Unable to grant Graph API permission to Managed Identity Enterprise application

Question

Unable to grant Graph API permission to Managed Identity Enterprise application

Chinmayi Bose 20

Hi,

I am trying to grant Graph API permission to managed identity. I am following the below article to grant permissions.

https://techcommunity.microsoft.com/blog/integrationsonazureblog/grant-graph-api-permission-to-azure-automation-system-assigned-managed-identity/4278846

I understand it is a limitation to grant permission directly through Azure portal.

I ran the script from the above article, It was executed with the below warning as:

"WARNING: App roles found:

Exception:

Line |

4 | throw "Some App Roles are not found on Graph API service principa …

| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

| Some App Roles are not found on Graph API service principal"

However, I refreshed the permissions page in the enterprise application and there are no privileges listed.

I need to fix this to execute a runbook in Automation account.

Error in the runbook is as below:

"+ Connecting to Graph (Managed Identity) [Authorization_RequestDenied] : Insufficient privileges to complete the operation. "

Please advise.

Regards,

Chinmayi bose

0 comments

2 answers

Your answer

Answer 1

Chinmayi Bose 20

Hi Raja,

I am using managed Identity in enterprise application so the above suggestion will not work for me.

Could you help me on removing the permissions from the Graph Explorer(the one we added).

Thank you,

Chinmayi Bose

0 comments

Answer 2

Raja Pothuraju 47,730 Microsoft Employee Moderator

Hello Chinmayi Bose,

Based on your description, I understand that you want to add API permissions to a system-assigned managed identity in your directory, where you only have the service principal object ID of that managed identity.

Please follow the steps below to add Microsoft Graph API permissions to your Managed Identity Enterprise Application:

Sign in to Graph explorerwith your Global Administrator account.
Paste the following URL and select POST: https://graph.microsoft.com/v1.0/oauth2PermissionGrants
Navigate to the Modify Permissions tab after pasting the above URL. Click Consent for the Directory.ReadWrite.All API permission.
Go back to the Request Body tab and paste the following JSON:

{
   "clientId": "00001111-aaaa-2222-bbbb-3333cccc4444",  
   "consentType": "AllPrincipals",  
   "resourceId": "03be439e-65de-488e-8aae-2b148ad586d4",  
   "scope": "User.Read.All Group.Read.All"  
}

clientId: Enter the Object ID of your Managed Identity Enterprise Application.
resourceId: This should be the Object ID of the Microsoft Graph first-party application. (The value provided above is correct; no changes are required.)
scope: Specify the list of API permissions you want to assign to the Enterprise Application.
After editing, click Run Query. You should receive a response similar to the screenshot provided.
Once the request is successful, go to your Managed Identity Enterprise Application in the portal, open the Permissions tab, and verify that the permissions have been added.

User's image

Please refer the below document for more details on same steps.

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=ms-graph#grant-admin-consent-for-delegated-permissions-using-microsoft-graph-api

Chinmayi Bose 20 Reputation points

2025-09-03T08:51:42.3+00:00

Hi,

Thank you for your response.

I was able to grant consent but there was a Bad Response message. So I hope it did not work.

Similarly I tried to update the details and run query again still getting the same error message.

Please advise.

Thank you
Raja Pothuraju 47,730 Reputation points Microsoft Employee Moderator

2025-09-03T11:54:58.15+00:00

Hello Chinmayi Bose,

Understood the problem here.

I just checked in another tenant, the object ID of Microsoft Graph is different it isn't same.

So, you need replace the resourceId value with your Microsoft Graph object ID. To please check that please go to Enterprise application and remove all the filter and search for Microsoft Graph and copy paste the object ID of that resource app.
Chinmayi Bose 20 Reputation points

2025-09-04T08:02:17.82+00:00

Hi Raja,

I was able to grant the permission with updated resourceID value. It is now updated in enterprise application. Unfortunately, I am getting the same error while running the script in Automation runbook.

Regards,

Chinmayi Bose
Raja Pothuraju 47,730 Reputation points Microsoft Employee Moderator

2025-09-04T09:10:36.43+00:00

Hello Chinmayi Bose,

That’s great. Regarding your script, the user or service account you used does not have the required privileges. Please verify this and ensure that you have granted consent to the Directory.ReadWrite.All scope when logging in.
Raja Pothuraju 47,730 Reputation points Microsoft Employee Moderator

2025-09-05T11:59:12.74+00:00

Hello Chinmayi Bose,

If all your concerns have been resolved, I would greatly appreciate it if you could mark the answer as "Accepted." This helps both us and others in the community.
Chinmayi Bose 20 Reputation points

2025-09-09T08:22:55.57+00:00

Hi Raja,

I would like to change the type from Delegated to Application. Also I would need to add below permissions.

Thank you
Raja Pothuraju 47,730 Reputation points Microsoft Employee Moderator

2025-09-09T08:42:46.64+00:00

Chinmayi Bose - After adding these scopes or API to application to run the script in Automation runbook without any issue?
Looks like your script is generating token without any user interaction. In that case, yes you have to use application permission instead of delegated permissions.
Chinmayi Bose 20 Reputation points

2025-09-10T10:01:08.3666667+00:00

Hi Raja,

Yes I want to change the type from delegate to Application and add the auditlog read all permissions to it. Please advise
Raja Pothuraju 47,730 Reputation points Microsoft Employee Moderator

2025-09-10T14:40:36.1966667+00:00
Hello Chinmayi Bose,

To add the application permission, please follow the steps below:

Sign in to the Azure Portal with a Global Administrator account.

Navigate to Microsoft Entra ID > App registrations.

Search for and select the application to which you want to add the permission.

Go to the API permissions tab, then click Add a permission.

Select Microsoft Graph.

Choose Application permissions, then search for AuditLog.Read.All as shown in the screenshot below.

Select the permission and click Add permissions.

After adding the permission, click on Grant admin consent for your application.
Raja Pothuraju 47,730 Reputation points Microsoft Employee Moderator

2025-09-10T14:46:28.8833333+00:00
If you don’t see the application listed under your App registrations blade but want to add an application API permission, you can follow the documentation below.

Run the Microsoft Graph query in the same way I explained earlier for Delegated permissions, but this time follow the steps for Application permissions https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=ms-graph#grant-admin-consent-for-application-permissions-using-microsoft-graph-api

POST https://graph.microsoft.com/v1.0/servicePrincipals/11112222-bbbb-3333-cccc-4444dddd5555/appRoleAssignedTo Request body { "principalId": "aaaaaaaa-bbbb-cccc-1111-222222222222", "resourceId": "a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1", "appRoleId": "df021288-bdef-4463-88db-98f22de89214" }
Chinmayi Bose 20 Reputation points

2025-09-17T14:52:19.7866667+00:00

Hi Raja,

Unfortunately the above commandlets did not work. Could you help in removing these permissions from graph explorer.

Thank you