
windows
or
Enterprise
mobility
security.
B
So
it
actually
gives
you
an
unified
programmability
model
that
you
can
get
to
access
to
anything
Microsoft
365
without
needing
to
learn
how
SharePoint
does
this
or
how
exchange
does
that?
So
it's
Unique,
it's
a
single
endpoint
for
everything
and
in
that
direction
it
means
that
the
the
the
end
point
or
the
whole
graph
API
is
the
Slicer
in
different
permissions
right
and
that's
how
we
control
that
access.
So
we
use
what
we
call
Microsoft
graphs,
API
permissions,
all
right,
so
graph
permissions.
B
They
are
split
in
different
in
three
pieces,
so
the
first
one
is
the
resource.
What
you're
trying
to
access?
So
a
user,
a
group,
a
mail,
a
mail
setting
a
drive,
a
file,
a
SharePoint
site,
there's
a
bunch
of
things
that
you
can
access,
then
what
type
of
operation
that
you
want
to
do?
Usually
they
are
read
or
read,
write.
There
is
one
exception
in
the
screen
that
I'll
talk
about
in
a
minute,
and
then
you
have
constraints
right,
so
constraints
are
actually
saying
what
you
can
do
inside
this
this
these
operations.
B
For
that
specific
object
for
app
permissions,
they
are
usually
o.o,
meaning
that
you
usually
will
have
access
to
everything.
So
if
you
have
a
permission
that
is,
user.readwrite.org
will
give
you
your
application,
the
permission
to
do
anything
into
any
user
in
your
tenant
right.
So
that
is
the
biggest
problem
that
we
have
with
Microsoft
graph
permissions.
That
is
too
permissive.
B
B
So
there's
a
difference
between
that,
but
the
idea
is
the
same
so
with
something
dot
create
so
you'll
be
able
to
that
application
will
be
able
to
create
objects
without
a
signage
in
user
right
and
on
it
by
the
application
will
be
able
to
manage
only
the
objects
that
it
sounded
that
it
owns
So.
If
a
service
principal
owns
a
group,
the
application
will
be
able
to
manage
that
group.
If
the
applic,
if
it
manages
an
application
on
the
service
principle,
it
will
be
able
to
manage
that
service
principle.
B
Recently,
we
introduced
something
called
dot
selectric,
so
dot
selected
is
actually
part
of
SharePoint
online,
so
within
SharePoint,
but
now
we,
when
you
do
sites
dot
selected,
you
go
to
SharePoint
and
you
say:
well,
this
service
principle
can
access
these
sites.
So,
instead
of
accessing
all
SharePoint
sites,
you're,
all
you
can
control
which
SharePoint
sites
these
users
can
access
talk
about
it
in
the
end.
So
when
we
talk
specifically
about
SharePoint
and
an
exchange
online,
but
just
for
you
to
know
about
that.
B
Another
thing
about
exchange
online
is
that
exchange
is
special
and
they
don't
have
the
constraint.
The
permissions
in
exchange.
Don't
have
the
constraint
part,
but
you
need
to
know
that
they
are
all
by
default.
So
when
you
have
mail.read,
it
means
mail.read.org
for
application
permissions.
So
you
can
that
service
principle
that
application
will
be
able
to
read
all
mailboxes
available
in
exchange
right.
So
without
any
restrictions
same
for
calendar
same
for
what
else
you
can
get
in
SharePoint
tasks
or
in
exchange
so
tasks.
B
Anything
that
is
available
in
exchange
will
be
you'll,
be
able
to
do
that
on
restricted
again,
we'll
cover
that
later.
How
do
we?
How
can
we
how
we
can
change
that?
So
we,
but
before
we
talk
about
exchanging
SharePoint,
we're
going
to
cover
one
thing
that
is
quite
important
and
it's
usually
forgotten
so
active
directory
Azure
active
directory
also
has
scoping.
So
the
first
is
coping
that
you
just
saw
is
the
scoping
for
the
application
using
application.
Permissions
they're
also
known
as
zapros.
