azure-ad-b2bazure-ad-powershell-v2

Error occurred while executing GetServicePrincipalOAuth2PermissionGrants

My requirement is to fetch permissions granted to Azure ad application from powershell. I have an application with few delegated permissions like this:

enter image description here

I found Get-AzureADServicePrincipalOAuth2PermissionGrant command to achieve my scenario.

But I am facing this error, when I ran the above command:

Get-AzureADServicePrincipalOAuth2PermissionGrant : Error occurred while executing GetServicePrincipalOAuth2PermissionGrants  
Code: Request_ResourceNotFound  
Message: Resource 'XXXXXXXX does not exist or one of its queried reference-property objects are not present.  
RequestId: d0ed46b9-e8ea-47c0-b575-10ba67863ac6  
DateTimeStamp: Wed, 10 Aug 2022 05:59:54 GMT  
HttpStatusCode: NotFound  
HttpStatusDescription: Not Found  
HttpResponseStatus: Completed  
At line:1 char:1  
+ Get-AzureADServicePrincipalOAuth2PermissionGrant -ObjectId XXXXX...  
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
+ CategoryInfo  : NotSpecified: (:) [Get-AzureADServ...PermissionGrant], ApiException  
+ FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetServicePrincipalOAuth2PermissionGrants

I have given the correct ObjectId of the application and I have admin role.

Help me with suggestions on how to avoid this error?

Solution

  • I tried to reproduce the same in my environment and got the below results:

    I created an Azure AD Application and granted same Api permissions like below:

    enter image description here

    I tried to fetch delegated permissions by using the below command and got the same error as below:

    Get-AzureADServicePrincipalOAuth2PermissionGrant -ObjectId 6bd87ba1-29ad-4596-XXXXX

    enter image description here

    Please note that, Service principal of ObjectID means you have to give ObjectID of your Enterprise Application:

    enter image description here

    When I gave ObjectID of Enterprise Application in the below command, got the response successfully:

    Get-AzureADServicePrincipalOAuth2PermissionGrant -ObjectId e6029623-d410-4d8c-82ea-XXXXX | fl

    enter image description here

    Reference:

    Get-AzureADServicePrincipalOAuth2PermissionGrant (AzureAD) | Microsoft Docs