Pfthb

I have created one Data Factory and Key Vault using C# Code, I would like to set Access Policy of Key Vault.
For that I want data factory "Service Identity Application ID" (Highlighted in red in attached image) using C# code.
How could I do that?

If you want to get the access token with the application id, hope this doc could help.

Yes you can do this from C# code.

Here is a quick sample code that I wrote to get the Service Identity Application ID from C# code.

Pre-requisite is to install the following packages from your package manager console (Tools -> NuGet Package Manager -> Package Manager Console):

Install-Package Microsoft.Azure.Management.DataFactory -Prerelease
Install-Package Microsoft.Azure.Management.ResourceManager -Prerelease
Install-Package Microsoft.IdentityModel.Clients.ActiveDirectory

After the packages are installed, use code below

using System;
using Microsoft.Rest;
using Microsoft.Azure.Management.ResourceManager;
using Microsoft.Azure.Management.DataFactory;
using Microsoft.IdentityModel.Clients.ActiveDirectory;

namespace GetDataFactory

 class Program
 
 static void Main(string args)
 

 // Set variables
 string tenantID = "<your tenant ID>";
 string applicationId = "<your application ID>";
 string authenticationKey = "<your authentication key for the application>";
 string subscriptionId = "<your subscription ID where the data factory resides>";
 string resourceGroup = "<your resource group where the data factory resides>";
 string dataFactoryName = "<specify the name of data factory to create. It must be globally unique.>";

 // Authenticate and create a data factory management client
 var context = new AuthenticationContext("https://login.windows.net/" + tenantID);
 ClientCredential cc = new ClientCredential(applicationId, authenticationKey);
 AuthenticationResult result = context.AcquireTokenAsync("https://management.azure.com/", cc).Result;
 ServiceClientCredentials cred = new TokenCredentials(result.AccessToken);
 var client = new DataFactoryManagementClient(cred) SubscriptionId = subscriptionId ;

 var myFactory = client.Factories.Get(resourceGroup, dataFactoryName);

 //Getting principal Id as you mentioned in question, but you can get more information from the Identity object as per your need.
 Guid? principalId = myFactory.Identity.PrincipalId;

 
 

Once you have all the identity information, you can update the access policy for the keyvault to give required permissions (like listing keys, get/list secrets etc.) to the application (whose Id you've highlighted in the image)

1. 
   

   Use KeyVaultManagementClient class -

   
   
   

   https://docs.microsoft.com/en-us/dotnet/api/microsoft.azure.management.keyvault.keyvaultmanagementclient?view=azure-dotnet

   
   
   

   https://docs.microsoft.com/en-us/dotnet/api/microsoft.azure.management.keyvault.vaultsoperationsextensions.updateaccesspolicy?view=azure-dotnet

   
   


2. 
   

   Use Fluent API -

   
   
   

   Look at this sample on Github - https://github.com/Azure-Samples/key-vault-dotnet-manage-key-vaults

   
   
   

    Utilities.Log("Authorizing the application associated with the current service principal...");
   
    vault1 = vault1.Update()
    .DefineAccessPolicy()
    .ForServicePrincipal(SdkContext.AzureCredentialsFactory.FromFile(Environment.GetEnvironmentVariable("AZURE_AUTH_LOCATION")).ClientId)
    .AllowKeyAllPermissions()
    .AllowSecretPermissions(SecretPermissions.Get)
    .AllowSecretPermissions(SecretPermissions.List)
    .Attach()
    .Apply();
   
    Utilities.Log("Updated key vault");
    Utilities.PrintVault(vault1);
   
    //============================================================
    // Update a key vault
   
    Utilities.Log("Update a key vault to enable deployments and add permissions to the application...");
   
    vault1 = vault1.Update()
    .WithDeploymentEnabled()
    .WithTemplateDeploymentEnabled()
    .UpdateAccessPolicy(vault1.AccessPolicies[0].ObjectId)
    .AllowSecretAllPermissions()
    .Parent()
    .Apply();
   
    Utilities.Log("Updated key vault");
    // Print the network security group
    Utilities.PrintVault(vault1);
   

   
   


3. 
   

   Use Rest API

   
   
   

   https://docs.microsoft.com/en-us/rest/api/keyvault/vaults/updateaccesspolicy

   
   

If you want to retrieve the app id of an existing ADF, you need to do 2 trips.

The first is to retrieve the service identity for resource manager. @rohit's first code block does this in c#. This retrieves the object ID of the principal, not the app ID which is an attribute of that object.

The second is to retrieve the application ID from active directory via RM. You can then use this to assign access policy. For example, in powershell you would do this:

First Step:

$principal = (Get-AzureRmDataFactoryV2 -ResourceGroupName "yourRG" -Name yourADF).identity.PrincipalId

then second step...

$appId = (Get-AzureRmADServicePrincipal -ObjectId $principal).ApplicationId

The c# equivilent should be easy to figure out from this.