Demo Deployment failing at assigning admin Consent for Microsoft graph about ipam HOT 13 CLOSED

Get-InstalledModule -Name Az

Version Name Repository Description

10.1.0 Az PSGallery Microsoft Azure PowerShell - Cmdlets to manage…

Get-InstalledModule -Name microsoft.graph

Version Name Repository Description

2.2.0 Microsoft.Graph PSGallery Microsoft Graph PowerShell module

from ipam.

Thank you so much! Can you please provide me with the output of this command?

Example:

from ipam.

Thanks for confirming!

Can you also store that value and try to connect to Microsoft Graph to see if you get the same error as from above?

Example:

from ipam.

Ok, I see what is going on here. The v2 of the Microsoft Graph SDK has a breaking change where it is looking for a SecureString type for the AccessToken instead of a String type which v1 was looking for.

Reference:
https://devblogs.microsoft.com/microsoft365dev/upgrade-to-microsoft-graph-powershell-sdk-v2-now-generally-available/#4-certificate-credentials

Confirmed by upgrading to v2.2.0 (like you) and testing with a SecureString

Example:

So, here is my advice for now...

Please downgrade your Microsoft Graph SDK to v1 and this should allow you to complete the deployment. I will get a bug fix done ASAP that will check for the currently installed version of the Microsoft Graph SDK and send the appropriate AccessToken type. This should be done in a few days.

Here's how to downgrade the Microsoft Graph SDK:

Uninstall-Module Microsoft.Graph -AllVersions
Install-Module -Name Microsoft.Graph -RequiredVersion 1.28.0

Hope that helps to unblock you for now, and I'll have this permanently fixed shortly. Thanks so much for finding this bug!

from ipam.

Hey there @vijaytechrepo, I'm so sorry you're having difficulties deploying the Azure IPAM solution.

Can you please provide me the versions on Azure PowerShell SDK and Microsoft Graph modules that you have installed?

Example:

from ipam.

Even Deploying with resource names retuned the same error

$ResourceNames = @{
appServiceName = 'ipamvjtestappservice01'
appServicePlanName = 'ipamvjtestappserviceplan01'
cosmosAccountName = 'ipamvjtestcosmosaccount01'
cosmosContainerName = 'ipamvjtestcontainer01'
cosmosDatabaseName = 'ipamvjtestdatabase01'
keyVaultName = 'ipamvjtestkeyvault01'
workspaceName = 'ipamvjtestworkspace01'
managedIdentityName = 'ipamvjtestmanagedid01'
resourceGroupName = '20230730VJtestAzIPAM'
}

./deploy.ps1 -Location "uksouth"
-ResourceNames $ResourceNames

from ipam.

Just scrapped org Name Matt

from ipam.

Very much appreciated!

And can you confirm that the output of this command is a very long string?

Example?

NOTE: PLEASE DON'T SHARE YOUR OUTPUT, I JUST WANT TO CONFIRM THAT THIS IS INDEED RETURNING A PROPER VALUE!

from ipam.

Yes, It does Matt I have replaced that value with XXXX in issue description. Infact I have copied it from log .

I have ran the command

(Get-AzAccessToken -Resource "https://graph.microsoft.com/").Token

and it has retuned the value

from ipam.

Nope it fails with error

"Connect-MgGraph: Cannot bind parameter 'AccessToken'. Cannot convert the "eyJ0eXAiOiJKV1QiLCJub25....." same as in description

from ipam.

Hi @vijaytechrepo, I've pushed a fix in #153 that should address this issue. Please let me know if you still have any issue, but for now the Deployment script should be able to handle both v1 & v2 of the Microsoft Graph PowerShell SDK. Thanks so much for bringing this to our attention!

from ipam.

Hi @DCMattyG I have demonstrated internally and need of global administrator rights is a stopper for us to implement this in our Organisation Environment. either way I will give a go on this on my dev env and let you know. I'm a bit tied up with day job and home chores but either way will update you how it went when i had a chance to get on with this.

from ipam.

Thanks for the update @vijaytechrepo, just as a reminder I'd like to highlight the following details:

1. Global Admin is not required to run the product. It's only required a single time to grant permission to the App Registrations as this process can only be done by a Global Admin
2. We have a two-part deployment option where a team within your organization whom has the Global Admin permissions can execute the App Registration Only step, which will create a parameter file which you (or an infrastructure team) can feed into the second step which is the Infrastructure Stack Only step. So in this case a single person won't require all of the permissions required to successfully deploy the Azure IPAM solution.

As always, if there's anything you need please don't hesitate to reach out. We're here to help!

from ipam.