B
So
if
you're
developing
your
own
application,
you
will
create
approach,
so
they
are
the
same
as
application
permissions
in
graph
and
they
will
be
this
user.reach
and
actually,
let's
do
that
in
a
portal.
So
we
look
into
that.
So
I
showed
you
that
my
application
doesn't
have
any
permissions
right,
but
I
could
have
added
permissions
to
it.
So
take
Microsoft
graph,
we're
not
talking
about
delegator
permission.
Our
Focus
today
is
Automation
and
devops.
So
we're
looking
into
application
permissions
out.
I
talked
about
mail,
so
there
you
go
so
you
see
so
the
newest
permissions.
B
B
If
I
take
a
user,
you
see
that
user
will
be
a
user.read
or
user.readwrite.all,
meaning
that
there's
no
restriction
so
whatever
I
give
that
permission,
that
permission
will
actually
be
used
for
any
any
object
in
the
directory,
but
well,
let's
step
back
and
then
before.
We
understand
what
to
understand
what
I'm
going
to
show
right
now,
so
you
remember
that
my
token
doesn't
have
any
permission
right.
So
we
created
a
token
like
this,
so
we
have
an
access
token
for
graph
but
doesn't
have
any
permission
to
make
it
more
interesting.
B
I
will
remove
this
permission,
I'll
leave
it
blank.
All
right.
I
can
even
request
a
new
access
token,
but
it
won't
change
anything,
but
just
to
make
it
clear
that
we
don't
need
any
permissions,
but
we
do
have
an
access
token.
So,
let's
play
around
with
this
access
token
now.
So
let
me
show
you
something:
let's
go
back.
B
So
now
that
I
have
an
access,
token
I'm,
going
to
use
the
graph
SDK
to
connect
to
graph.
There
was
the
same
token
that
you
saw
before
so
we're
connected
with
that
token,
but
then
I
will
try
something
right.
You
know
that
this
application
doesn't
have
any
permission
is
connected
to
graph,
but
let's
see
if
it
works,
okay,
mg
user.
B
But
what
I
wanted
to
show
is
that
when
you
do
connect
graph
get
mg
user
will
fail,
but
not
with
the
error
that
we
saw,
we
would
receive
an
access
denied
right
because
we
can't
use
that,
but
we
do
have
access
to
some
objects
with
that
token,
so
there
is
a
permission
that
is
default.
That
is
the
permission
for
the
object
itself.
B
So
because
that
service
principle
has
an
application
and
the
service
principle,
it
can
connect
to
itself
and
read
the
information
so
if
I
run
get
mg
application,
even
with
that
token,
without
any
permission,
I
will
be
able
to
see
the
details
for
that
application
and
the
related
service
principle.
The
catch
is,
you
need
to.
You
can
browse
because
we
don't
have
browse
permissions,
so
you
need
to
know
the
object
ID
right.
So
the
idea
is
that
we
get
this
object
ID
and
then
we
can
query
that
object
with
that
specific
token.
B
B
See
if
it
works
we'll
give
it
some
time
to
to
install
I.
Just
don't
want
to
change
the
right
now.
Otherwise
I.
Will
you
see
that
it's
different
so
the
first
demo?
The
idea
is
that
I
will
show
you
that
this
would
work
right
even
without
any
graph
permissions,
because
we
do
so.
The
objects
can
read
itself,
but
if
I
try
anything
else
in
graph,
because
if
we
don't
have
permissions,
it
will
fail.
So
that
is
the
initial
scenario.
B
B
B
User.Read
all
or
read,
write
all
do
admin
consent
and
that
would
work
the
problem
with
that
permission
is
that
is
unrestricted,
so
we're
going
to
be
able
to
do
anything
result
the
users
and
without
in
all
the
attributes.
That's
not
all
I
want,
so
that
we
want
to
reduce
the
permission
so
be
more
specific
on
what
this
can
be
done,
what
can
be
done
and
what
objects
we
want
to
change.
B
So
we're
not
going
to
do
that
that
we're
not
adding
any
permissions
here,
but
we're
going
to
use
another
resource
we're
going
to
use
the
user
administrator
directory
directory
row.
