azurepowershellazure-app-registration

Unable to use powershell to set empty array on app registration manifest for API permissions

I'm trying to write a powershell script to remove delegated permissions from my app registrations on Azure. I'm able to successfully do this if there is any application type permissions but when trying to remove all delegated permissions from app registrations with application permissions

Eg from this:

    "requiredResourceAccess": [
    {
        "resourceAppId": "00000000-0000-0000-0000-000000000000",
        "resourceAccess": [
            {
                "id": "00000000-0000-0000-0000-000000000000",
                "type": "Scope"
            }
        ]
    }
],

To this:

        "requiredResourceAccess": [],

This doesn't seem to work via powershell using @() but does via the portal.

Here is my powershell script to test this:

Connect-MgGraph -Scopes "Application.ReadWrite.All" -TenantId "XXX"
$dummyPermission = @()

$appId = "XXX" # Define your App ID

$appManifest = Get-MgApplication -ApplicationId $appId
Write-Host "Original RequiredResourceAccess count: $($appManifest.RequiredResourceAccess.Count)" -ForegroundColor Yellow
Update-MgApplication -ApplicationId $appId -RequiredResourceAccess $dummyPermission
$app.RequiredResourceAccess | ConvertTo-Json -Depth 3
Solution

  • Note: There is no direct PowerShell command to set requiredResourceAccess as null.

    Hence you can make use of Microsoft Graph API to set requiredResourceAccess as null:

    For sample, I added application and delegated API permissions:

    enter image description here

    First you need to revoke admin consent granted to the permissions:

    enter image description here

    Make use of below query:

    PATCH https://graph.microsoft.com/v1.0/applications/ObjectID

{
"requiredResourceAccess": []
}

    enter image description here

    Now when I refresh the Portal the API permissions are removed and manifest is set as requiredResourceAccess : []

    enter image description here

    enter image description here

    Alternatively, you can also make use of below PowerShell script:

    Connect-MgGraph -Scopes "Application.ReadWrite.All"

$uri = "https://graph.microsoft.com/v1.0/applications/ObjectID"
$body = @{
    requiredResourceAccess = @()
} | ConvertTo-Json -Depth 3

Invoke-MgGraphRequest -Method PATCH -Uri $uri -Body $body -ContentType "application/json"

    enter image description here

    Reference:

    Graph API - Can you remove all permissions from your own app via api call? - Microsoft Q&A by JanardhanaVedham-MSFT