Graph API - Service Principal app role assignments, returns nothing

Question

I am trying to use the

https://graph.microsoft.com/v1.0/servicePrincipals/ServicePrincipalID/appRoleAssignment

API, however it does not return any results on the 1.0 or beta endpoint. Is this a known issue or am I doing something wrong?

I am using Powershell, MSAL module to get a token, and calling that as a GET request via Invoke-RestMethod. I have also tried the MG Graph PS module equivalent. I have validated that the MG Graph app in Entra ID has application.read.all (and my custom app for trying it directly).

graph.windows.net <-- This works either via direct API call or the Get-AzureADServiceAppRoleAssignment MSOLv2 PS command

graph.microsoft.com <-- Returns nothing either via direct API call or the Get-MgServicePrincipalAppRoleAssignment MG Graph PS command.

Answer 1

The /appRoleAssignments endpoint returns application permissions consented to the given service principal. If delegate permissions are used instead, the /oauth2PermissionGrants endpoint is what you need.

In both cases, if no consent has been granted, nothing will show on the SP object, even if the app object lists the permissions.