Unable to assign permissions to the service principle through Graph API

Question

**I am trying to assign API permission to Service principle which is showing under enterprise applications not in app registration tab

when i am trying with graph API geeting bellow errors as i am giivng the correct principle id still geeting same error

{**

**"error": {**

    **"code": "Request_BadRequest",**

    **"message": "Principal was not found or was not a valid user.",**

    **"innerError": {**

        **"date": "2025-10-31T12:35:55",**

        **"request-id": "a74a7ac2-d78b-4f78-9582-7fc3ecf97481",**

        **"client-request-id": "261222ce-c063-5eae-f60f-6dea088a5b68"**

    **}**

**}**

}

Answer 1

Hello @Kondeti Amrutha,

Based on your description, I understand that you want to add API permissions to a system-assigned managed identity in your directory, where you only have the service principal object ID of that managed identity.

Please follow the steps below to add Microsoft Graph API permissions to your Managed Identity Enterprise Application:

1. Sign in to Graph explorerwith your Global Administrator account.
2. Paste the following URL and select POST: https://graph.microsoft.com/v1.0/oauth2PermissionGrants
3. Navigate to the Modify Permissions tab after pasting the above URL. Click Consent for the Directory.ReadWrite.All API permission.
4. Go back to the Request Body tab and paste the following JSON:

{
   "clientId": "00001111-aaaa-2222-bbbb-3333cccc4444",  
   "consentType": "AllPrincipals",  
   "resourceId": "03be439e-65de-488e-8aae-2b148ad586d4",  
   "scope": "User.Read.All Group.Read.All"  
}

• clientId: Enter the Object ID of your Managed Identity Enterprise Application.
• resourceId: This should be the Object ID of the Microsoft Graph first-party application. (The value provided above is correct; no changes are required.)
• scope: Specify the list of API permissions you want to assign to the Enterprise Application.
• After editing, click Run Query. You should receive a response similar to the screenshot provided.
• Once the request is successful, go to your Managed Identity Enterprise Application in the portal, open the Permissions tab, and verify that the permissions have been added.

Please refer the below document for more details on same steps.

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=ms-graph#grant-admin-consent-for-delegated-permissions-using-microsoft-graph-api

To add an application API permission, you can follow the documentation below.

Run the Microsoft Graph query in the same way I explained earlier for Delegated permissions, but this time follow the steps for Application permissions. https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=ms-graph#grant-admin-consent-for-application-permissions-using-microsoft-graph-api

POST https://graph.microsoft.com/v1.0/servicePrincipals/11112222-bbbb-3333-cccc-4444dddd5555/appRoleAssignedTo

Request body

{
   "principalId": "aaaaaaaa-bbbb-cccc-1111-222222222222",
   "resourceId": "a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1",
   "appRoleId": "df021288-bdef-4463-88db-98f22de89214"
}

• Enter the Object ID of your Enterprise application in your Graph query ID.
• PrincipalID: Here the enter the Object ID of your Managed Identity Enterprise Application.
• ResourceID: This should be the Object ID of the Microsoft Graph first-party application.
• AppRoleID: This much be your scope app role ID of your resource application. For example if its Microsoft Graph, you can get these IDs by running below Graph query.

GET https://graph.microsoft.com/v1.0/servicePrincipals?$filter=displayName eq 'Microsoft Graph'&$select=id,displayName,appId,appRoles