app service - You do not have permission to edit authentication settings

Hello @Sean T,

Thank you for posting your question on the Microsoft Q&A forum. 

The error “You do not have permission to edit authentication settings” because Web App authentication/authorization is tied to Microsoft Entra ID application creation & update permissions, which live outside the scope of your Web App resource itself.

Your current role fails even if your custom role has Microsoft.Web/sites/ permissions, adding an Identity Provider requires:

1. Creating or updating an App registration in Entra ID.
2. Linking that App registration to your Web App.
3. Possibly writing into the Microsoft.Web/sites/config/authsettingsV2 resource.

If your account isn’t a Global Administrator or Cloud Application Administrator (or doesn’t have delegated application permissions in Entra), the portal can’t perform those steps hence the error.

The exact permissions you need

You can solve this in two ways:

Option 1 – Grant a directory-level role in Entra ID

In Microsoft Entra admin center > Roles and administrators, give your account one of:

• Application Administrator (recommended minimal for this task)
  • Allows creation and management of all app registrations, including assigning them to Web Apps.
• Cloud Application Administrator (similar to above but also grants consent to apps)
• Global Administrator (full rights, but usually overkill)

If you’re using a non-GA account, make sure it’s in a role that can manage app registrations in Entra.

 Option 2 – Keep your custom Azure role, but add the necessary Entra permissions

Your Azure custom role likely covers:

Microsoft.Web/sites/*
Microsoft.Web/sites/config/*

but you also need Entra Graph API permissions:

Custom directory roles can be made in Entra ID → Roles and administrators → New custom role.

Feel free to post back if you have any further questions or need assistance with implementing these changes.