Give Api permissions

Your AZExecute Api access is restricted by default. You can give access to the Api from the System Settings menu, or directly from the Azure portal.

Users, groups and service principals from your tenant can get access to the Api. When you have assigned a role for any type of principal, that entity can begin authorizing against the AZExecute Api.

---

---

Choose a role and select a principal to give Api access.

Just as in the Azure Portal this requires the logged in user to have permissions to do this. Application Administrator would for instance be able to.

Assigning Users and Groups in Azure

API access is granted through app role assignments on the AZExecute API Enterprise Application. The System Settings page writes the same Entra ID assignments that you can manage manually from the Azure portal.

For delegated users, the API resolves the user's AZExecute tenant role as part of authentication. A recognized explicit Entra tenant app role is authoritative and is synchronized to the user's database record; when no recognized app role is present, the stored AZExecute role is used. Default Access does not override the stored role. See Roles and Access for the complete precedence and role-source behavior.

For service principals, assign the required API app role directly so the role appears in the access token. Service-principal API access roles and a human user's tenant role solve different authorization needs and should not be treated as interchangeable.

To assign users and groups access to AZExecute, navigate to the Azure portal and select the Enterprise Application. From there, go to the "Users and groups" section.

Provide specific users and groups with the necessary roles to access the application. This step is crucial for managing who can access and administer AZExecute.