How to delete users who have granted permissions to delegate App Permissions.

Hello @CPO , you can remove delegated permissions for a specific user using the Remove-MgOauth2PermissionGrant command.

Keep in mind that there may be two delegated permission grants authorizing an application to act on behalf of a user when calling an API. This can happen when a user consents for the application on their own behalf (creating an oAuth2PermissionGrant with consentType Principal, identifying the user) and then an administrator grants tenant-wide admin consent on behalf of all users (creating a second oAuth2PermissionGrant with consentType of AllPrincipals). You can use the same command to delete the latter.

Also, and to avoid the user obtaining new access tokens using any previously issued refresh token, use the Invoke-MgBetaInvalidateUserRefreshToken.

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.

To revoke the delegated app permission for accessing OneDrive when a user leaves the company, you can follow these steps using the Azure portal:

1. Sign in to the Azure Portal: Use your administrator credentials to log in to the Azure porta.
2. Navigate to Azure Active Directory:
   • In the left-hand menu, click on "Azure Active Directory."
     • Under the "Manage" section, select "Enterprise applications."
3. Find and Select the App:
   • Use the search bar or browse through the list to find the app that was granted permission to access OneDrive.
     • Click on the app's name to open its details page.
4. Manage Permissions:
   • In the app's details page, go to the "Permissions" section. Here, you'll find a list of permissions granted to the app.
     • Locate the specific delegated permission related to OneDrive that you want to revoke.
5. Revoke the Permission:
   • Click on the permission you want to revoke.
     • In the permissions details page, you should see a "Grant Permissions" section. Find the user who has left the company and revoke their permissions by clicking on the "Revoke" or "Remove" option next to their name.
6. Confirm the Revocation:
   • A confirmation dialog might appear asking you to confirm the revocation. Confirm the action.
7. Save Changes:
   • After confirming, save your changes. The app's permission to access the user's OneDrive will be revoked.

If the user account will be deleted, then just wait for that to happen--all the delegated permission grants for that user will be deleted as well.

If you plan to keep the user account (e.g. disabled), but with to delete the delegated permission grants, the best approach is what Alfredo Revilla mentiones in his answer (the Remove-MgOAuth2PermissionGrant cmdlet)