i create a new app registration via MgGraph Powershell Module, for example:
$appName = "Test"
$APIResourceID = "00000003-0000-0000-c000-000000000000"
$APIResourceAccess = @{
Id="5ac13192-7ace-4fcf-b828-1a26f28068ee"
Type="Role"
}
$app = New-MgApplication -DisplayName $appName `
-PasswordCredentials @{ displayName="Secret Name" } `
-RequiredResourceAccess @{ ResourceAppId=$APIResourceID; ResourceAccess=@($APIResourceAccess) }
This works, i get an app registration with the API permission "DeviceManagementServiceConfig.ReadWrite.All" but it still requires the admin consent within Entra ID. I know that there is a way to grant the admin consent via Powershell within the Azure Module "az ad app permission admin-consent --id $app.id" but i'd like to stay within MgGraph. I searched a lot, but cant find a way to grant the admin consent with MgGraph, is it just noch possible yet?
checked the documentations but found only ways to grant delegated permissions or application permissions with MgServicePrincipal
To grant admin consent to the Application permissions, check the below:
Create the Service principal after creating the application:
New-MgServicePrincipal -AppId <AppIDofappinappregisterationblade>
Now make use of below script to grant admin consent to the Application permissions:
$params = @{
principalId = "SPObjID"
resourceId = "MicrosoftGraphResourceID"
appRoleId = "APIpermissionID"
}
New-MgServicePrincipalAppRoleAssignedTo -principalId <servicePrincipalId> -BodyParameter $params
To get the values refer below and check this SO Thread by me:
Go to Enterprise application of the application you created:
Copy ObjectID
of Enterprise application and pass in it in principalId
and principalId
values.
The resourceId
is the Microsoft Graph Resource ID:
Remove the filters in Enterprise applications blade and search
References:
Grant tenant-wide admin consent to an application type permissions - Microsoft Entra ID | Microsoft