powershellazure-authenticationazure-ad-b2b

Unable to revoke admin consent for added permissions: Powershell

I have one Azure Ad app where I added permissions using Add-AzADAppPermission

To grant admin consent to these, I used CLI commands here

az login
az ad app permission admin-consent --id <application-id>

I can see admin consent is granted for these permissions in Portal:

enter image description here

But I want to remove this consent now from PowerShell.

Is there any command like Revoke-AzADPermissionGrant to achieve that?

I can do this from Portal, but I want it from PowerShell or CLI or Graph query.

Can anyone please shed light on this?

Solution

  • To revoke admin_consent granted for Azure AD application permissions, you can make use of below Graph API query:

    DELETE https://graph.microsoft.com/v1.0/oauth2PermissionGrants/<id>

    To get the <id>, you can run this query by filtering it with Service Principal ObjectID.

    GET https://graph.microsoft.com/v1.0/oauth2PermissionGrants/?$filter=clientId eq 'SP ObjectID'

    I tried to reproduce the same in my environment and got the below results:

    I created one Azure AD application and granted same API permissions like this:

    enter image description here

    You can get SP ObjectID of the above application like below:

    Go to Azure Portal -> Azure AD -> Enterprise Applications -> Your App -> Overview

    enter image description here

    I ran the below query to get <id> by including filter like this:

    GET https://graph.microsoft.com/v1.0/oauth2PermissionGrants/?$filter=clientId eq 'SP ObjectID'

    Response:

    enter image description here

    I ran the DELETE query like below, I got the response successfully:

    DELETE https://graph.microsoft.com/v1.0/oauth2PermissionGrants/<id>

    Response:

    enter image description here

    When I checked Azure Portal, admin consent got revoked successfully for that application like below:

    enter image description here

    To do the same from PowerShell, try running below commands:

    Connect-MgGraph
Import-Module Microsoft.Graph.Identity.SignIns
Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $Id

    Make sure to install Microsoft.Graph module before running those commands.

    If not, try using below command to install that module:

    Install-Module Microsoft.Graph -Scope CurrentUser