Unable to assign roles from azure AD application manifest

Question

I tried to implement role-based authorization in my azure application, as described in http://www.dushyantgill.com/blog/2014/12/10/roles-based-access-control-in-cloud-applications-using- azure-ad / . Unfortunately, after I downloaded the manifest with roles, I can’t assign roles to users - the assignment button at the bottom of the Azure management portal is disabled (in the article, the action I want to perform is in the 4th screenshot), Has anyone encountered with something like that? The following is the appRoles part of my application manifest:

"appRoles": [ { "allowedMemberTypes": [ "User" ], "description": "Can do some stuff", "displayName": "AU", "id": "c400a00b-f67c-42b7-ba9a-f73d8c67e433", "isEnabled": true, "origin": "Application", "value": "au" } ], 

Update It turns out that the reason the button was disabled was pretty simple: I assigned the user earlier and suggested that if I implemented the roles in the manifest, it would allow me to assign them using the Assign button, even if the user was already assigned.

However, it does not solve the root problem - after removing the user from the application and then assigning him, the invitation with the role assignment is not displayed to him, the user status "Assigned" simply changes to "Yes", as if no roles were specified in the manifest.

Answer 1

Well, I should have understood this before - the request for the assignment of a role does not appear when there is only one role in the application manifest, in which case it automatically assigns this role to the user. I realized this when I looked at all the claims sent to the application and found one specific role there.

Dushant Gill - thanks for the help.

Answer 2

jspi, only global administrators and administrators of user account accounts can assign users and groups of applications - can you confirm that the signed-in user is in one of these two directory roles?

Answer 3

You must upgrade the Azure portal to see the change (click here for Microsoft Azure). You can also log out and log in.