Azure management application permissions

Question

Hi

We're testing 2023.1 and have registed the app per your guide https://adaxes.com/help/RegisterAdaxesAsAppMicrosoftAzure/

When I've tried to use the app registration for both the Cloud Service and domain registation, I've received warnings about the app's permissions.

For the Cloud Service it was

For the Azure domain, it was this

With the permissions from your guide, are there going to be tasks we can't perform?

Thanks

Matt

Answer 1

Hello Matt,

Please, make sure that the Azured AD roles specified in the corresponding section of the following help article are assigned to the application you created: https://adaxes.com/help/RegisterAdaxesAsAppMicrosoftAzure/#assign-roles-to-the-app.

If you assign the roles and API permissions specified in the article, you should be able to manage your Azure AD domain and perform Microsoft 365 tasks with no issues.

Comments

Thanks for the reply.

I have followed the instructions from your guide, I just wanted to check though as the Cloud Service is saying "Exchange administrator", whereas the guide says to grant "Exchange recipient administrator".

If that's the required permissions though then the security team will be much happeir :D

---

Hello Matt,

Thank you for pointing out the inconsistency. To perform all the tasks in Microsoft 365 and Exchange Online, the application account needs to be assigned to the Exchange administrator and User administrator roles. We will make the corresponding changes in the help article shortly.

---

Thanks for the clarification :)

---

Hello, I now i am a little bit late on that conversation. i recently made the upgrade to newest version and connected our Azure tenant to Adaxes. I followed the instructions of the articel.

I don't want to give the app registration global administration rights if it's possible but if I only give the Exchange administrator and User administrator roles i can't add users to groups. (insufficient permissions). Adding Group Administrator didn't help either. It works only with Global Administration and i didn't found any other permissions for the App registrations which would make sense to me.

Regards Tristan

---

Hello Tristan,

As per our check, it works fine with the permissions granted according to the article and the User administrator and Exchange administrator only roles assigned to the app. Make sure that you granted all the 5 permissions mentioned in the article and granted admin consent for them all.

---

Thanks for the fast reply,

yes, i have already checked that.

I can change the user attributes, just not adding to groups unless the app has global rights.

---

Hello Tristan,

The permissions are incorrect. Make sure to grant them according to the article using the manifest. If you still want to grant the permissions manually, select Application, not Dedicated.