Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Issue with servicePrincipals and appRoleAssignedTo in some Entra Tenants

Aperta
#275 5 commenti 0 reazioni 1 assegnatario Vedi su GitHub

@eketo-msft ci sta già lavorando.

Dal 12/1/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

bug

Bicep version

0.39.26

Resource and API version

  • Microsoft.Graph/applications@beta → works in Entra tenant A & B
  • Microsoft.Graph/servicePrincipals@beta → works in Entra tenant A fails in Entra tenant B
  • Microsoft.Graph/appRoleAssignedTo@beta → works in Entra tenant A fails in Entra tenant B

Auth flow

Automated deployment
Bicep executed on Azure DevOps Agent using a service principal (workload identity federation)..

The same configured service principal (same permissions and roles) is used in both Entra tenants.

Deployment details

Insufficient privileges to complete the operation.
Graph client request id: cbf743cc-bffd-443c-a2dd-b1da094d75ac.
Graph request timestamp: 2025-12-30T14:06:55Z.

Describe the bug

Using the same Bicep template, same service principal, and same permissions:

  • Deployment works in Tenant A
  • Deployment fails in Tenant B

Failures occur only for:

  • Microsoft.Graph/servicePrincipals
  • Microsoft.Graph/appRoleAssignedTo

The same operations executed via direct Microsoft Graph REST API
(using PowerShell / az rest) succeed.

Expected behavior:
ARM/Bicep Graph deployments should behave consistently across tenants and align with direct Microsoft Graph API behavior.

Actual behavior:
Tenant-dependent failures occur only when using the ARM-based Microsoft Graph provider.

To Reproduce

No idea.

Additional context

  • Admin consent to SP used by Azure DevOps is granted in both Entra tenants
  • Same permissions, roles, API version, and payload
  • Same service principal identity
  • Tenant settings reviewed and appear identical
  • The issue occurs only when operations are executed via Azure Resource Manager
  • Direct Microsoft Graph API calls do not exhibit this tenant-dependent behavior

This suggests additional tenant-level enforcement applied only to
ARM-mediated Microsoft Graph operations.

Lingua principale
TypeScript
Stelle
80
Fork
15
Merge medio
1h 21m
PR unite (30g)
3

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoftgraph/msgraph-bicep-types

Tutte le issue di microsoftgraph/msgraph-bicep-types

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.