Remember
when
I
talked
about
the
idea
of
having
a
key
votes
that
will
check
its
own
policies
to
see
if
that
service
principle
has
access
to
the
key.
So
here
is
the
same
thing.
So
Azure
AG
controls
access
to
objects
using
using
rows.
So
you
have
a
role:
a
road
gives
access
to
users.
B
B
Right
I
can
check
what
the
permissions
that
are
assigned
to
this
row
and
you
can
do
that
with
all
the
rows
that
are
around
there
and
you
can
see
everything
that
that
role
can
do
right,
and
actually
you
will
see
that
there
is
a
bit
more
stuff
here.
If
you
look
into
groups,
you
see
that
there
are
some
group
permissions
around
here
too.
B
You
see
so
the
user
administrator
actually
has
some
rights
with
with
groups
and
a
bunch
of
things,
and
then
you
say
okay,
but
this
is
not
what
I
want
it's,
probably
even
more
than
users,
dot
read
or
read,
write
all
what
you
can
actually
do
is.
If
you
go
back
to
Rosen
administrator,
you
can
create
a
custom
row
and
by
creating
a
custom
row
you
will
be
able
to
tell
which
permissions
you
want
to
give.
So
all
the
Azure
ID
directory
permissions
are
here
only
directory
right.
B
So
we're
talking
about
exchange
briefly
in
SharePoint,
we'll
talk
about
that
in
next
slide,
but
these
are
only
available
for
the
directory
permissions.
So
you
see
user
licenses
so
they're
pretty
specific.
So
you
can
do
a
lot
of
very,
very
specific
information
about
the
user
and
you
can
just
delegate
that
and
I'm
talking
about
users
and
groups,
but
you
can
see
devices
you
can
see
applications.
You
can
see
service
principles
anything.
B
So
if
you
want
to
further
filter
or
scope
the
permissions,
you
can
use
a
custom
permission,
a
custom
role,
but
if
you
want
to
do
just
like
user
manager
or
applications,
we
were
talking
about
applications,
so
application
manager
or
application
administrator
application
developer.
So
all
these
rows
they
can
be
done
with
the
service
principle.
So
let's
take
the
user,
one
user
administrator
and
let's
see
how
it
looks
like
so
under
assignments,
we're
going
to
add
an
assignment,
and
that
is
the
key
thing.
B
B
B
So
now
this
is
like
a
permanent
thing,
so
you
cannot
use
pimp
to
elevate
the
axis
because
it
doesn't
have
a
user.
So
there's
no
elevation,
so
it's
always
permanent
right.
So
you
do
the
assignment
and
that's
it
so
now.
I
need
to
request
the
token
again
so
when
I
request
the
token
again
that
information
will
be
actually
in
the
token,
so
I
think
that
at
least
should
work.
B
B
You
see,
there's
nothing,
many,
not
no
much
difference
in
here.
Usually
what
may
happen
is
that
we
will
see
the
groups
that
we
add
into
this
width
column
all
right,
so
these
are
directory
rows
that
we
have
access
to.
So,
if
you
start
increasing
it
may
be
that
if
you
don't
refresh
here,
I
may
even
okay
call
it
again.
B
There
you
go
there,
you
go
now.
I
have
a
new
way
you
see,
but
this
is
only
relevant
for
Azure
ID,
for
so
graph
will
received
that
we'll
check
into
Azure
ID
if
that
road
actually
has
whatever
the
user
is
trying
to
do
and
we'll
give
it
access
or
not
right,
so
that
access
will
actually
be
controlled
by
something
completely
different
from
what
we're
going
to
we
did
before.
B
So,
instead
of
giving
full
control
through
users
full
control
to
groups
full
control
to
Applications
mailboxes
or
whatever
we
have
there,
what
we're
going
to
use
is
directory
rows
to
restrict
that
access
so
and
we
use
can
use
the
custom
rows
to
be
very,
very
specific.
