Access denied to "Configure" page about ipam HOT 5 CLOSED

Great, thanks for support. I am closing this issue.

from ipam.

Hi @azheaipl, thanks for reaching out!

There are many nuances to creating the required App Registrations so it's likely something was overlooked during the manual creation.

I see above that you mention that you are an Owner of the Tenant Root Group, but have you assigned the Engine Service Principal (created from the App Registration) as a Reader on the Tenant Root Group?

Also, the UI App Registration must be added under "knownClientApplications" in the Manifest of the Engine App Registration.

I'm happy to help review these configuration items with you if you'd like. Simply drop me an email to [email protected] and we can setup some time to hop on a meeting during a time that is convenient for you.

from ipam.

Hi @DCMattyG

Indeed, the Engine Service Principal was missing "Reader" role on the Tenant Root Group. It works, many thanks.
May I have another question if you don't mind :) What are consequences if we remove Directory.Read.All permission for UI App Registration? This is the only one permission which requires admin consent and we might not get it approved from our AD team.

from ipam.

That permissions is what allows you to view the list of Users/Service Principals in the UI so you can select them and add them as Admins in the IPAM platform.

NOTE: This is a permissions all users ALREADY HAVE. This is a delegated permission which means the App Registration itself doesn't have the permission, this is based on the USERS permission accessing the UI. This does not grant any higher permission than a user already has.

It might be good to read up on Delegated vs. Application permissions so you feel more comfortable with this API permission setting:

https://learn.microsoft.com/en-us/entra/identity-platform/permissions-consent-overview#types-of-permissions

Hope that helps!

from ipam.

Excellent, so glad you were able to get everything working!

from ipam.