[BUG] Forbidden Azure.AccessManagement.ActiveDirectoryApplications.GetByName

When i call above function I got a Forbidden exception. The ad client application has the following rights:

Access to other resources is fine (e.g. Vault, AppService,…)

Exception or Stack Trace

“Operation returned an invalid status code ‘Forbidden’”

at Microsoft.Azure.Management.Graph.RBAC.Fluent.ApplicationsOperations.<ListWithHttpMessagesAsync>d__6.MoveNext() at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult() at Microsoft.Azure.Management.Graph.RBAC.Fluent.ApplicationsOperationsExtensions.<ListAsync>d__1.MoveNext() at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter1.GetResult() at Microsoft.Azure.Management.Graph.RBAC.Fluent.ActiveDirectoryApplicationsImpl.<GetByNameAsync>d__3.MoveNext() at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter1.GetResult() at Microsoft.Azure.Management.ResourceManager.Fluent.Core.Extensions.Synchronize[TResult](Func1 function) at Microsoft.Azure.Management.Graph.RBAC.Fluent.ActiveDirectoryApplicationsImpl.GetByName(String spn)

Code Snippet var credentials = AzureCliCredentials.Create();

var azure = Azure .Configure() .WithLogLevel(HttpLoggingDelegatingHandler.Level.Basic) .Authenticate(credentials) .WithSubscription(subscritptionId);

azure.AccessManagement.ActiveDirectoryApplications.GetByName(“[application name as registererd in AAD]”);

[nickzhums]

@BartNetJS thanks for the detailed explanation! 😃

Yes definitely we are seeing more and more people have now turned to the SDK to manage the resources

When the new libraries come out, feel free to try them and provide us with suggestions

[BartNetJS]

I’m using it in azure pipeline together with Cake (see above). We found that using ARM templates and yaml pipelines was very error prone and difficult to debug. In the current implementation we can just debug regular C# code in Visual Studio for the azure pipelines on our local development machine. It is very verbose and productive.

We are also providing an API platform (together with APIM) for internal API providers and are looking to provide CI/CD as a service to those API providers. The Cake Frosting (C# implementation) together with azure resource sdk’s is a good starting point for us.