Get-UnifiedEnvironment - Issue with App Registration Login

[avaripsam]

Hi. Currently I have an issue with using the Get-UnifiedEnvironment function with an AppRegistration access. When I run the command with my appreg I get:

When I run the same command with my admin account it works:

The AppReg has API permissions for ERP, CRM, Power Platform API, PowerApps Service and PowerApps-Advisor with Admin Consent. The appreg has the Power Platform Administrator role in Entra Id, too. The appreg is added with New-PowerAppManagementApp generally to the dataverse and is set as an Application User on the environment. I also set it in D365 F&O in Microsoft Entra ID applications

The diffrence seems to be that the AppReg cannot get the data for FinOppsApp. But I have no clue why. Am I missing something? Or is this a general issue? Thanks

@Splaxi @FH-Inway

[Splaxi]

Does Get-BapEnvironment work?

[Splaxi]

I think we are on the limits of what the API's are capable off. Like Aurélien points out in his blog: https://www.powerazure365.com/blog-1/d365-finops-devops-and-github-alm-new-generation

We are reverse engineering things and running against somewhat unsupported API's many different places.

I know that Lane (PM at Microsoft), is very close on releasing new authentication support - for service principals - done granularly. I'm in fact struggling with getting that to work - so I would expect that things might change in the near future.

Behind the scenes - it seems that it is the "Get-BapEnvironmentD365App" that fails.

        $appsEnvironment = Invoke-RestMethod `
            -Method Get `
            -Uri "https://api.admin.powerplatform.microsoft.com/api/AppManagement/InstancePackages/instanceId/$tenantId`?instanceUrl=$uriSourceEncoded`&geoType=$GeoRegion" `
            -Headers $headersAdminApi

[Splaxi]

Maybe we should chase Lane a bit - and see if he knows about other endpoints, that can give us the same details....

/api/data/v9.2/msprov_getfinopsapplicationdetails
Is the one the gives us all the PpacProv* properties.

/api/data/v9.2/msprov_getfnoversiondetails
Is the one that gives us what Platform Updates is available.

[Splaxi]

AthenaFinanceOperationsTableAdapterGroup/AthenaFinanceOperationsTableAdapterService/GetPlatformBuildVersion
{"FaultMessage":null,"FaultType":0,"IsFaulted":false,"Version":"7.0.7778.45"}

AthenaFinanceOperationsTableAdapterGroup/AthenaFinanceOperationsTableAdapterService/GetApplicationBuildVersion
{"FaultMessage":null,"FaultType":0,"IsFaulted":false,"Version":"10.0.2428.95"}

These endpoints are directly on the D365FO instance. Can't find any that lists the 10.0.45.7 - which we get from the "/AppManagement/InstancePackages/instanceId" endpoint...

[Splaxi]

Try this, with your App Reg

(Get-PpacD365OperationHistory -EnvironmentId 'ABC' | `
Where-Object {$_.Status -eq 'Succeeded' -and $_.State -eq 'Completed'}).ProvVersion | `
Sort-Object -Descending | `
Select-Object -First 1

If that works - then we can refactor the Get-UnifiedEnvironment and use that logic - until we find a better way.

[avaripsam]

Okay, that looks good:

First the command with the error, second your new command. it gets the 10.46.0.2 correct...

[avaripsam]

@Splaxi any news here? can I help somehow?

[DanielEriksson-Avega]

Hi guys!
I think the bap tools is a very good toolset. I am currently building a ps module and a workflow that I want to use for refreshing all our different environments either on a schedule (we do a prod->test every night for the internal support team to troubleshoot reported tickets) or on demand when developers och project teams need fresh data.

Yesterday we started to explore authentication with service principle for the ability to move the solution to DevOPs or Azure Automation (I am currently scheduling on an Azure VM). We came rather far during the day and made enhancements. But we never got past the same issue as above. So right now I am back to authenticate with a user account.

I see You say that we might get some new possibilities with authentication from MS, but what/when is unclear.
In the meant time I am thinking, can I continue with spn (and maybe some hybrid mode with yml and pac)

Do You know which functions in bap tools that are suffering from the spn problem?

I am running this as a three-step flow

1. copy the environment
2. Set access and permission in the target environment
3. Enable the target environment

Below is the list of functions I am using so far.
They all work except the copy part, where I get an error like below

Start-UdeDatabaseRefresh
Set-PpacAdminMode
Get-FscmUser
Set-FscmUser
Get-GraphGroupMember
Add-FscmSecurityRoleMember
Add-PpacSecurityRoleMember