List owned app registration in the context of an application/spn

[verbedr]

Related command
az ad app list --show-mine

Describe the bug
When executing in an azdo pipeline and thus using a spn (application based) access token, we get "ERROR: /me request is only valid with delegated authentication flow." . This probably caused by the underlying graph API call, but I'm unaware what the exact call is. This is why I report it here

To Reproduce
Execute the command using a SPN.

Expected behavior
The same result as if you would execute the command with a normal user. It should be noted that spn's can be owners and have the required rights to access and updates app registration.

Environment summary
Hosted agent -> https://github.com/actions/runner-images/blob/ubuntu20/20221027.1/images/linux/Ubuntu2004-Readme.md
azure-cli 2.41.0 *
azure-devops 0.25.0

Additional context

[yonzhan]

@jiasli for awareness

[verbedr]

Just want to confirm that the problem is in the underlying API call. So I guess the problem should be forwarded to the graph API team. I'm not sure how to do this, but I trust you guys can have a talk with them.

[verbedr]

I'm currently using following workaround.

$spn = (az ad sp show --id (az account show | ConvertFrom-Json).user.name | ConvertFrom-Json).id
$ownedApps = (az rest -u "`"https://graph.microsoft.com/v1.0/servicePrincipals/$($spn)/ownedObjects`"" | ConvertFrom-Json).value

[Morgomor]

Any progress on this issue? Would be nice to make this available for application-based authentication.

[tuxerrante]

Same here,
I'm executing on Azure DevOps Server 2022.1 an AzureCLI@2 task with addSpnToEnvironment: true where the service principal has Microsoft Grpah API permissions Application.ReadWrite.OwnedBy.

The command going in error seems to be

az ad sp list --show-mine --output none --display-name "${ENV}${PROJECT}-FOO";

Related: https://stackoverflow.com/a/75659922/3673430