Least API permissions

Question

Hi All,

I am looking for the minimum Microsoft Graph API permissions required to update the Owners of an Azure App Registration (service principal/application).

Can anyone advise which API permissions (delegated or application) are required to add or remove owners programmatically?

Answer 1

I think the least Graph perm for adding or removing owners on an App Registration or Service Principal is Directory.ReadWrite.All (application permission) and that perm is listed for both owner write calls.

Answer 2

To manage owners of an Azure App Registration (application or its service principal) via Microsoft Graph, these are the least-privileged permissions from the documentation.

Application object owners

Add owner (application) – POST /applications/{id}/owners/$ref

• Delegated (work or school):
  • Least privileged: Application.ReadWrite.All and Directory.Read.All
  • Note: Application.ReadWrite.OwnedBy alone is not sufficient to add another owner; consent to Application.ReadWrite.All is required.
• Application (app-only):
  • Least privileged: Application.ReadWrite.OwnedBy and Directory.Read.All

Reference roles (delegated scenarios): Hybrid Identity Administrator, Cloud Application Administrator, Application Administrator.

Remove owner (application) – DELETE /applications/{id}/owners/{id}/$ref

• Delegated (work or school):
  • Least privileged: Application.ReadWrite.All
• Application (app-only):
  • Least privileged: Application.ReadWrite.OwnedBy

Reference roles (delegated scenarios): Hybrid Identity Administrator, Cloud Application Administrator, Application Administrator.

Service principal owners

Add owner (service principal) – POST /servicePrincipals/{id}/owners/$ref

• Delegated (work or school):
  • Least privileged: Application.ReadWrite.All
• Application (app-only):
  • Least privileged: Application.ReadWrite.OwnedBy (plus Directory.Read.All when following the applications tutorial example)

Remove owner (service principal) – DELETE /servicePrincipals/{id}/owners/{id}/$ref

• Delegated (work or school):
  • Least privileged: Application.ReadWrite.All
• Application (app-only):
  • Least privileged: Application.ReadWrite.OwnedBy

Listing owners (for completeness)

To list owners of a service principal:

• Delegated (work or school): least privileged Application.Read.All
• Application (app-only): least privileged Application.Read.All

In all delegated scenarios, the signed-in user must also have an appropriate Microsoft Entra role (for example Application Developer, Cloud Application Administrator, Application Administrator, or other listed least-privileged roles) as documented.

---

References:

• List owners of a service principal
• Update application
• Remove application owner
• Add owner
• Remove service principal owner
• Manage Microsoft Entra applications using Microsoft Graph
• Update servicePrincipal