Get-AppRoleAssignment [-ProgressAction ] []

Connect-EntraService -ClientID $clientId -TenantID $tenantId -ClientSecret $clientSecret -Service "GraphBeta"
$assignments = Get-AppRoleAssignment

$assignments = Get-AppRoleAssignment -Verbose
$overPrivilegedApps = $assignments | Where-Object { $_.AppRoleCount -gt 50 }

$assignments = Get-AppRoleAssignment
$appOnlyPerms = $assignments | ForEach-Object {
    $app = $_
    $app.AppRoles | Where-Object { $_.PermissionType -eq 'Application' } | ForEach-Object {
        [PSCustomObject]@{
            AppName = $app.PrincipalName
            AppId = $app.PrincipalId
            Permission = $_.FriendlyName
            PermissionId = $_.appRoleId
        }
    }
}

NOTES

Prerequisites:

• Must be connected to Microsoft Graph using Connect-EntraService with GraphBeta service
• Requires the following Microsoft Graph permissions:

* Application.Read.All (to read service principals) * AppRoleAssignment.Read.All (to read app role assignments) * Directory.Read.All (recommended for complete data)

• Beta endpoint access required (function uses GraphBeta service)

Authentication: The function requires prior authentication via Connect-EntraService. Example: Connect-EntraService -ClientID $clientId -TenantID $tenantId -ClientSecret $clientSecret -Service "GraphBeta" Or for interactive authentication: Connect-EntraService -Service "GraphBeta" Performance Considerations:

• Uses automatic pagination via Invoke-EntraRequest (handles large result sets)
• Uses explicit memory management with garbage collection
• Processing time scales with number of service principals (typically 30-120 seconds for large tenants)
• Can efficiently handle thousands of assignments

Memory Management: The function implements several memory optimization techniques:

• Uses $select to only retrieve needed properties from Graph API
• Explicitly nulls large objects after use ($graphServicePrincipal = $null)
• Calls \[System.GC\]::Collect() at strategic points to free memory
• Consolidates lookup tables to reduce duplication
• Streams results rather than holding everything in memory
• Recommended for enterprise environments with many applications

Permission Type Classification:

• Application: App-only permissions that don't require user context

Examples: User.Read.All, Mail.Read (when used by daemon apps)

• DelegatedWork: Permissions that require a signed-in user context

Examples: User.Read, Mail.Read (when used by interactive apps)

• Unknown: Permission ID could not be resolved in lookup table

This typically indicates a deprecated or custom permission Microsoft Graph Service Principal: The function specifically queries assignments for the Microsoft Graph service principal:

• AppId: 00000003-0000-0000-c000-000000000000
• This is the well-known application ID for Microsoft Graph
• Does not include assignments to other resource providers (e.g., SharePoint, Exchange)

API Calls Made: 1. GET /servicePrincipals(appId='00000003-0000-0000-c000-000000000000')?$select=appRoles,publishedPermissionScopes,resourceSpecificApplicationPermissions - Retrieves Graph service principal with all permission definitions 2. GET /servicePrincipals(appId='00000003-0000-0000-c000-000000000000')/appRoleAssignedTo?$select=appRoleId,principalId,principalDisplayName,resourceDisplayName - Retrieves all app role assignments with optimized query (automatically paginated) Output Optimization: The function returns streamlined objects containing only essential information:

• Reduces memory footprint compared to raw Graph API responses
• Optimized for pipeline operations and filtering
• Suitable for large-scale analysis and reporting
• Can be easily exported to CSV, JSON, or XML

Verbose Logging: Use -Verbose to see detailed progress information:

• Service principal retrieval
• Number of assignments retrieved
• Lookup table construction progress
• Permission enrichment steps
• Final principal count

Common Use Cases: 1. Security Audits: Identify over-privileged applications 2. Compliance Reporting: Document permission assignments for auditors 3. Permission Inventory: Baseline of current state before changes 4. Change Tracking: Monitor permission grants over time 5. License Planning: Understand Graph API feature usage 6. Incident Response: Quickly identify which apps have sensitive permissions 7. Cleanup Projects: Find candidates for permission removal Error Handling:

• Throws error if Graph API connection fails
• Throws error if insufficient permissions to query
• All errors include detailed exception messages
• Use try/catch blocks for automation scenarios

Troubleshooting: If "Insufficient privileges" error:

• Verify authentication with correct permissions
• Ensure Application.Read.All and AppRoleAssignment.Read.All are granted
• Check if admin consent has been provided for application permissions

If slow performance:

• Normal for large tenants (10,000+ assignments can take 2-3 minutes)
• Network latency affects pagination speed
• Consider running during off-peak hours for very large tenants

If memory errors:

• Increase PowerShell memory limits
• Close other memory-intensive applications
• Run on a machine with more available RAM

If empty results:

• Verify applications actually have Graph permissions assigned
• Check if connected to correct tenant
• Ensure using GraphBeta service (not GraphV1)

Best Practices:

• Always use -Verbose for long-running operations in production
• Save results with Export-Clixml for later analysis
• Implement error handling in automation scripts
• Schedule during off-peak hours for large tenants
• Archive results periodically for change tracking
• Combine with Get-PermissionAnalysis for comprehensive reviews

Related Cmdlets:

• Connect-EntraService: Authenticate to Microsoft Graph
• Get-PermissionAnalysis: Analyze if assigned permissions are actually needed
• Get-AppActivityData: Get API activity to determine permission usage
• Export-PermissionAnalysisReport: Generate HTML reports