Add initial workspace creator as workspace enterprise app owner

[marrobi]

Resolves #2625

How is this addressed

• Add initial workspace creator as owner of the enterprise app
• Give Application Admin Directory.Read.All permissions in make auth

Breaking change.

The Application Admin account needs to be granted Directory.Read.All permissions:

[github-actions]

Unit Test Results

0 tests   0 ✔️  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit 58e10e4.

♻️ This comment has been updated with latest results.

[marrobi]

/test

[github-actions]

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3098465186 (with refid 4559838e)

(in response to this comment from @marrobi)

[marrobi]

It seems this need an additional permissions to be able to add this user. It worked in my environment, but failed for a customer. I have the some additional permissions - Directory.Read.All and Group.ReadWrite.All. I am guessing this operation tries to read the workspace owner object and hence needs Directory.Read.All

[marrobi]

Directory.Read.All fixes the deployment, although user still cannot access the enterprise app n the portal

[marrobi]

User also needs to have "Directory Reader" role in AD.

[martinpeck]

Approved, but you have a typo

[marrobi]

/test

[github-actions]

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3150965693 (with refid 4559838e)

(in response to this comment from @marrobi)

[marrobi]

/test-force-approve passed https://github.com/microsoft/AzureTRE/actions/runs/3150965693

[github-actions]

🤖 pr-bot 🤖

✅ Marking tests as complete (for commit 58e10e4)

(in response to this comment from @marrobi)