Adding Scopes to Azure AD Application with Powershell (Expose an API)

Question

I'd like to add a Scope to an Azure AD App / Service Principal (UI=Expose an API) with Powershell.

$app = New-MgApplication -DisplayName $name -SignInAudience "AzureADMyOrg"
Update-MgApplication -ApplicationId $app.id -IdentifierUris @("api://$($app.AppId)")

$oauth_permission_scopes = @{
        AdminConsentDescription = "admin desc"
        AdminConsentDisplayName = "admin name"
        Type = "Admin"
        Value = "Read.all"
        Id = $([guid]::NewGuid())
    }
$sp = New-MgServicePrincipal -AppId $app.AppId -Notes $description -Tags @("HideApp","WindowsAzureActiveDirectoryIntegratedApp")  #HideApp=VisibleToUsers
Update-MgServicePrincipal -ServicePrincipalId $sp.Id -Oauth2PermissionScopes $oauth_permission_scopes

But i get the message:

Update-MgServicePrincipal_UpdateExpanded1: Property 'oauth2PermissionScopes' is read-only and cannot be set.

Can this only be added in the UI?!

Answer 1

I tried to reproduce the same in my environment and got below results:

I ran the same code as you to add scopes and got same error as below:

When I checked the same in Portal, application is created but scope not added like below:

To add scope to Azure AD Application with PowerShell (Expose an API), you need to modify your script as suggested by Cpt.Whale like this:

$api = @{
    oauth2PermissionScopes = @(
        @{
        AdminConsentDescription = "admin desc"
        AdminConsentDisplayName = "admin name"
        Type = "Admin"
        Value = "Read.all"
        Id = $([guid]::NewGuid())
    }
    )
}

Update-MgApplication -ApplicationId $app.id -Api $api

Response:

When I checked the same in Portal, scope added successfully in Expose an API tab of Azure AD application as below: