add-mi-permissions-to-graph.ps1

# Replace with your managed identity object ID
$miObjectID = "17707c90-dab4-483d-a57f-65e91ac3d94f"

# The app ID of the API where you want to assign the permissions
$appId = "00000003-0000-0000-c000-000000000000"

# The app IDs of the Microsoft APIs are the same in all tenants:
# Microsoft Graph: 00000003-0000-0000-c000-000000000000
# SharePoint Online: 00000003-0000-0ff1-ce00-000000000000

# Replace with the API permissions required by your app
$permissionsToAdd = "User.Read.All", "User.Invite.All", "GroupMember.ReadWrite.All"

Connect-AzureAD

$app = Get-AzureADServicePrincipal -Filter "AppId eq '$appId'"

foreach ($permission in $permissionsToAdd)
{
    try {
        $role = $app.AppRoles | where Value -Like $permission | Select-Object -First 1
        New-AzureADServiceAppRoleAssignment -Id $role.Id -ObjectId $miObjectID -PrincipalId $miObjectID -ResourceId $app.ObjectId -ErrorAction Stop
    }
    catch {        
        if ($_.Exception.ErrorContent.Message.Value -notcontains "Permission being assigned already exists on the object") {
            throw $_
        }
    }
}