列出有权访问企业应用程序AzureAD RBAC的组

Question

I'm trying to use graph REST api / python of AzureAd. I'm logged in with service principal.

Is it possible to list users/groups which has access to enterprise application?
If so: How?

Answer 1

Look in the RestAPI if you found what you need: https://msdn.microsoft.com/Library/Azure/Ad/Graph/api/api-catalog

If you don't find it, it's likely not possible. If you found it, this RestAPI is exposed in Python by the azure-graphrbac package:

• https://pypi.python.org/pypi/azure-graphrbac
• https://docs.microsoft.com/python/api/overview/azure/activedirectory

If you found it in the RestAPI, but not in the Python package, open an issue for support to the endpoint your need:

https://github.com/Azure/azure-sdk-for-python/issues

(I work in the Azure SDK for Python team at MS)

Answer 2

Thanks to @laurent-mazuel I found the problem that Navigation Properties are missing from SDK

Workaround:
From documentation: Service Principal Entity has Navigation property appRoleAssignedTo . Then the solution was to use raw API endpoint as folows: https://graph.windows.net/{tenant_id}/servicePrincipals/{service_principal}/appRoleAssignedTo/ and extend ServicePrincipalOperations in azure-sdk-for-python

Which returns AppRoleAssignment entities.