Fix Terraform Azure AD App Registration (SPN) Read Permssions Running with Azure DevOps Pipelines

 Azure DevOps use service principals (SPN or Azure AD app registration) to make a service connection to Azure to be able to run Terraform or other IaC based resource deployments targeting Azure. You may run into issue while trying to read another Azure AD app registration information, within terraform. For example consider below code segment.

# aks kv app

data "azuread_application" "akskv" {

  display_name = "${var.PREFIX}-${var.PROJECT}-aks-kv-app"

}

data "azuread_service_principal" "akskv" {

  application_id = data.azuread_application.akskv.application_id

}

Fix Terraform Azure AD Group Read with "403 Insufficient privileges" in Azure Pipelines

 For deploying Azure resources  with Terraform via Azure pipelines we use service principals (SPN) to connect to Azure from Azure DevOps. You might encounter "403 Insufficient privileges" errors while trying to read Azure AD groups data, which you might want to use to create role assignment in the new resources you are provsioning with Terraform. For example it can be a Azure AD group referred as data as shown below.

# refer to sub_owners AD group to assign as aks admins

data "azuread_group" "myteam" {

  display_name     = "sub_owners"

  security_enabled = true

}

 Let's look at the how to resolve the exception "403 Insufficient privileges".

TFS on Azure – 07. Add Azure VM to Domain in a Azure VM

To setup TFS environment in Azure Virtual Network it is required to join the SQL, TFS, RM etc VM to the domain in Azure VM (Using AAD is another option). Before adding the VM to domain controller static internal IP should be assigned.

For example the VM created below is for setting up SQL server.



Selecting pre-created cloud service is not mandatory here. Setting the virtual network as shown below is required.



Set static internal IP.

To add to the domain go to server manager, local server. Click on Workgroup.

Click change.


Provide domain name.


Provide domain administrator credentials to add to domain.



Restart the VM.

TFS on Azure – 05. Set DNS in Virtual Network

To complete setting up the AD in Azure VM, next step is to setup the DNS for the Virtual Network. Setting up DNS is required to join other machine (TFS, RM server etc,) to the domain.
Go to the server manager of the AD server in Azure VM. Click on Toos—> DNS.


In the DNS Manager right click on Domain Controller and click on Properties.
 

In the Forwarded tab of the Properties window click on IP address and click Edit.


In Edit Forwarders select the IP and click Delete.


Then click OK.


Click Apply and close DNS Properties.


Now go to the Azure Management portal click on the Virtual Network and go to Configure tab.



In the dns servers provide Domain Controller name and the static internal IP assigned to it. Click on Save.


Click Yes for the below message.


This will update the Virtual Network





DNS setup done for the Virtual network.

TFS on Azure – 04. Setup AD on Azure VM

To create a TFS environment in Azure, AAD can be used with Corporate AD as explained here. The other option is setting up the AD as a Azure VM or use AAD. For the TFS demonstration & training environment purpose, setting up AD as Azure VM is described in this post.

In Server manger in the Azure VM created click on Add roles and features.





Select Role –based or feature-based installation.


Select the server. Note the static IP set in “Adding Static Internal IP to Azure VM”.


Select Active Directory Domain Services.








Click Install.




Click on Promote this server to a domain controller.


In Deployment Configuration select Add a new forest and provide a root domain name.


Skip DNS options by clicking next. This can be set up later.

Provide a NetBIOS name.




Specify paths.


Review and Install. Ignore DNS warnings as it can be setup later.






Once setup completed and restarted can be logged in to the server using Administrator password provided for the machine, which will be valid for the domain administrator.

Create Non AD User in TFS in a Domain

If you want to create a non existing user for some purpose to TFS (For example assign all removed User Stories and Bugs to a non existing user, this was the requirement I got from a client :))  and if you do not like to add this user to Active Directory since there is no such actual Person, you can achieve this by creating the user in the TFS box as a windows user.

First create a windows user in TFS box



Add this user to the team project (do it inside the TFS box and you will not have any issues). My domain is ALM and my TFS box is TFS.

 

From any client machine having access to the TFS, login with the new user.




It works like a charm!