From cbe8a42f5c22d5e64cb9e859d70980735456311a Mon Sep 17 00:00:00 2001
From: Jan Tourlamain <jan.tourlamain@outlook.com>
Date: Wed, 19 Feb 2020 17:02:35 +0100
Subject: [PATCH 1/2] receive appid via graph API

---
 deployment/find-applicationid.ps1 | 55 +++++++++++++++++++++++++++----
 1 file changed, 48 insertions(+), 7 deletions(-)

diff --git a/deployment/find-applicationid.ps1 b/deployment/find-applicationid.ps1
index 6168178..455c416 100644
--- a/deployment/find-applicationid.ps1
+++ b/deployment/find-applicationid.ps1
@@ -1,9 +1,50 @@
-param(
-    [Parameter(Mandatory)]
-    $appName
+<#
+.SYNOPSIS
+    This script can be used to retreive an app id based on an application service principal id
+.DESCRIPTION
+    Based on the application name, this script can retreive the appId. An appId is needed if you want to give the app SQL access via MSI
+    The registered client (can be your devops client) in AzureAD must have Microsoft Graph Directory.Read.All rights
+    .PARAMETER tenantId
+    The tenantId where the devops service connection is connecting to. The tenantId is used to request a token to connect to the Azure SQL as only 
+    AzureAD users/apps can give other AzureAD users access to the Azure SQL DB.
+    .PARAMETER clientId
+    The clientId of the devops service connection app registration
+    .PARAMETER clientSecret
+    The clientSecret of the devops service conneciton app registration. This is needed to be able to request a token.
+    .PARAMETER appServicePrincipalId
+    The application id of the app. This id can be retreived via your ARM template. Ex: "[reference(concat(resourceId('Microsoft.Web/sites', variables('webAppName')), '/providers/Microsoft.ManagedIdentity/Identities/default'), '2018-11-30').principalId]"
+    .PARAMETER outputVariableName
+        The prefix for the appid output variable that is injected in the devops pipeline. Defaults to devops_appId
+#>
+param (
+    [Parameter(Mandatory=$true)][string]$tenantId,
+    [Parameter(Mandatory=$true)][string]$clientId,
+    [Parameter(Mandatory=$true)][string]$clientSecret,
+    [Parameter(Mandatory=$true)][string]$appServicePrincipalId,
+    [string]$outputVariableName = "appId"
 )
-$servicePrincipal = Get-AzureRmADServicePrincipal  -SearchString $appName
-$appId = $servicePrincipal.ApplicationId
 
-Write-Output "Application id for application with name $appName is $appId"
-Write-Output ("##vso[task.setvariable variable=appId;]$appId")
\ No newline at end of file
+$graphResource = 'https://graph.microsoft.com/'
+
+
+$tokenResponse = Invoke-RestMethod -Method Post -UseBasicParsing `
+    -Uri "https://login.windows.net/$($tenantId)/oauth2/token" `
+    -Body @{
+        resource=$graphResource
+        client_id=$clientId
+        grant_type='client_credentials'
+        client_secret=$clientSecret
+    } -ContentType 'application/x-www-form-urlencoded'
+
+if ($tokenResponse) {
+    Write-debug "Access token type is $($tokenResponse.token_type), expires $($tokenResponse.expires_on)"
+    $token = $tokenResponse.access_token
+
+
+    $appInfo = Invoke-RestMethod -Method Get `
+        -uri "https://graph.microsoft.com/beta/servicePrincipals/$appServicePrincipalId" `
+        -Headers @{"Authorization" = $token}
+    $result = $appInfo.appId
+    Write-Host "Found AppId: $result"
+}
+Write-Host ("##vso[task.setvariable variable=$outputVariableName;issecret=true;]$result")

From bc0272a871deefd0dbdfd6bdad01dee02c2abf54 Mon Sep 17 00:00:00 2001
From: Jan Tourlamain <jan.tourlamain@outlook.com>
Date: Wed, 19 Feb 2020 17:12:57 +0100
Subject: [PATCH 2/2] updated description info

---
 deployment/find-applicationid.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deployment/find-applicationid.ps1 b/deployment/find-applicationid.ps1
index 455c416..25e3330 100644
--- a/deployment/find-applicationid.ps1
+++ b/deployment/find-applicationid.ps1
@@ -14,7 +14,7 @@
     .PARAMETER appServicePrincipalId
     The application id of the app. This id can be retreived via your ARM template. Ex: "[reference(concat(resourceId('Microsoft.Web/sites', variables('webAppName')), '/providers/Microsoft.ManagedIdentity/Identities/default'), '2018-11-30').principalId]"
     .PARAMETER outputVariableName
-        The prefix for the appid output variable that is injected in the devops pipeline. Defaults to devops_appId
+    The variable name that is injected in the devops pipeline. Defaults to appId
 #>
 param (
     [Parameter(Mandatory=$true)][string]$tenantId,