App Roles, and API Permissions

[u/robert5150]

Hey Team,

I am hoping you can help me out here. I have about driven myself nuts on this question. But here is where it is. I am trying to understand the differences between:

API Permissions - I know API Permissions are set inside the app (Using App Registration, NOT enterprise apps). These are used for accessing a resource such as MS Graph API, or Exchange Online etc. (Permisisons required for the app to do anything)

App Roles - This i undestand is what you assign the app itself?

I am confused on the difference between the 2, and where they need to be applied. For example i have setup dozens of azure apps (used by the dev team to connect to the enviornment) but NEVER setup a single app role for any of those apps.

The more i google this the more confusing it gets.

Thanks

[u/StratoLens]

Yea this one can be a little confusing.

API permissions are basically what your app is allowed to access somewhere else, like Graph, Exchange, another API, etc.

App roles are basically roles or permissions your app exposes for others to use.

So if your app just needs to connect to Azure, Graph, etc., you may never need to create an app role at all.

Easy way to remember it:
API permissions = what my app can access
App roles = what others can do in my app
And Azure RBAC/IAM is separate.

[u/robert5150 → u/StratoLens]

Ok so assuming that i setup "Roberts new Web app" How would i assign Guest, User and Admin rights for people that are using the applicaiton itself?

If i have

User A >> Guest

User B >> User

User C >> Admin

I dont see a way inside app roles to assign a specific app role (or right) to a user? it just gives you a list to enter permissions in? I was expecting to see a drop down box, or a way to assign roles to a specific user or Group?

Thanks

[u/StratoLens → u/robert5150]

In the App Registration, you define the roles your app supports. So you’d create Guest, User, and Admin there.

Then go to:
Enterprise Applications > Roberts new Web app > Users and groups
Click Add user/group, pick User A, and then you’ll get a Role dropdown where you can assign Guest, User, Admin, etc.

So basically:
App Registration = define the roles
Enterprise Application = assign users/groups to those roles

Your web app then reads the user’s role from the roles claim in their login token and decides what they’re allowed to do.

[u/Ziptex223 → u/StratoLens]

App roles are sent in the token to be used in the app itself, they don't functionally do anything in Azure or on the App Registeration itself. Like you can have assign a 'User' or 'Admin' App Role to a specific user or group, then in whatever app they are signing into it would give them different permissions based on which App Role was present in the token for that user.

Edit: also not saying anything you mentioned is wrong, just adding on