So
if
you
want
the
user,
if
you,
for
instance,
acquire
a
common
scenario
that
I've
seen
before
with
customers,
they
didn't
want
a
principle
to
be
able
to
delete
objects.
B
So
your
body,
do
you
create
a
custom
row
that
will
only
allow
them
to
create
things
but
never
delete
right
and
then
you'll
be
able
to
do
that
and
play
around
with
these
things.
So
it
will
be.
You
can
control
that
change
it
here,
and
there
is
one
more
thing
here
when
we
follow
that
pass.
When
we
go
that
route
the
road
route,
there
is
another
thing
that
is
available
that
we
can
also
use.
B
So
when
you
go
to
rows
and
admins
we're
not
only
talking
about
rows
itself,
but
where
is
that
okay
here,
so
we
do
have
ajimista
TV
units
bye?
Well,
what
does
that
mean?
So
that
means
that
the
administer
that
the
app
like
we
can
even
scope,
not
only
what
users,
what
permissions
the
application
can
do
with
in
the
users,
but
we
can
also
scope
what
users
that
application
can
modify
or
can
update
right,
because
what
we
can
do
here
is
actually
in
an
admissions
TV
unit.
We
can
perform
an
assignments
right.
B
So
when
you
go
to
rows,
you
see
user
administrator
here
and
when
we
add
the
assignments,
obviously
because
I
added
before
you
won't,
probably
it
won't
work,
you
won't,
it
may
work,
but
it
won't
make
sense
right.
So
I
can
add
that
the
service
principle
for
user
administrator
under
the
user
administrator
role,
but
that
will
be
specific
to
that
administer
TV
unit.
B
Digit
cool,
so
when
we
go
back
to
the
ajimisa
TV
unit,
you
see
that
these
are
the
only
users
that
that
application
can
manage
same
for
groups
for
devices
and
in
the
future.
You
also
presume
you'll
be
available
you'll
be
able
to
do
that
for
other
objects,
as
we
start
work
as
we're
working
on
more
objects
that
will
be
available
within
an
admin
unit.
B
Right
does
it
make
sense
all
right
so,
instead
of
giving
access
to
everything
to
an
application,
that
is
a
common
complaint
that
we
have
that
all
graph
permissions
are
too
permissive.
We
don't
we
don't
want
to
do
graph
permissions
to
everyone.
I,
don't
want
that
application
to
modify
everything.
So
would
that
address
your
scenario?
B
Do
you
have
that
kind
of
concern
so,
instead
of
being
more
specific
in
the
types
of
permissions
that
we
want
to
to
give
I
just
want
to
highlight,
this
is
actually
available
for
a
while.
It's
just
like
it's
documented,
but
it's
lost
in
in
the
middle
of
the
Microsoft
documents,
and
it's
not
that
clear,
but
this
just
works
right.
Actually
there
is
a
bonus.
You
saw
that
I
was
able
to
get
an
access
token
for
graph
right
and
I
could
get
access
tokens
for
any
applications
that
you
create.
B
B
We
can
control
that
we
can
restrict
the
reason
you
can
get
a
token
is
because
every
app
registration
by
default
has
assignment
required
set
to
no
that's
the
reason
you
can
get
a
token
for
the
application,
even
if
you
don't
have
any
specific
permission
or
set
to
it.
If
you
change
that
to
yes,
it
will
be
mandatory
to
have
your
service
principle
included
here,
all
right.
Otherwise,
you
won't
be
able
to
to
access
the
application
or
get
a
token
for
that
application.
B
B
Make
sense,
so
let
me
stop
around
here
and
see
if
there
are
questions
in
the
in
the
chat
or
if
you
want
to
come
on
mute
too.
Okay,
so
I'm
rolling
backwards.
So
there's
a
question
about:
how
do
we
scope
the
API
permission
to
a
Target
Security
Group?
Only
there
are
two
aspects:
do
you
want
to
manage
one
single
group,
or
do
you
want
to
manage
the
members
of
the
security
group
join
common
on
mute?
It
will
be
cool.
B
I
got
your
name
right,
oh
okay,
so
that
Ruby
was
adding
such
a
unit,
so
it
will
do
user
administrators.
