Graph API access to Azure Active Directory through Enterprise Application

Question

Need help with Graph API access to Azure Active Directory through Enterprise Application. Tried various PowerShell commands unable to get up.

Answer 1

Yea sounds like you are using the newer version of mggraph that is breaking runbook compatibility.

You may need to step back to 2.25.0

https://learn.microsoft.com/en-us/answers/questions/2278135/getting-failure-with-connect-mggraph

https://office365itpros.com/2025/03/04/powershell-sdk-problems/

Answer 2

Hello ARC,

The error "Authentication needed. Please call Connect-MgGraph" usually occurs due to compatibility issues between newer Microsoft Graph PowerShell modules and PowerShell 7.2 runbooks in Azure Automation.

To resolve this, first delete the latest versions of any Microsoft Graph modules from your Automation Account like this:

Then install modules of version 2.25.0, which is stable for this use case by running below PowerShell script in Azure Cloud Shell:

# Import Microsoft.Graph.Authentication module

$moduleName = 'Microsoft.Graph.Authentication'
$moduleVersion = '2.25.0'

New-AzAutomationModule -AutomationAccountName 'AutAccName' -ResourceGroupName 'rgName' -Name $moduleName -ContentLinkUri "https://www.powershellgallery.com/api/v2/package/$moduleName/$moduleVersion" -RuntimeVersion '7.2'

# Import Microsoft.Graph.Users module

$moduleName = 'Microsoft.Graph.Users'
$moduleVersion = '2.25.0'

New-AzAutomationModule -AutomationAccountName 'AutAccName' -ResourceGroupName 'rgName' -Name $moduleName -ContentLinkUri "https://www.powershellgallery.com/api/v2/package/$moduleName/$moduleVersion" -RuntimeVersion '7.2'

# Import Microsoft.Graph.Users.Actions module

$moduleName = 'Microsoft.Graph.Users.Actions'
$moduleVersion = '2.25.0'

New-AzAutomationModule -AutomationAccountName 'sriautgraph' -ResourceGroupName 'Sri' -Name $moduleName -ContentLinkUri "https://www.powershellgallery.com/api/v2/package/$moduleName/$moduleVersion" -RuntimeVersion '7.2'

Wait until these modules show Available in the portal before testing your runbook.

Make sure to grant LicenseAssignment.ReadWrite.All and User.ReadWrite.All permissions of Application type to managed identity service principal:

You can refer below script to add required Application type permissions:

$msiName    = "autaccname"
$graphAppId = "00000003-0000-0000-c000-000000000000"  
$permissions = @(
    "LicenseAssignment.ReadWrite.All",
    "User.ReadWrite.All"
)

$graphSP = Get-AzADServicePrincipal -AppId $graphAppId

foreach ($permission in $permissions) {
    $appRole = $graphSP.AppRole | Where-Object {
        $_.Value -eq $permission -and $_.Origin -eq "Application"
    }

    if ($appRole) {
        New-AzADServicePrincipalAppRoleAssignment `
            -ServicePrincipalDisplayName $msiName `
            -ResourceDisplayName $graphSP.DisplayName `
            -AppRoleId $appRole.Id
    } else {
        Write-Warning "Permission '$permission' not found in Microsoft Graph"
    }
}

After that, you can run the below modified script to remove any licenses assigned to the end user:

Connect-MgGraph -Identity

$UserId = "******@xxxxxxxx.onmicrosoft.com"

try {
    $licenseDetails = Get-MgUserLicenseDetail -UserId $UserId
    $skuIds = $licenseDetails.SkuId

    if ($skuIds.Count -gt 0) {
        $params = @{
            addLicenses = @()
            removeLicenses = $skuIds
        }

        $result = Set-MgUserLicense -UserId $UserId -BodyParameter $params
        Write-Output "Attempted to remove licenses for user: $UserId"
    } else {
        Write-Output "User $UserId has no licenses assigned."
    }
}
catch {
    Write-Error "Failed to remove licenses for user ${UserId}: $_"
}


Disconnect-MgGraph

Response:

Let me know if you still need help with setup or testing. Happy to assist.

Hope this helps!

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful, which may help members with similar questions.

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.