This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 49%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERC%3C/text%3E%3C/svg%3E)
I have an App Registration that supports multiple organizations / multi-tenants (and I have the corresponding client_id and client_secret). I am trying to get the list of all users who have assigned roles across all tenants that installed my enterprise application. I tried using /servicePrincipals(appId='{appId}')/appRoleAssignedTo but this only gives me users in my organization directory instead of across all tenants and their organization directories for the specified appId.
https://learn.microsoft.com/en-us/graph/api/serviceprincipal-list-approleassignedto?view=graph-rest-1.0&tabs=http
Is there a Graph query that such that I can fetch all role assigned users across all tenants for this specific appId?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
@Ray Chen Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back. Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
The only way to get such data is to query each tenant individually, and to do that you will of course need sufficient permissions within each tenant.
duplicated*
How do I query that data from each tenant individually? I already have the Application.Read.All and Directory.Read.All permissions set (on the delegated level) and some of the tenants already granted consent for their organization.
I want to grab this data from all the tenants using my account (client_id / client_secret), and not needing each tenant to log in and give it to me.
You simply have to obtain a token in the context of a given tenant, then run the query. If you're using any of the MSAL libraries, this is doable via the WithTenantId("tenantname.onmicrosoft.com") method. Once a token is obtained, you will be able to run /servicePrincipals(appId='{appId}')/appRoleAssignedTo in the context of said tenant, giving you the required info.