Skip to content

Instantly share code, notes, and snippets.

@itpropro
Created March 14, 2023 20:25
Show Gist options
  • Save itpropro/047f965a27b1d529a2cb01e7fc04e601 to your computer and use it in GitHub Desktop.
Save itpropro/047f965a27b1d529a2cb01e7fc04e601 to your computer and use it in GitHub Desktop.
Add Graph API permissions to managed identity
$tenantId = "00000000-0000-0000-0000-000000000000" # Replace with your tenant ID
$graphApiAppId = "00000003-0000-0000-c000-000000000000" # Well known ID
$msiName = "MSINAME" # Name of your managed identity e.g. name of Function or Logic App
$graphPermissions = @("Directory.Read.All", "User.Read.All") # Add or remove permissions
Connect-AzureAD -TenantId $tenantId
$msi = Get-AzureADServicePrincipal -Filter "displayName eq '$msiName'" # Can take a few seconds, add a sleep if necessary
$graphApiAppRegistration = Get-AzureADServicePrincipal -Filter "appId eq '$graphApiAppId'"
$appRoles = $graphApiAppRegistration.AppRoles | Where-Object { $graphPermissions -contains $_.Value -and $_.AllowedMemberTypes -contains "Application" }
foreach ($appRole in $appRoles) {
New-AzureAdServiceAppRoleAssignment -ObjectId $msi.ObjectId -PrincipalId $msi.ObjectId -ResourceId $graphApiAppRegistration.ObjectId -Id $appRole.Id
}
@itpropro
Copy link
Author

If you want to assign for example Exchange Online permissions, you can adjust line 8:

$graphApiAppRegistration = Get-AzureADServicePrincipal -Filter "displayName eq 'Office 365 Exchange Online'" 

And then use permissions like Exchange.ManageAsApp

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment