Retrieving permission IDs for Microsoft Graph API - Delegated / Application Permissions GUID for various Scopes

user_8006379 0
Viewed 460

Is there a quick and easy way to find Microsoft Graph API - Delegated / Application Permissions GUID (or even deprecated Azure AD API Permissions).

Tried to follow the official document but find it not very intuitive. https://docs.microsoft.com/en-us/graph/permissions-reference

Since permissions names are similar, eg: group.readwrite.all between delegated vs application, is there any tool or technique to easily find these IDs.

az ad sp list --query "[?appDisplayName=='Microsoft Graph'].{permissions:oauth2Permissions}[0].permissions[?value=='Group.ReadWrite.All'].{id: id, value: value, adminConsentDisplayName: adminConsentDisplayName, adminConsentDescription: adminConsentDescription}[0]" --all
{
  "adminConsentDescription": "Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user.  Additionally allows group owners to manage their groups and allows group members to update group content.",
  "adminConsentDisplayName": "Read and write all groups",
  "id": "4e46008b-f24c-477d-8fff-7bb4ec7aafe0",
  "value": "Group.ReadWrite.All"
}

this seems to be incorrect as the ID that is correct is:

        Group_ReadWrite_All = {
          id   = "62a82d76-70ea-41e2-9197-370581804d09"
          type = "Role"
        }

Am I missing something obvious here? especially the Role/Scope or its Delegated vs Application issue?

microsoft-graph-api azure-active-directory azure
1 Answers

Query to list all the Apps

az ad sp list  --query '[].{appDisplayName:appDisplayName, appId:appId}'

Query "Microsoft Graph" app, to find "oauth2" scope of "Group.ReadWrite.All" permission

az ad sp list --query "[?appDisplayName=='Microsoft Graph'].{permissions:oauth2Permissions}[0].permissions[?value=='Group.ReadWrite.All'].{id: id, value: value, adminConsentDisplayName: adminConsentDisplayName, adminConsentDescription: adminConsentDescription}[0]" --all

{
  "adminConsentDescription": "Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user.  Additionally allows group owners to manage their groups and allows group members to update group content.",
  "adminConsentDisplayName": "Read and write all groups",
  "id": "4e46008b-f24c-477d-8fff-7bb4ec7aafe0",
  "value": "Group.ReadWrite.All"
}

Query "Microsoft Graph" app, to find app "Role" of "Group.ReadWrite.All" permission

az ad sp list --query "[?appDisplayName=='Microsoft Graph'].{permissions:appRoles}[0].permissions[?value=='Group.ReadWrite.All'].{id: id, value: value, adminConsentDisplayName: adminConsentDisplayName, adminConsentDescription: adminConsentDescription}[0]" --all

{
  "adminConsentDescription": null,
  "adminConsentDisplayName": null,
  "id": "62a82d76-70ea-41e2-9197-370581804d09",
  "value": "Group.ReadWrite.All"
}
user_80063790
Related