So
don't
do
user
video!
You
should
not
do
because
if
you
the
permissions,
they
are
combine
it.
So
if
you
do
user.read.org
that
will
actually
give
everything
just
there's
a
remark.
I
need
to
give
you
in
a
minute,
but
the
idea
is,
though,
you
go
to
an
admin
unit
and
you
do
user
administrator.
B
You
want
to
manage
all
the
users,
so
you
want
to
manage.
The
members
of
the
group
is
that
it
is.
There
are
two
ways
of
doing
this.
So
that's!
So!
If
you
want
to
manage
the
users
you,
you
can't
do
that
with
groups,
so
you
create
an
admin,
unity
and
you
put
your
users
here
and
then
you
can
manage
only
the
users
around
here.
If
you
want
to
manage
only
that
group,
you
put
the
group
here
and
then
you
go.
You
do
group
by
administrator.
B
A
Hey
Michael,
this
is
something.
Can
you
hear
me
now?
Yes,
oh
good.
Oh
thank
you.
Thank
you
for
the
clarification,
so
the
the
original
behind
this
question
is,
you
know
if
the
users
request
permissions,
for
example,
user
dot
read,
write
all
right,
so
are
we
able
to
scope
that
permission
to
a
specific,
targeted,
Security
Group
only
instead
of
keeping
it
Global
across
the
tenant,
so
that
that
was
the
background
requirement
question.
B
Yeah
and
we
have
Dynamic
membership
too.
So
if
you
have
like
you
can
use
attributes,
as
as
the
question
that
happened
before
they
came
before
Oh,
you
can
use
a
tag
or
something
I.
Don't
think
you
can
filter
attack,
I'm,
sorry,
but
you
can
play
around
with
some
attributes,
so
you
can
create
Dynamic
membership,
the
user,
you
that
service
principle
can
manage
users
in
specific
region,
so
you
can
create
rules
here.
B
Welcome
so
by
the
way
you
you
mentioned,
you
read
write.
Oh
that's
a
good
thing.
The
problem
with
read
is
that
we
can't
cons.
We
can't
block
reach
in
the
tenant
right,
so
every
object
is
read
a
readable
form
anything.
So
if
you
give
read
permission
in
the
tenant
or
you
always
read
all
the
all
the
uses
right,
so
that
is
our
limitation.
Let's
say
the
rights
but
read
write.
We
can
control
again
just
make
it
very
very
clear.
So
you
can't
do.
B
B
Chelsea,
so
Jesus
is
too
blank,
always
blank.
So
if
you
want
to
use
admin
units,
you
don't
put
anything
in
here,
you
can
combine,
but
the
problem
is
that
the
most
permissive
will
work.
So
you
should
just
give
read
write
all
here.
We
will
be
hit
right
wrong,
so
you
should
not
give
anything
here,
so
you
can
control
that
via
rows
and
admin
units
got
it.
Thank
you
welcome,
so
any
questions
that
I
lost
there.
E
B
Yes,
there
are
four
different
ways
of
getting
access
tokens
so
in
the
UI
I
use
it
the
secret
right,
so
straightforward
certificates,
as
you
mentioned,
but
we
do
have
Federated
credentials.
So
you
can
use
tokens
from
other
identity
providers
and
exchange
that
token
by
an
Azure
AG
token.
So
I
think
the
most
common
scenario
is
GitHub.
So
if
you
get
a
token
from
GitHub,
GitHub
comes
to
Azure
ID
send
the
GitHub
token
and
we
exchange
that
by
another
ad
access
token.
B
B
Yeah
four
is
not
in
the
UI,
so
four
is
manage
identities.
So
if
you
have
a
resource
that
is
running
on
Azure
like
an
Azure
function,
an
Azure,
VM
or
anything
I
think
even
powerapps
can
do
that.
So
there
is
the
concept
of
manage
identities
and
our
managed
identity
has
a
trust
relationship
within
the
platform,
meaning
that
you
know
every
manage
identity,
Creator
service
principle
in
Azure
AG.
