Equivalent of MS Graph "Application.ReadWrite.OwnedBy" without ability to create new apps

Question

Equivalent of MS Graph "Application.ReadWrite.OwnedBy" without ability to create new apps

Josef Ondrej 0

Hello, the docs for MS Graph mention for the role "Application.ReadWrite.OwnedBy" the following:
"Allows the app to create other applications, and fully manage those applications..."

(See: https://learn.microsoft.com/en-us/graph/permissions-reference#applicationreadwriteownedby)

I would like to ask if there is an equivalent role that can manage the application that it owns already, but can't create new ones.

Thanks, Josef

0 comments

1 answer

Your answer

Answer 1

Vasil Michev 127.5K MVP Volunteer Moderator

Simply assigning the corresponding service principal as the Owner of the desired apps should be sufficient for that.

Alternatively, you can create a custom role, see the documentation here: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-available-permissions

Apart from restricting which specific actions are included in the role, you can modify its scope to only cover objects within specific Administrative unit, thus restricting the default tenant-wide scope. Do note however, that Microsoft has not yet stated, that this is a supported scenario (currently only users, groups and devices are officially supported as members of AUs).

Josef Ondrej 0 Reputation points

2026-08-05T14:09:08.0733333+00:00
Thanks for the prompt response @Vasil Michev

I need to create new roles on the app registration.
I already assigned the service principal as the Owner of the app registration, but unfortunately, this is not enough.

When I am trying to create new roles using the service principal I get this error
ERROR: Insufficient privileges to complete the operation.
I am using this script in Azure DevOps pipeline where I use the service principal via service connection.

$id = '<client id of the app registration>' $file = Join-Path ([System.IO.Path]::GetTempPath()) 'app-roles.json' @' [ {"id":"...","allowedMemberTypes":["User","Application"],"displayName":"Test","value":"Test","description":"Test role.","isEnabled":true} ] '@ | Set-Content $file az ad app update --id $id --app-roles "@$file" az ad app show --id $id --query "appRoles[].{value:value,enabled:isEnabled}" --output table

When I try to run it locally with my user account, everything works.

For the sake of completeness, originally I tried to use terraform and the resource azuread_application_app_role where I got this error:
Error: retrieving Application (Application: "..."): unexpected status 403 (403 Forbidden) with error: Authorization_RequestDenied: Insufficient privileges to complete the operation.