What would be the least privilege permission to create a SAML signin certificate using a Custom Role ?

Avinash Banjan 1 Reputation point
2022-11-24T08:17:54.687+00:00

I need to create a signing certificate using Graph API via Custom Role with has least permission to do just this job. Please suggest what would be the least permission to get this done ?

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
10,557 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vicky Kumar (Mindtree Consulting PVT LTD) 1,156 Reputation points Microsoft Employee
    2022-11-24T18:39:46.16+00:00

    Grant yourself the following delegated permissions:

    Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, Policy.Read.All, Policy.ReadWrite.ApplicationConfiguration, and User.ReadWrite.All.

    Read the doc to create SAML signin custom signing certificate - https://learn.microsoft.com/en-us/graph/application-saml-sso-configure-api?tabs=http%2Cpowershell-script