Limit IPAM Engine App to limited Users and groups

[omerzubair]

by default any UAMI (Service principal) or user can call and get a token from IPAM Engine Entra ID Application and then try to get details from the IPAM API.
There is a way to limit this interaction.
following are steps which you can use to limit it if anyone is interested please feel free to follow.

1. Go to Entra ID (assuming you have application Developer Role)

App Reg settings

2. Locate your Entra ID IPAM Engine 'App registration'
3. Click App Roles > + Create app role > save ()
4. Click Api permissions > + Add a permission > Apis my organisation uses > Search Engine App > click Application Perissios > tick the new App Role you created > Add permissions button

Enterprise app settings

5. Locate your Entra ID IPAM Engine Enterprise App
6. Click on Properties > Assignment required > turn Yes
7. Click on 'users and groups' > + Add user/group > Search the EntraId Group Powershell comadlet below

New-AzureADGroupAppRoleAssignment -ObjectId $groupObjId   -PrincipalId $groupObjId   -ResourceId $engineAppObj -Id $EngineAppRoleId