title: How To Use Service principal To Assign A Role To Another Service Principal
body: <p>How can I give a service principal access to assign a role to a resource it created?</p>
  
  <hr>
  
  <p>Here's the scenario.</p>
  
  <p>I...</p>
  
  <ul>
  <li>Created an Azure DevOps pipeline</li>
  <li>Created a Service Connection (which creates a service principal and grants it <code>Contributor</code> access to the entire subscription).</li>
  <li>Created a pipeline task <code>AzureCLI@1</code> using the service connection</li>
  <li>Executed <code>az group create …</code> - <strong>SUCCESS</strong> - made a resource group!</li>
  <li>Executed <code>az group deployment create …</code> - <strong>SUCCESS</strong> - deployed some stuff!
  
  <ul>
  <li>^-- (Unless I do any role assignments as part of my ARM template)</li>
  </ul></li>
  <li>Executed <code>az role assignment create …</code> - <strong>FAILURE</strong></li>
  </ul>
  
  <p><code>ERROR: Insufficient privileges to complete the operation.</code></p>
  
  <hr>
  
  <p>I tried making the service principal <code>Owner</code> instead of <code>Contributor</code>.  No difference.</p>
  
  <p>This made me understand (kinda) why: <a href="https://stackoverflow.com/questions/52285608/azure-service-principal-insufficient-permissions-to-manage-other-service-princip">Azure Service principal insufficient permissions to manage other service principals</a></p>
  
  <p>Which lead me here: <a href="https://docs.microsoft.com/en-ca/azure/devops/pipelines/release/azure-rm-endpoint?view=azure-devops#failed-to-assign-contributor-role" rel="noreferrer">https://docs.microsoft.com/en-ca/azure/devops/pipelines/release/azure-rm-endpoint?view=azure-devops#failed-to-assign-contributor-role</a></p>
  
  <hr>
  
  <p>But I'm a little stuck.  I <strong>think</strong> I'm supposed to grant my service principal some sort of role within active directory so that it's allowed to manage role assignments.</p>
  
  <p>I found this: <a href="https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/roles-delegate-by-task#roles-and-administrators" rel="noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/roles-delegate-by-task#roles-and-administrators</a></p>
  
  <p>Based on that, it seems I should give my service principal <code>Privileged role administrator</code> access.  <em>scary</em>.</p>
  
  <p>Then I found this:  <a href="https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles" rel="noreferrer">https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles</a></p>
  
  <p>Because I wanted to limit this service principal to only be able to flex the active directory powers <strong>within a single subscription</strong>, which seems to be possible in the <code>AssignableScopes</code> property.</p>
  
  <hr>
  
  <p>But two things are giving me pause, which brings me here.</p>
  
  <p>1)  I'm relatively unfamiliar with what I'm doing, and I'm tossing around big scary terms like <code>Administrator</code> <strong><em>shudder</em></strong>.  Time to consult some experts!</p>
  
  <p>2)  This seems complex.  The task I'm performing seems like it should <strong>not</strong> be complex.  I'm just trying to deploy AKS and a Container Registry in an Azure Pipeline and give AKS access to the registry.  Which is what all the docs say to do (albeit at the commandline, not in a pipeline).</p>
  
  <hr>
  
  <p>So, should I really be creating a custom role just for the subscription which gives <code>Privileged role administrator</code> type privileges assignable only to the subscription, then granting my service principal that role?</p>
  
  <p>Or... How do I do this?</p>
  
  <hr>
  
  <p>EDIT:</p>
  
  <p>I did try creating a custom role with action <code>Microsoft.Authorization/write</code>.  It failed with this error: <code>'Microsoft.Authorization/write' does not match any of the actions supported by the providers.</code>  </p>
  
  <p>But I succeeded in creating one with action <code>Microsoft.Authorization/*/write</code> as well as <code>Microsoft.Authorization/*</code></p>
  
  <p>My .json definition looks like: </p>
  
  <pre><code>{
    "Name": "...", "Description": "...", "IsCustom": true,
    "Actions": [ "Microsoft.Authorization/*" ],
    "AssignableScopes": [
      "/subscriptions/[subscriptionid]"
    ]
  }
  </code></pre>
  
  <p>After assigning the role to the service principal, it still failed with insufficient access.  I logged in locally via <code>az login --service-principal</code>, tried to use my new powers, and got this message:</p>
  
  <p><code>The client '...' with object id '...' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourceGroups/.../Microsoft.Authorization/read' over scope '/subscriptions/.../resourceGroups/.../.../providers/Microsoft.Authorization/roleDefinitions' or the scope is invalid. If access was recently granted, please refresh your credentials.</code></p>
  
  <hr>
  
  <p>EDIT:  SOLUTION </p>
  
  <pre><code>{
    "Name": "...", "Description": "...", "IsCustom": true,
    "Actions": [ 
      "Microsoft.Authorization/roleAssignments/read",
      "Microsoft.Authorization/roleAssignments/write"
    ],
    "AssignableScopes": [
      "/subscriptions/[subscriptionid]"
    ]
  }
  </code></pre>
  
  <p>This works with <code>az role definition create</code>.  </p>
  
  <p>The service principal also needs to be a Directory Reader, unless you specify the role assignment by object-id.  <a href="https://stackoverflow.com/questions/51759015/azure-active-directory-add-service-principal-to-directory-readers-role-with-pow">Azure Active Directory: Add Service Principal to Directory Readers Role with PowerShell</a></p>
  
  <p>It can be assigned to the service principal, and when executing <code>az</code> commands as that service principal, it succeeds in creating role assignments.</p>