remove-mi-permissions-to-graph.ps1

# Replace with your managed identity object ID
$miObjectID = "17707c90-dab4-483d-a57f-65e91ac3d94f"

# The app ID of the API where you want to assign the permissions
$appId = "00000003-0000-0000-c000-000000000000"

# The app IDs of the Microsoft APIs are the same in all tenants:
# Microsoft Graph: 00000003-0000-0000-c000-000000000000
# SharePoint Online: 00000003-0000-0ff1-ce00-000000000000

# Replace with the permissions to remove
$permissionsToRemove = "Group.ReadWrite.All", "Sites.ReadWrite.All"

Connect-AzureAD

$app = Get-AzureADServicePrincipal -Filter "AppId eq '$appId'"

$appRoles = Get-AzureADServiceAppRoleAssignment -ObjectId $app.ObjectId | where PrincipalId -eq $miObjectID

foreach ($appRole in $appRoles) {
    $role = $app.AppRoles | where Id -eq $appRole.Id | Select-Object -First 1
    if ($permissionsToRemove.Contains($role.Value)) {
        Remove-AzureADServiceAppRoleAssignment -ObjectId $app.ObjectId -AppRoleAssignmentId $appRole.ObjectId
    }    
}