title: Azure AD Application - Require Role Assignment + Add a role assignment for an Application?
body: <p>I have an MVC Web Application (WebAPI + Angular) deployed to Azure as a Web App (not API App) that is setup to be secured using Settings -> Authentication / Authorization -> AAD -> Express. This created an AD Application with the same name as the Web App, and as a normal web user (in the directory, using OAuth) this works as expected.</p>
  
  <p>But I also have external automation that needs to call the WebAPI controllers directly, so I need to programmatically get a Bearer token to pass along with those requests. </p>
  
  <p>This all works OK when "USER ASSIGNMENT REQUIRED TO ACCESS APP" == NO. But this won't suffice because everyone in the Directory shouldn't have access to this app. </p>
  
  <p>Flipping that switch results in the error:</p>
  
  <blockquote>
    <p>Application 'AppId' is not assigned to a role for the application 'AppId'.</p>
  </blockquote>
  
  <p>The code being used:</p>
  
  <pre><code>    var aadLoginUri = "http://login.microsoftonline.com/{0}";
      var tenantId = "[xxx].onmicrosoft.com";
      var authority = String.Format(CultureInfo.InvariantCulture, aadLoginUri, tenantId);
      var clientId = ConfigurationManager.AppSettings["ClientId"];
      var clientSecret = ConfigurationManager.AppSettings["ClientSecret"];
  
      var authContext = new AuthenticationContext(authority);
      ClientCredential clientCredential = new ClientCredential(clientId, clientSecret);
      AuthenticationResult authResult = authContext.AcquireToken(clientId, clientCredential);
  </code></pre>
  
  <p><strong>How can I add a role assignment for an Application?</strong> 
  <br><em>(as opposed to for a user)</em></p>
  
  <p>I tried utilizing the 'permissions to other applications' section, but an app cannot be added to itself. To see if this would solve the problem from another app, I went ahead and created one and was able to add the App &amp; set Delegated Permissions to 'Access [App Name]'. But just as before, this only works if user assignment is not required to access the app. Afterwards <code>AcquireToken()</code> throws the same exception. </p>
  
  <p>It seems this issue <a href="https://stackoverflow.com/a/32594294">could be solved</a> by decoupling our API from the Angular app, hosting the API as an API App (with a Gateway), but that's not an option at the moment. Also <a href="https://azure.microsoft.com/en-us/documentation/articles/app-service-mobile-how-to-configure-active-directory-authentication/#advanced" rel="noreferrer">this article</a> says this new Auth feature "<em>replaces the App Service gateway for most applications</em>" and <a href="https://azure.microsoft.com/en-us/blog/announcing-app-service-authentication-authorization/" rel="noreferrer">this blog post</a> announcing the feature in November says "<em>We recommend web and mobile applications use this feature instead of the App Service gateway going forward</em>" so I wonder if this just hasn't made it into the UI &amp; perhaps it's possible to add app role assignments via the app manifest (tried, failed), graph/service-mgmt api, powershell, etc. </p>