Assigning Microsoft Graph API Application Permissions to a Managed Identity Using Azure CLI

Introduction

Managed Identities provide a secure way for Azure resources to authenticate to Microsoft Entra ID without storing credentials. However, when a Managed Identity needs to call Microsoft Graph APIs, it must be granted the appropriate Microsoft Graph application permissions.

Recently, I was working on an Azure Function that needed to retrieve users and groups from Microsoft Entra ID using Microsoft Graph and, at the same time, assign Microsoft Graph permissions, such as User.Read.All and Group.Read.All to the Managed Identity, I encountered an Authorization_RequestDenied error despite having Application Administrator privileges.

In this article, I'll walk through:

How to retrieve Microsoft Graph App Role IDs
How to assign Microsoft Graph application permissions to a Managed Identity
What Microsoft Entra role is required to perform the assignment

Understanding Microsoft Graph App Roles

When assigning Microsoft Graph application permissions programmatically, you cannot use the permission name directly.

Instead, Microsoft Graph expects the corresponding App Role ID.

The App Role ID can vary and should always be retrieved directly from the Microsoft Graph Service Principal.

Retrieve the Microsoft Graph Service Principal Object ID

Microsoft Graph uses the following Application ID:

00000003-0000-0000-c000-000000000000

The assignment operation requires the Object ID of the Microsoft Graph Service Principal in your tenant.

az rest `
    --method GET `
    --uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$count=true&`$filter=appId eq '00000003-0000-0000-c000-000000000000'" `
    --headers "ConsistencyLevel=eventual" "Content-Type=application/json" `
    --query "value[0].id" `
    --output tsv

Note the value of the id property.

Get the App Role ID for User.Read.All and Group.Read.All

The following command filters the response and returns only the User.Read.All permissions:

$response = az rest -m GET -u "https://graph.microsoft.com/v1.0/servicePrincipals(appId='00000003-0000-0000-c000-000000000000')?`$select=appRoles" | ConvertFrom-Json
$response.appRoles |Where-Object { $_.value -eq "User.Read.All" } |Select-Object id, value, displayName
$response.appRoles |Where-Object { $_.value -eq "Group.Read.All" } |Select-Object id, value, displayName

Retrieving the Managed Identity Service Principal

Next, retrieve the Object ID of your Managed Identity.

$webAppName = “b2crole”

$managedIdentitySp = az ad sp list --display-name $webAppName --query "[0]" | ConvertFrom-Json

$managedIdentitySp |Select-Object id

Assign your actual web app name for $webAppName

The returned value is the Managed Identity Service Principal Object ID.

Assign User.Read.All Permission to the Managed Identity

Use the following request:

az rest -m POST -u https://graph.microsoft.com/v1.0/servicePrincipals/{ManagedIdentityObjectID}/appRoleAssignments -b '{"principalId":{ManagedIdentityObjectID}, "resourceId": {Object Id of the Graph API service principal},"appRoleId": {user.readl.all id}'

Resouced Id: The object ID of the Microsoft Graph API service principal

appRoleId: user.read.all ID

PrincipalId: The object ID of the Managed Identity

Common Error: Authorization_RequestDenied

You may encounter the following error:

{
  "error": {
    "code": "Authorization_RequestDenied",
    "message": "Insufficient privileges to complete the operation."
  }
}

This is commonly seen when assigning Microsoft Graph permissions, even though the same account can successfully assign permissions to other enterprise applications.

Required Microsoft Entra Roles

For many application registrations and enterprise applications, the following roles are sufficient:

Application Administrator
Cloud Application Administrator

However, Microsoft Graph application permissions are treated differently because they grant access to directory data.

To assign Microsoft Graph application permissions, such as:

User.Read.All
Group.Read.All

The recommended minimum role is:

Privileged Role Administrator

The following roles can also perform the assignment:

Privileged Role Administrator
Global Administrator

If your organization uses Privileged Identity Management (PIM), ensure that the Privileged Role Administrator role is activated before executing the command.

Summary

Managed Identities eliminate the need to store secrets when accessing Microsoft Graph. However, assigning Microsoft Graph application permissions requires understanding the relationships among App Role IDs, Service Principals, and Microsoft Entra administrative roles.

Following the above steps allows Azure Functions, Logic Apps, App Services, and other Azure resources using Managed Identity to access Microsoft Graph securely without client secrets or certificates.