New-MgApplication failing even with correct permissions

Question

I'm trying to automate the creation of Azure application using PowerShell Microsoft.Graph module cmdlets. When running New-MgApplication I'm getting error: "New-MgApplication_CreateExpanded1: Insufficient privileges to complete the operation."

Microsoft Graph indicates the permissions required for this command are :
New-MgApplication Applications POST /applications IMicrosoftGraphApplication1 {Application.ReadWrite.All, Directory.AccessAsUser.All} {Create1, CreateExpanded1}

I consented to get those permissions and I do get them listed when I run:

(Get-MgContext).Scopes
Application.ReadWrite.All
Directory.AccessAsUser.All
Directory.ReadWrite.All

Why I still getting the insufficient privileges error? what Am I missing?

Answer 1

Hi @RegioNW

I tested the command locally and it works fine for me.

First run the command to connect to MgGraph. The command prompts you to go to a web page to sign in using a device code. Once you've done that, the command indicates success with a Welcome To Microsoft Graph! message. You only need to sign in once per session.

Connect-MgGraph -Scopes "Application.ReadWrite.All"  

Then run the command to automatically create the Azure AD application:

New-MgApplication -DisplayName 'New app 2' | Format-List Id, DisplayName, AppId, SignInAudience, PublisherDomain  

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi @RegioNW

You can use this PowerShell command to add an instance of an application from the Azure AD application gallery into your directory.

Import-Module Microsoft.Graph.Applications  
  
$params = @{  
	DisplayName = "Azure AD SAML Toolkit"  
}  
  
Invoke-MgInstantiateApplicationTemplate -ApplicationTemplateId $applicationTemplateId -BodyParameter $params  

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Hi CarlZhao, tks for your answer, I did exactly as you mentioned and it works, however when using -ApplicationTemplateId it fails with the insufficient permissions error, do we need a special permission to use this parameter?

Answer 4

here the parameter values I'm trying to execute:
New-MgApplication -DisplayName "myAppDisplayName" -ApplicationTemplateId "5da54e9e-f26d-4c5e-a38c-b410271496a8"

and getting:

New-MgApplication_CreateExpanded1: Insufficient privileges to complete the operation.