Granting permission to managed identity for PIM approvals

@Jack S Thanks for reaching out. From logic app perspective you can authenticate logic apps against Microsoft graph using managed identity.

You can use the HTTP connector and in authentication type you can select the Managed Identity and define system identity and audience as below.

At your application end you can define the specific graph permission that are listed here.

I am not an expert in graph API what exact permission would be needed for your scenario, but looking into this document Directory write permission (Directory.ReadWrite.All) should help you.

I will wait for the graph API experts to confirm if there is any permission that could help you in your use case.

Hi @MayankBargali-MSFT

Thank you for your response!

Unfortunetely i had read through that documentation already and upon testing it discovered that a managed identity would still recieve the following error response:

This appears to be because the managed identity isn't listed as an Approver within the PIM role settings in EntraID. Only a user account or group can be assigned as approvers within the UI.

It would be great if someone is aware of a way to set the managed identity as an approver, or alternatively if it's a pssoible for a users authentication can be passed from a teams adaptive card button into a follow-on HTTP action in the logic app.