Get the delegated and application permissions for a given Azure AD App. The output clearly shows the roles and scopes (e.g. All.Sites.Manage, Mail.Read etc.) along with display names and resource (e.g. EXO, SPO etc.) information.

Get-AzureADAppPermissions.ps1

#Connect-MgGraph -Scopes "User.Read.All","Group.ReadWrite.All","Application.Read.All", "Application.ReadWrite.All", "Directory.Read.All", "Directory.ReadWrite.All", "Directory.AccessAsUser.All"
#Get-Command -Module Microsoft.Graph* *serviceprincipal*
#Get-MgUser

#Use below if you have exact name to get the service principal of the AAD application
$azureAdAppName = "MGT-App"
$sp = Get-MgServicePrincipal -Filter "DisplayName eq '$azureAdAppName'"

#Use below if you have partial name to get the service principal of the AAD application
#$sp = Get-MgServicePrincipal -Search "DisplayName:MGT" -ConsistencyLevel "eventual"

#Use beloow if you have the Azure AD app ID to get the service principal of the AAD application
#$sp = Get-MgServicePrincipal -Filter "AppId eq '<Azure AD App ID>'"

$permissions = @()

#Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id | select ResourceId, ConsentType, PrincipalId, Scope
$oAuth2PermGrants = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id
$oAuth2PermGrants | %{ 
    $resourceSP = Get-MgServicePrincipal -ServicePrincipalId $_.ResourceId
    $userPrincipal = $_.ConsentType -eq "Principal" ? (Get-MgUser -UserId $_.PrincipalId) : $null
    $permissions += [PSCustomObject] @{
        "PermissionType" = "Delegated"
        "AADAppName" = $sp.DisplayName
        #"AADAppId" = $sp.AppId
        "Resource" = $resourceSP.DisplayName
        #"ResourceId" = $resourceSP.Id
        "Scope" = $_.Scope
        "ConsentType" = $_.ConsentType
        "PrincipalType" =  "User"
        "UPN" =  $userPrincipal -ne $null ? $userPrincipal.UserPrincipalName : "NA"
        "PrincipalId" = $userPrincipal -ne $null ? $userPrincipal.Id : "NA"
    }    
}


$appRoles = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id
$appRoles | %{
	$resourceSP = Get-MgServicePrincipal -ServicePrincipalId $_.ResourceId
	$appRoleInfo = $resourceSP.AppRoles | where Id -eq $_.AppRoleId
    $permissions += [PSCustomObject] @{
        "PermissionType" = "Application"
        "AADAppName" = $sp.DisplayName
        #"AADAppId" = $sp.AppId
        "Resource" = $resourceSP.DisplayName
        #"ResourceId" = $resourceSP.Id
        "Scope" = $appRoleInfo.Value
        "ConsentType" = "NA"
        "PrincipalType" =  $_.PrincipalType
        "UPN" =  "NA"
        "PrincipalId" = $_.PrincipalId
    } 
}

#Show permission details
$permissions | FT -AutoSize

#Export permision details to a csv file
#$permissions | Export-Csv -Path "AppsInventory.csv" -NoTypeInformation