Grant admin consent for app registration API permission

Question

i create a new app registration via MgGraph Powershell Module, for example:

$appName = "Test"
$APIResourceID = "00000003-0000-0000-c000-000000000000"
$APIResourceAccess = @{
        Id="5ac13192-7ace-4fcf-b828-1a26f28068ee"
        Type="Role"
    }
$app = New-MgApplication -DisplayName $appName `
    -PasswordCredentials @{ displayName="Secret Name" } `
    -RequiredResourceAccess @{ ResourceAppId=$APIResourceID; ResourceAccess=@($APIResourceAccess) }

This works, i get an app registration with the API permission "DeviceManagementServiceConfig.ReadWrite.All" but it still requires the admin consent within Entra ID. I know that there is a way to grant the admin consent via Powershell within the Azure Module "az ad app permission admin-consent --id $app.id" but i'd like to stay within MgGraph. I searched a lot, but cant find a way to grant the admin consent with MgGraph, is it just noch possible yet?

checked the documentations but found only ways to grant delegated permissions or application permissions with MgServicePrincipal

Answer 1

To grant admin consent to the Application permissions, check the below:

Create the Service principal after creating the application:

New-MgServicePrincipal -AppId <AppIDofappinappregisterationblade>

Now make use of below script to grant admin consent to the Application permissions:

$params = @{
principalId = "SPObjID"
resourceId = "MicrosoftGraphResourceID"
appRoleId = "APIpermissionID"
}
New-MgServicePrincipalAppRoleAssignedTo -principalId <servicePrincipalId> -BodyParameter $params

To get the values refer below and check this SO Thread by me:

Go to Enterprise application of the application you created:

Copy ObjectID of Enterprise application and pass in it in principalId and principalId values.

The resourceId is the Microsoft Graph Resource ID:

Remove the filters in Enterprise applications blade and search

References:

Grant tenant-wide admin consent to an application delegated permissions - Microsoft Entra ID | Microsoft

Grant tenant-wide admin consent to an application type permissions - Microsoft Entra ID | Microsoft