Least Permission required for creation SPN via code

Question

Hi Team,

Just wanted to double check is there any limitation on number of SPN or App registration that can be done via this MS Graph API permission "Application.ReadWrite.OwnedBy"

As per this documentation https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/quickstart-app-registration-limits there are some limitation if we assign it to a user. i.e., microsoft.directory/applications/createAsOwner: Assigning this permission results in the creator being added as the first owner of the created app registration, and the created app registration counts against the creator's 250 created objects quota.

Will this be the same issue with this MS Graph API permission "Application.ReadWrite.OwnedBy" assigned to a SPN

Answer 1

@Rahul

Thank you for posting this in Microsoft Q&A.Whenever there is an application or SPN created in tenant, it is considered as 1 object.

Permission MS Graph API permission "Application.ReadWrite.OwnedBy" will count an object whenever there is an SPN created.

Hence, MS Graph API permission "Application.ReadWrite.OwnedBy" assigned to a SPN will have the same behavior as mentioned in the document.

Let us know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.