Ability to Grant Permissions via API or Powershell
Azure AD allows you to create app registrations, define roles on them and give permissions to each other (as application identities). This way you can have a Web application talking to your API with its service principal and you can protect your API with roles.
Service Principal creation, role definition and permission assignment can be done through Portal, Powershell and API. But in order to make Application Permissions (which requires admin consent) work, you need someone with Global Administrator role to go to Azure Portal and click Grant Permissions button (or do the same thing via OAuth prompt on your web apps).
Right now there is no way to automatize Grant Permissions and it is a manual process at the moment. We confirmed this with the Microsoft Support and Product Teams as well.
If this can be managed via Powershell or API, we would like to include it in our Automation Runbooks and take the work load off of our security teams.

Thank you for the feedback! This is in the backlog and we are looking into this. We don’t have an ETA yet, but we will share once we have one. Please keep voting if this feature matters to you.
20 comments
-
Dmitry Serbin commented
We also need this feature! Is there any update?
-
Charl commented
I sometimes wish that MS stops building new stuff in Azure and AzureAD and first bring its APIs SDKs and modules and documentation in order.
-
Anonymous commented
yes please - a set of commandlets to grant API permissions would be helpful
-
Claude Gex commented
We managed to grant delegated permission via https://graph.microsoft.com/v1.0/oAuth2Permissiongrants
see https://docs.microsoft.com/en-us/graph/api/resources/oauth2permissiongrant?view=graph-rest-1.0
Application Roles can be add via https://graph.microsoft.com/v1.0/servicePrincipals/<service-principal-id>/appRoleAssignedTo or via https://docs.microsoft.com/en-us/graph/api/serviceprincipal-post-approleassignments?view=graph-rest-1.0&tabs=http
-
Majed commented
Do we have any update on this?
-
Bill commented
@Microsoft, heading for two years with no further update. What is the ETA on this?
Thanks
-
Stefan Buciu commented
Hello there,
Any updates on this?
Best regards,
Stefan -
Claude Gex commented
Hi all
We are struggling with the exact same issue as Mats described.
@microsoft azure ad team: what is the current state?
Kind regards
Claude -
Mike McAdams commented
+1 on this ... need a way to write a test that enumerates all permission scopes (app and user) and then confirms the presence of a scope within the cloud at hand
-
Andy Ball commented
Bump
-
Mats Magnem commented
Hi all
Yo you know if this is possible yet? The Azure portal does this by the REST API, but when I try to do the same, I get that the api-version is wrong. I guess this is functionality Microsoft wants for themselves.I have tried:
POST https://graph.windows.net/myorganization/consentToApp?api-version=2.0
With my valid access token and the proper request object containing app id, dynamicPermissions (roles and scopes) etc.But it does not work. I have also swapped "myorganization" in the url with my tenantid (guid), like I do on other operations against the graph.windows.net API endpoint.
Any idea if the app-version 2.0 will be open to public?
-
Anonymous commented
okk
-
Anonymous commented
Hi there, any update on this?
-
Filip Van Raemdonck commented
Hi,
Is it possible to do this via powershell already? -
Alex Salter commented
Please also consider providing a means to grant permissions through az as well.
-
Ben Hatton commented
As a workaround, a module to invoke REST API has been contributed by Jos Lieben:
[apologies for previous now deleted post, didn't sufficiently read what I was suggesting]
-
anajafi commented
do we have grant permissions for users via powershell yet?
-
Anonymous commented
This feature will help us to complete our automation runbooks without any manual intervention.
-
Anonymous commented
When can we expect Oauth2 grant permissions command through powershell?
-
Sebastian commented
Still no cmdlet for that?