Deploy in Azure shell failed

[philipho11]

Dear Matt

I am trying to deploy part 1 first within Azure shell, is it possible? Should I install Graph tools into the Azure shell?

If this is not possible, should I try codespace if I don't have a Windows machine around?

PS> ./deploy.ps1 `

-AppsOnly -UIAppName "AZURE_IPAM_UI_20240828"
-EngineAppName "AZURE_IPAM_ENGINE_20240828" `
-MgmtGroupId "Tenant Root Group/abc/def"
./deploy.ps1: The script 'deploy.ps1' cannot be run because the following modules that are specified by the "#requires" statements of the script are missing: Microsoft.Graph.

Philip

[DCMattyG]

Hi @philipho11, appreciate you reaching out any happy to assist@

Regardless of where you deploy the Azure IPAM solution from, you'll need to make sure you've met all of the prerequisites, one of which is having the Microsoft Graph SDK installed.

https://azure.github.io/ipam/#/deployment/README?id=prerequisites

You mention not having a Windows machine around, but PowerShell is cross-platform and can be installed from Windows, Linux and MacOS as of PowerShell 7.x. Is there something preventing you from installing PowerShell and the prerequisites on your existing machine?

[DCMattyG]

P.S. The -MgmtGroupId you've specified above is invalid. This needs to be the ID of the target Management Group. Not sure if this was on purpose, or perhaps just an example you were sharing here in the discussions.

[philipho11]

Dear Matt

Great suggestion from you! Installed Powershell and Az module in Ubuntu.

I am owner of the root management group , but in Microsoft 365, I have a role of application developer only. Should I be able to run the command?

NOTE: IPAM Deployment Type: FunctionContainer
INFO: Fetching Tenant ID from Azure PowerShell SDK
INFO: Fetching Azure Cloud type from Azure PowerShell SDK
INFO: Validating Azure Region selected for deployment
INFO: Azure Region validated successfully
INFO: Creating Azure IPAM UI Application
New-AzADApplication_CreateExpanded: /home/pcbho/.local/share/powershell/Modules/Az.Resources/7.3.0/MSGraph.Autorest/custom/New-AzADApplication.ps1:707
Line |
707 | $app = Az.MSGraph.internal\New-AzADApplication @PSBoundParameters
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Insufficient privileges to complete the operation.
New-AzADApplication_CreateExpanded: /home/pcbho/.local/share/powershell/Modules/Az.Resources/7.3.0/MSGraph.Autorest/custom/New-AzADApplication.ps1:707
Line |
707 | $app = Az.MSGraph.internal\New-AzADApplication @PSBoundParameters
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Insufficient privileges to complete the operation.

INFO: Creating Azure IPAM Engine Application
New-AzADApplication_CreateExpanded: /home/pcbho/.local/share/powershell/Modules/Az.Resources/7.3.0/MSGraph.Autorest/custom/New-AzADApplication.ps1:707
Line |
707 | $app = Az.MSGraph.internal\New-AzADApplication @PSBoundParameters
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Cannot convert the literal '' to the expected type 'Edm.Guid'.
New-AzADApplication_CreateExpanded: /home/pcbho/.local/share/powershell/Modules/Az.Resources/7.3.0/MSGraph.Autorest/custom/New-AzADApplication.ps1:707
Line |
707 | $app = Az.MSGraph.internal\New-AzADApplication @PSBoundParameters
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Cannot convert the literal '' to the expected type 'Edm.Guid'.

INFO: Updating Azure IPAM Engine API Endpoint
PS>TerminatingError(Update-AzADApplication): "Cannot process argument transformation on parameter 'ApplicationId'. Cannot convert null to type "System.Guid"."

TerminatingError(Deploy-IPAMApplications): "Cannot process argument transformation on parameter 'ApplicationId'. Cannot convert null to type "System.Guid"."
ERROR: Unable to deploy Azure IPAM solution due to an exception, see logs for detailed information!

Philip

[DCMattyG]

An Application Developer role should indeed be able to create App Registrations as described here.

You might want to verify your permissions. I'll test on my end that this role should indeed be sufficient as I've only tested with Global Administrator so far.

[philipho11]

Can I manually setup the two app registration separately and ask my global admin to grant API permissions to the apps?

Then I will switch to part 2 deploy.ps . Please guide me in manual setup of the two apps. Thanks a lot!

[philipho11]

I am creating the two app manually using Azure portal. That would be wonderful if you can show the screen of them like this:

[philipho11]

[philipho11]

The deployment of part 2 now completes with 6 resources. Only that I do not include "Directory.ReadAll" granted in UI app.

The GUI cannot load with a spiraling circle.

App log shows:
ERROR | app.dependencies:validate_token:209 - Microsoft Identity v1.0 access tokens are not supported!

[philipho11]

Matt,

I get it running now, without granting "Directory.ReadAll" in UI app. Many thanks for your guidance.

Philip

[DCMattyG]

Wonderful news @philipho11! Please let me know if you need anything else, we're happy to be of assistance.