How does one add the "resource principal named https://management.azure.net" to the default directory in Azure?

Question

what I want to do: use the Azure REST API from a custom tool.

What I did: I created an app registration named CDTester and a secret for it in my default directory. Then I went to the subscription and added the role Contributor to CTTester.

I got a config object cfg loaded from user-secrets with the application id and secret of CDTester and with the tenant id of my default directory.

Now I try to authenticate like this:

var app = ConfidentialClientApplicationBuilder
                .Create(cfg.ApplicationId)
                .WithTenantId(cfg.LoginTenantId)
                .WithClientSecret(cfg.ApplicationSecret)
                .Build();
            var authResult = await
                app.AcquireTokenForClient(new[] {"https://management.azure.net/.default"})
                    .ExecuteAsync();

The .ExecuteAsynccall fails with "' AADSTS500011: The resource principal named https://management.azure.net was not found in the tenant named . This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant."

As a (weak) alternative, I added the Azure Service Management delegated permission to CDTester, gave Admin Consent, switched the code to:

            var app = PublicClientApplicationBuilder.Create(cfg.ApplicationId)
                .WithTenantId(cfg.LoginTenantId)
                .WithDefaultRedirectUri()
                .Build();
            var authResult = await app
                .AcquireTokenInteractive(new[] { "https://management.azure.net/user_impersonation" })
                .ExecuteAsync();

ran it, logged in with my own user (who's of course global administrator) and got the same message, this time in the browser right after login.

Changing the scope to "https://management.azure.net/.default" in this flow doesn't change anything either.

So, obviously somehow I need to "install the resource principal https://management.azure.net" into my tenant - but for the life of me, I cannot find how.

Please try by changing `https://management.azure.net` to `https://management.azure.com/`. — Gaurav Mantri, Jul 19 '21 at 14:12
if you change your comment into an answer, I'll select it as the right answer - and thank you very much! — Modern Ronin, Jul 19 '21 at 14:16

score 2 · Accepted Answer · answered Jul 19 '21 at 14:29

2

As mentioned in the comment, please change https://management.azure.net to https://management.azure.com/.

Essentially there is no such thing as https://management.azure.net. To get an access token so that you can execute Azure Resource Manager API, you will need to acquire a token for https://management.azure.com/ resource.

answered Jul 19 '21 at 14:29

Gaurav Mantri

128,066
12
206
241

I should add that the ".net" version came from the XML doc comments on `.AcquireTokenInteractive()` so it seems in the past probably it was ".net" and MS forgot to update the doc comments. – Modern Ronin Jul 19 '21 at 14:43
It is probably `https://management.core.windows.net/`. That is still valid BTW. – Gaurav Mantri Jul 19 '21 at 14:45
any chance you might be able to help with https://stackoverflow.com/questions/68453220/creating-a-b2c-tenant-via-the-rest-api-returns-401-unauthorized , too? – Modern Ronin Jul 20 '21 at 10:54

How does one add the "resource principal named https://management.azure.net" to the default directory in Azure?

1 Answers1