Removed guidance suggesting assigning Microsoft Graph permissions to SQL managed identity #10139
Conversation
|
@MarkMpn : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
prmerger-automator
bot
added
azure-sql/svc
Change sent to author
security/subsvc
labels
|
Learn Build status updates of commit c12037c: ✅ Validation status: passed
For more details, please refer to the build report. |
|
Can you review the proposed changes? IMPORTANT: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
bot
added
the
aq-pr-triaged
|
@PratimDasgupta - Hey Pratim, can you please verify this? Thanks. #assign:PratimDasgupta |
|
Hi @MarkMpn - Thanks for the PR. I've confirmed with the Product Team that this is incorrect. The doc https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-directory-readers-role?view=azuresql#assign-the-directory-readers-role is a little outdated and Directory Readers can be replaced with the permissions mentioned in https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-user-assigned-managed-identity?view=azuresql#permissions I'll make the updates to the Directory Readers doc. For now, I'll close this PR, but please feel free to provide further feedback. Thanks! |
As noted in https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-directory-readers-role?view=azuresql#assign-the-directory-readers-role, assigning individual Graph permissions to the managed identity is not sufficient to allow an application user to create another user - the managed identity must have the Directory Readers role instead.
The current wording suggests this is the best way to apply the permissions because the Directory Readers role includes other permissions that are not required, which leads to wasted time trying to get this set up when actually the Directory Readers role is required.