feat(resource-group-init): add MI and group members as app registration owners

Sets uniqueName on the application registration in the script (required
for Bicep Graph extension lookup), then manages owners of both the
service principal and application registration via Bicep, adding the
pipeline MI and screening group members to both.

Author: josielsouzanordcloud

infrastructure/terraform/resource_group_init/enterpriseAppOwner.bicep

@@ -2,11 +2,22 @@ extension microsoftGraphV1
 
 param miPrincipalId string
 param enterpriseAppClientId string
+param enterpriseAppName string
 param groupMemberIds array = []
 
+var owners = concat([miPrincipalId], groupMemberIds)
+
 resource enterpriseAppSp 'Microsoft.Graph/servicePrincipals@v1.0' = {
   appId: enterpriseAppClientId
   owners: {
-    relationships: concat([miPrincipalId], groupMemberIds)
+    relationships: owners
+  }
+}
+
+resource enterpriseApp 'Microsoft.Graph/applications@v1.0' = {
+  uniqueName: enterpriseAppName
+  displayName: enterpriseAppName
+  owners: {
+    relationships: owners
   }
 }

infrastructure/terraform/resource_group_init/main.bicep

@@ -23,6 +23,7 @@ var privateDNSZoneRGName = 'rg-hub-${hubMap[envConfig]}-uks-private-dns-zones'
 var managedIdentityRGName = 'rg-mi-${envConfig}-uks'
 var infraResourceGroupName = 'rg-mbsgw-${envConfig}-infra'
 var keyVaultName = 'kv-mbsgw-${envConfig}-inf'
+var enterpriseAppName = 'spn-manbrs-web-api-${envConfig}'
 
 var miADOtoAZname = 'mi-${appShortName}-${envConfig}-adotoaz-uks'
 var miGHtoADOname = 'mi-${appShortName}-${envConfig}-ghtoado-uks'
@@ -215,6 +216,7 @@ module pipelineMiAppRole 'enterpriseAppOwner.bicep' = {
   params: {
     miPrincipalId: managedIdentiyADOtoAZ.outputs.miPrincipalID
     enterpriseAppClientId: enterpriseAppClientId
+    enterpriseAppName: enterpriseAppName
     groupMemberIds: groupMemberIds
   }
 }

scripts/bash/resource_group_init.sh

@@ -37,6 +37,21 @@ fi
 
 echo "Found enterprise app client ID: $enterpriseAppClientId"
 
+echo "Checking uniqueName on application registration $enterpriseAppName..."
+appObjectId=$(az ad app show --id "$enterpriseAppClientId" --query id -o tsv)
+currentUniqueName=$(az rest --method GET \
+  --uri "https://graph.microsoft.com/v1.0/applications/${appObjectId}?\$select=uniqueName" \
+  --query uniqueName -o tsv 2>/dev/null || echo "")
+if [ -z "$currentUniqueName" ]; then
+  echo "Setting uniqueName to: $enterpriseAppName"
+  az rest --method PATCH \
+    --uri "https://graph.microsoft.com/v1.0/applications/${appObjectId}" \
+    --headers "Content-Type=application/json" \
+    --body "{\"uniqueName\": \"${enterpriseAppName}\"}"
+else
+  echo "uniqueName already set to: $currentUniqueName"
+fi
+
 echo "Deploy to hub subscription $HUB_SUBSCRIPTION_ID..."
 az deployment sub create --location "$REGION" --template-file infrastructure/terraform/resource_group_init/main.bicep \
   --subscription "$HUB_SUBSCRIPTION_ID" \