It
doesn't
show
in
the
UI
all
right.
B
So
you
won't
see
it
here,
but
you
can
do
the
same
things
that
we
were
talking
about
here,
but
you
may
only
need
to
use
Powershell
to
do
that,
because
the
most
of
the
time
you
won't
be
able
to
do
that
through
the
UI,
but
that's
the
safest.
You
can
do
because
there's
no
password
involved
no
credentials,
but
the
only
thing
is
that
you
need
to
be.
You
need
to
have
the
resource
running
on
azure.
B
Doesn't
show
you
up
here,
you
don't
have
an
operation
and
it
doesn't
show
in
the
UI.
So
that
is
a
common
scenario,
for
instance
with
keyword.
So
in
key
vote
you
use
the
manage
identity
to
set
the
permission
to
the
key.
But
although
you
won't
see
in
the
UI,
you
can
do
that
via
VIA
Powershell.
To
do
the
assignments
as
as
you.
E
B
Exactly
yeah,
if
that
is
that's,
why
we
don't
we
used,
we
recommend
to
use
client
credentials
for
service
principles.
Okay,
thank
you.
You're
welcome
and
just
realized.
We
are
on
time
so
quickly.
So
the
part
about
exchange
online
in
SharePoint
so
exchange
online
in
SharePoint.
They
have
different
approaches.
B
So
exchange
online
actually
is
very
misleading
because
you
don't
you
do
the
access
permissions,
the
mail
read
and
everything
as
you
would
have
access
to
everything
in
exchange,
but
the
exchange
administrator
needs
to
go
on
the
exchange
side
and
exchange
online
and
create
a
policy
to
restrict
what
that
service
principle
can
access.
So
you
need
to
work
together
with
the
exchange
administrator
to
scope
down
the
the
access
to
the
mailboxes.
B
Sharepoint
is
different.
Sharepoint
works
with
the
selected
concept.
We're
talking
about
so
you
grant.
You
do
give
the
permission.
You
don't
give
the
all
permission,
but
you
give
selected.
Then
you
go
on
SharePoint
and
then
you
say:
oh
this
service
principle
can
access
these
sites,
so
files
is
under.
Preview
will
come
soon
so
before
we
close,
then
so
just
remember,
but
permissions
are
cumulative,
so
whatever
you
give
you
get.
So
if
you
mix,
then
it's
always
the
most
permissive.
B
So
if
you
do
group
administrator,
Road,
plus
user,
read
write
all
you
would
have
both
of
them,
so
they
will
work
together.
They
will
combine
so
the
resource
app
is
responsible
to
validate
the
token
so
check
what
it
can
be
done.
Azure
ID
rows
will
scope,
object,
type
and
permissions.
So
what
permissions?
To
what
objects
and
agimist
achieving
units
will
scope
within
the
same
object
types
so
which
users
you
will
have
permission
to
do
which
groups
which
devices
you
you
wouldn't
need
to
manage
right.
B
So
I
will
move
to
the
last
slide
because
then
we
have
all
the
information
about
the
call.
So
there
is
the
survey
link
here
in
the
slide.
There
is
the
link
for
where
the
public,
where
we're
going
to
publish
the
the
com,
the
call
or
the
contents,
so
you
will
see
the
video
under.
Let
me
put
that
in
the
chat
all
right,
so
first
link
for
this,
for
the
feedback.
Second
link
is
when
the
recording
will
be
available,
so
it
will
be
in
the
Microsoft
365
Community
PNP.
B
The
next
application
developer.
Events
on
the
the
page,
the
events
page
on
the
next
call
we'll
have
will
be
on
May
18.
We
don't
have
a
topic
yet
so
feel
free
to
submit
it,
keep
an
eye
on
the
on
the
identity
blogs
because
then
I
will
post
the
scripts
there,
probably
today
or
tomorrow.
So
you
see
you
can
get
the
Powershell
and
make
sure
that
you
make
it
work
unlike
me,
and
don't
update
anything
when
you're
going
to
do
the
demo
right
so
I'm
still
around.