feat(DTOSS-13037): automate enterprise app ownership via resource-group-init

Adds pipeline MI as owner of the enterprise app service principal and
group members as owners of both the service principal and application
registration using the Bicep Graph extension. Dynamically looks up the
enterprise app client ID and group members in the deployment script, and
sets uniqueName on the app registration to enable Bicep Graph extension
lookup.

Author: josielsouzanordcloud

infrastructure/terraform/resource_group_init/bicepconfig.json

@@ -0,0 +1,5 @@
+{
+  "extensions": {
+    "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:1.0.0"
+  }
+}

infrastructure/terraform/resource_group_init/enterpriseAppOwner.bicep

@@ -0,0 +1,21 @@
+extension microsoftGraphV1
+
+param miPrincipalId string
+param enterpriseAppClientId string
+param enterpriseAppName string
+param groupMemberIds array = []
+
+resource enterpriseAppSp 'Microsoft.Graph/servicePrincipals@v1.0' = {
+  appId: enterpriseAppClientId
+  owners: {
+    relationships: concat([miPrincipalId], groupMemberIds)
+  }
+}
+
+resource enterpriseApp 'Microsoft.Graph/applications@v1.0' = {
+  uniqueName: enterpriseAppName
+  displayName: enterpriseAppName
+  owners: {
+    relationships: groupMemberIds
+  }
+}

infrastructure/terraform/resource_group_init/main.bicep

@@ -7,6 +7,8 @@ param storageAccountRGName string
 param storageAccountName string
 param appShortName string
 param userGroupPrincipalID string
+param enterpriseAppClientId string
+param groupMemberIds array = []
 
 var hubMap = {
   dev:                  'dev'
@@ -21,6 +23,7 @@ var privateDNSZoneRGName = 'rg-hub-${hubMap[envConfig]}-uks-private-dns-zones'
 var managedIdentityRGName = 'rg-mi-${envConfig}-uks'
 var infraResourceGroupName = 'rg-mbsgw-${envConfig}-infra'
 var keyVaultName = 'kv-mbsgw-${envConfig}-inf'
+var enterpriseAppName = 'spn-manbrs-web-api-${envConfig}'
 
 var miADOtoAZname = 'mi-${appShortName}-${envConfig}-adotoaz-uks'
 var miGHtoADOname = 'mi-${appShortName}-${envConfig}-ghtoado-uks'
@@ -207,6 +210,17 @@ resource groupNetworkContributorAssignment 'Microsoft.Authorization/roleAssignme
   }
 }
 
+module pipelineMiAppRole 'enterpriseAppOwner.bicep' = {
+  name: 'pipelineMiAppRoleAssignment'
+  scope: managedIdentityRG
+  params: {
+    miPrincipalId: managedIdentiyADOtoAZ.outputs.miPrincipalID
+    enterpriseAppClientId: enterpriseAppClientId
+    enterpriseAppName: enterpriseAppName
+    groupMemberIds: groupMemberIds
+  }
+}
+
 output miPrincipalID string = managedIdentiyADOtoAZ.outputs.miPrincipalID
 output miName string = miADOtoAZname
 output keyVaultPrivateDNSZone string = keyVaultPrivateDNSZone.outputs.privateDNSZoneID

infrastructure/terraform/resource_group_init/managedIdentity.bicep

@@ -14,3 +14,4 @@ resource managedIdentiyGHtoADOFedCred 'Microsoft.ManagedIdentity/userAssignedIde
 }
 
 output miPrincipalID string = mi.properties.principalId
+output miId string = mi.id

scripts/bash/resource_group_init.sh

@@ -22,12 +22,43 @@ fi
 
 echo "Found group Object ID: $userGroupPrincipalID"
 
+echo "Fetching members of group: $userGroupName"
+groupMemberIds=$(az ad group member list --group "$userGroupName" --query "[].id" -o json)
+echo "Found group members: $groupMemberIds"
+
+enterpriseAppName="spn-manbrs-web-api-${ENV_CONFIG}"
+echo "Fetching appId for enterprise app: $enterpriseAppName"
+enterpriseAppClientId=$(az ad sp list --filter "displayName eq '${enterpriseAppName}'" --query "[0].appId" -o tsv)
+
+if [ -z "$enterpriseAppClientId" ]; then
+  echo "Error: Enterprise app '$enterpriseAppName' not found in Entra ID"
+  exit 1
+fi
+
+echo "Found enterprise app client ID: $enterpriseAppClientId"
+
+echo "Checking uniqueName on application registration $enterpriseAppName..."
+appObjectId=$(az ad app show --id "$enterpriseAppClientId" --query id -o tsv)
+currentUniqueName=$(az rest --method GET \
+  --uri "https://graph.microsoft.com/v1.0/applications/${appObjectId}?\$select=uniqueName" \
+  --query uniqueName -o tsv 2>/dev/null || echo "")
+if [ -z "$currentUniqueName" ]; then
+  echo "Setting uniqueName to: $enterpriseAppName"
+  az rest --method PATCH \
+    --uri "https://graph.microsoft.com/v1.0/applications/${appObjectId}" \
+    --headers "Content-Type=application/json" \
+    --body "{\"uniqueName\": \"${enterpriseAppName}\"}"
+else
+  echo "uniqueName already set to: $currentUniqueName"
+fi
+
 echo "Deploy to hub subscription $HUB_SUBSCRIPTION_ID..."
 az deployment sub create --location "$REGION" --template-file infrastructure/terraform/resource_group_init/main.bicep \
   --subscription "$HUB_SUBSCRIPTION_ID" \
   --parameters enableSoftDelete="$ENABLE_SOFT_DELETE" envConfig="$ENV_CONFIG" region="$REGION" \
     storageAccountRGName="$STORAGE_ACCOUNT_RG" storageAccountName="$STORAGE_ACCOUNT_NAME" \
-    appShortName="$APP_SHORT_NAME" userGroupPrincipalID="$userGroupPrincipalID" --what-if
+    appShortName="$APP_SHORT_NAME" userGroupPrincipalID="$userGroupPrincipalID" \
+    enterpriseAppClientId="$enterpriseAppClientId" groupMemberIds="$groupMemberIds" --what-if
 
 read -r -p "Are you sure you want to execute the deployment? (y/n): " confirm
 [[ "$confirm" != "y" ]] && exit 0
@@ -36,7 +67,8 @@ output=$(az deployment sub create --location "$REGION" --template-file infrastru
   --subscription "$HUB_SUBSCRIPTION_ID" \
   --parameters enableSoftDelete="$ENABLE_SOFT_DELETE" envConfig="$ENV_CONFIG" region="$REGION" \
     storageAccountRGName="$STORAGE_ACCOUNT_RG" storageAccountName="$STORAGE_ACCOUNT_NAME" \
-    appShortName="$APP_SHORT_NAME" userGroupPrincipalID="$userGroupPrincipalID")
+    appShortName="$APP_SHORT_NAME" userGroupPrincipalID="$userGroupPrincipalID" \
+    enterpriseAppClientId="$enterpriseAppClientId" groupMemberIds="$groupMemberIds")
 
 echo "$output"