Jira Automation Azure Runbooks connection asks for permissions every time and never logs in

[Toby Hessellund]

I'm trying to start a Runbook in Azure within Jira Automation and every single time it asks to login to azure and when I do I get the following pop-up. Even though I have approved it many times, it still pops up like it never took hold. 

Each time, I'll get the following. 

the Service Account I'm using has admin access to the project where the automation is running and is a Automation Job Operator on the Azure side. 

Let me know what I seem to be missing here or what other information I can share.

[Silvano Bemer]

We believe it has to do with the enforcement of "prompt=consent" in the URL. 

See: https://medium.com/@namsoochoi/solved-need-admin-approval-or-approval-required-aadsts90094-error-during-microsoft-sign-in-b3fde2ec4523

[Toby Hessellund]

Does anyone know what the minimum role is needed in Azure for this connection to work?

[Toby Hessellund]

I've discovered this seems to be related to the level of permissions on the Azure side. The service account has job operator permissions and I tested it with an admin account and it connected successfully. I'll have to see what the minimum is needed to connect.

[Daniel]

I'm struggling with this issue as well. Only seem to work when signing in and consenting with Global Admin account.

@Toby Hessellund did you find out what minimum permissions to issue the service account to get it working?

[Toby Hessellund]

@Daniel I never did get an answer for this. I ended up just creating a runbook URL and passed the information to that.

[Silvano Bemer]

@Toby Hessellund @Daniel 

Please see the following documentation: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent?pivots=portal#configure-user-consent-in-microsoft-entra-admin-center

I got in touch with support and managed to solve it by setting the setting to "Allow user consent for apps from verified publishers, for selected permissions."

Also, just so you are aware, we had to put the “Assignment required?” option to “No”. Even when the user I am trying to use is assigned to the application it would forward me to the request approval screen. If I put this to “No” I can accept the permissions as a non-admin user and connect successfully.

After you successfully granted permissions and completed the flow with the desired account you can actually revert all the changes you made. It will keep working. 

Good luck!

[Daniel]

Thanks for the reply @Silvano Bemer

I'd prefer not to allow consent for users at all to avoid application sprawl by opening the flood gates. But might consider it temporarily if its the solution.

By doing this where you able to get it work with Azure RBAC assignments only? I'm trying to keep it to as low privileges as possible. 

[Silvano Bemer]

Hi @Daniel

We had the same discussions, but decided to allow the consent temporarily (for a few minutes). After the user completes the workflow we reverted back the setting. This was the only thing that worked for us, sadly. Luckily you can do it pretty quickly, it only took us a few minutes total.