January community call

[Dan Kershaw [MSFT] (dkershaw10)]

Folks,

We're looking to have a community call on Thursday, Feb 1st at 9am Pacific Time, as part of the Bicep Community Call. Some of you may already have this invite, but we will be forwarding the invitation to this community also (so apologies for the spam). Here's our proposed agenda:

1. Private preview feedback and discussion.
2. Zero-touch deployment status.
3. Latest plans and roadmap.

Questions:

1. Are there any other topics you'd like to discuss?
2. Would you like to be able to demo a Bicep template that you've built that uses Graph resource types in a "real-world scenario"?
3. Would you like an additional session at 2pm Pacific Time (for folks based in APAC)?

[Shea Smith (SheaSmith)]

Will there be an recording of the call available afterwards?

[Dan Kershaw [MSFT] (dkershaw10)]

We should be able to record it. But I will double check.

[Dan Kershaw [MSFT] (dkershaw10)]

Just updated the announcement to say that we are now meeting as part of the regular Bicep Community Call (February 1st) at 9am pacific time. Invites to follow (if you haven't already received one).

[Dan Kershaw [MSFT] (dkershaw10)]

For any folks that missed Thursday's Bicep Community Call, the recording can be found here: https://www.youtube.com/watch?v=Ng9rPvTCgDs. The portion on the Graph Bicep extension starts around 18.5 minutes and is about 18 minutes long.

I've added our current timelines for new features as we work towards a public preview in May, that we presented at the community call. One thing to note is that we really wanted to get the app-only support out sooner, but unfortunately that wasn't possible. I know this is a painful delay for many of you.

Feature	ETA
Consistent naming of client-provided key properties between Bicep and Graph types – uniqueName (applications and groups)	February 2024
Federated identity credentials (TBD with MI as credential)	March 2024
Graph v1.0 resource types	March 2024
Zero-touch deployment (app-only)	Beginning April 2024
Public preview documentation (including Graph Bicep reference)	May 2024

NOTE: Not currently part of the public preview plan, for May:

• Client secrets, users, PIM for groups, CA policy or any other Entra or M365 resource types
• What-if, verbose output, deployment stacks, extensible resources in Azure portal deployment blade
• National clouds

[Teemu Tapanila (Tapanila)]

Has there been decision on supporting application secrets? Asking because from the discussion on issue I got the picture that this wouldn't be supported but seems like there's demand on getting it supported.

[Teemu Tapanila (Tapanila)]

Any news on Zero-touch deployment? I'm very eagerly waiting for it

[Dan Kershaw [MSFT] (dkershaw10)]

Teemu Tapanila (@Tapanila) We're eager to release it too :) and we're working as fast as we can to get it into your hands. Testing and validation in our pre-production environment looks good, and it's being promoted to production which may take longer than we hoped. Hopefully this will be in your hands before the end of this month. We'll let you (and everyone else) know as soon as it's available, as we want to validate that it works for your scenarios.

[Teemu Tapanila (Tapanila)]

Dan Kershaw [MSFT] (@dkershaw10) thanks for providing information where things are going.

[Dan Kershaw [MSFT] (dkershaw10)]

Hi Teemu Tapanila (@Tapanila). Sharing some of the poll feedback from the January Bicep Community call (sorry meant to so this earlier);

• We had 35 poll respondents.
• Federated identity credentials (FIC) is popular, to enable secret-free apps.
• 40% of respondents need to configure client (application) secrets for legacy (3P) apps and require this support in the Applications bicep type.
• ~50% of respondents don’t need any Entra types beyond what we already support for private preview (apps, SPs, groups, and app permissions).
• For the rest, PIM APIs were the most requested API to add Bicep types for, followed by users, FIC, PIM for groups, role management, and CA policy.
• For those folks that do any "interactive" deployments, most folks use Az PS pr Az CLI.

So yes - we got a strong customer signal that client secrets are required.
We're working with a sister team to add support for client secrets (so it works with Bicep templates), but as yet this is still uncommitted work :(. However, I will continue to push for this.

I'll update if there's any more news on this, on the tracking issue.

[Shea Smith (SheaSmith)]

Dan Kershaw [MSFT] (@dkershaw10) Did you manage to get an update around using FIC in place of secrets for those cross-tenant scenarios? We'd love to get rid of our secrets, but I can't see how we can use FIC at the moment

[Dan Kershaw [MSFT] (dkershaw10)]

Sorry for the late reply Shea Smith (@SheaSmith). Latest I heard, is that using MSI as a FIC (in place of secrets) should be available in public preview at the end of this quarter. However, that may change.

Can you clarify what you mean by cross-tenant scenarios here? One thing that will not be allowed is to configure an app from one tenant to have a FIC with an MSI from another tenant.

Federating with other identity providers via FIC is supported and can be configured using Graph Bicep, like the sample here: https://github.com/microsoftgraph/msgraph-bicep-types/tree/main/quickstart-templates/create-fic-for-github-actions

[Shea Smith (SheaSmith)]

Sorry for the late reply Shea Smith (@SheaSmith). Latest I heard, is that using MSI as a FIC (in place of secrets) should be available in public preview at the end of this quarter. However, that may change.

Can you clarify what you mean by cross-tenant scenarios here? One thing that will not be allowed is to configure an app from one tenant to have a FIC with an MSI from another tenant.

Federating with other identity providers via FIC is supported and can be configured using Graph Bicep, like the sample here: https://github.com/microsoftgraph/msgraph-bicep-types/tree/main/quickstart-templates/create-fic-for-github-actions

Perhaps I used the wrong terminology here. Essentially I mean that we have an app registration in tenant X, which is given permissions to access some graph APIs in tenant Y and then we want to use a managed identity in tenant X to authenticate and view those APIs in tenant Y, in the place of a secret.

It sounds like the forthcoming public preview should work for us so I look forward to it being available.

[Dan Kershaw [MSFT] (dkershaw10)]

Shea Smith (@SheaSmith) If you are talking about a multi-tenant application using MSI as a FIC instead of a secret, that can be consented in other tenants, that should work fine. However, I will double check to be sure.

[pecjag]

Sorry for the late reply Shea Smith (@SheaSmith). Latest I heard, is that using MSI as a FIC (in place of secrets) should be available in public preview at the end of this quarter. However, that may change.

Is there any update on the timeline for availability of this ^^? thanks