HTTP request to update Service Principal in Microsoft Entra ID fails for POST calls

I'm trying to write a script to update the permissions for a managed identity using PowerShell and the REST API, but I'm running into a problem and I don't know how to troubleshoot it any further.

My script connects to an App Registration with App ID and Secret, generates a token and I use that token in my "Invoke-RestMethod" command.

Connecting works fine, and I can run GET commands against the endpoints, but trying to update it using a POST gives me an error of "Not a valid reference update".

This is the bit of code:

# Payload in Hashtable
$POSTBody = @{
    principalID = "$($MIDData.id)"
    resourceID = "$ObjectID"
    appRoleId = "$($TEMProle.id)"
}


# check if Hashtable converts to JSON
$POSTBody | convertto-json

$AppRoleAssignment = "https://graph.microsoft.com/beta/servicePrincipals/$ObjectID/appRoleAssignedTo"

Invoke-RestMethod -Uri $AppRoleAssignment -Headers @{Authorization = "Bearer $($TokenAccess)" }  -Method POST -Body $($POSTBody | convertto-json) -ContentType "application/json"

I'm confident my variables are correct. I've tried hard-coding them as well, but I get the same result.

Note that, you need to pass Object ID of Microsoft Graph Enterprise Application for resourceID parameter.

In my case, I ran below API call to get the object ID of Microsoft Graph service principal:

GET https://graph.microsoft.com/v1.0/servicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'

Now I ran below PowerShell script to generate token and call API to add User.Read.All permission of Application type to managed identity:

$AppId = "appID"
$ClientSecret = "secret"
$TenantId = "tenantID"

$TokenEndpoint = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"
$Body = @{
    client_id     = $AppId
    scope         = "https://graph.microsoft.com/.default"
    client_secret = $ClientSecret
    grant_type    = "client_credentials"
}

$TokenResponse = Invoke-RestMethod -Uri $TokenEndpoint -Method Post -Body $Body -ContentType "application/x-www-form-urlencoded"
$AccessToken = $TokenResponse.access_token

$PrincipalId = "fd0e0b8b-53f6-4bcd-a723-xxxxx"   # Managed identity Object ID
$ResourceId = "c68a82f4-ecea-4f65-8047-xxxxx"     # Microsoft Graph Enterprise App Object ID
$AppRoleId = "df021288-bdef-4463-88db-98f22de89214"      # User.Read.All permission App Role ID

$POSTBody = @{
    principalId = $PrincipalId
    resourceId  = $ResourceId
    appRoleId   = $AppRoleId
}

$POSTBodyJSON = $POSTBody | ConvertTo-Json 

$AppRoleAssignment = "https://graph.microsoft.com/beta/servicePrincipals/$ResourceId/appRoleAssignedTo"

try {
    $Response = Invoke-RestMethod -Uri $AppRoleAssignment `
        -Headers @{Authorization = "Bearer $AccessToken"} `
        -Method POST `
        -Body $POSTBodyJSON `
        -ContentType "application/json"

    Write-Host "App Role Assignment Successful:"
    Write-Host ($Response | ConvertTo-Json -Depth 10 -Compress)
} catch {
    Write-Error "Error assigning App Role: $($_.Exception.Message)"
}

Response:

To confirm that, I checked the same in Azure Portal where User.Read.All permission of Application type added successfully to managed identity like this:

Reference:

Grant an appRoleAssignment for a service principal - Microsoft Graph