Home
PowerShell
Remove-MgGroupAppRoleAssignment

How to delete app role assignments of Microsoft Entra ID groups using Remove-MgGroupAppRoleAssignment

Deleting app role assignments granted to Microsoft Entra ID groups

Removing application role assignments from Microsoft Entra ID groups is essential for managing access control and ensuring users no longer have permissions to specific applications when they are no longer needed. IT administrators often need to revoke these assignments to maintain security and compliance. While the Remove-MgGroupAppRoleAssignment PowerShell command in Microsoft Graph allows admins to remove app role assignments, it requires admins to write long, complicated scripts.

Delete app role assignments of Microsoft Entra ID groups using Microsoft Graph PowerShell

Prerequisites

Before running the Remove-MgGroupAppRoleAssignment cmdlet, ensure the following requirements are met:

The Microsoft Graph PowerShell module is installed. If it’s not installed, use the following command:
Install-Module Microsoft.Graph -Scope CurrentUser
Connect to Microsoft Graph PowerShell with the necessary permissions to read group details:
Connect-MgGraph -Scopes "Group.Read.All"

Using the Remove-MgGroupAppRoleAssignment cmdlet to delete Microsoft Entra ID groups' app role assignments

Use the Remove-MgGroupAppRoleAssignment cmdlet in Microsoft Graph PowerShell to delete app role assignments of Microsoft Entra ID groups. The syntax is as follows:


                                    Remove-MgGroupAppRoleAssignment 

                                         -AppRoleAssignmentId <String> 

                                         -GroupId <String> 

                                         [-IfMatch <String>] 

                                         [-ResponseHeadersVariable <String>] 

                                         [-Headers <IDictionary>] 

                                         [-PassThru] 

                                         [-ProgressAction <ActionPreference>] 

                                         [-WhatIf] 

                                         [-Confirm] 

                                    [<CommonParameters>]

Example use case and script using the Remove-MgGroupAppRoleAssignment cmdlet

Example: Remove an app role assignment from a Microsoft Entra ID group


                                    Remove-MgGroupAppRoleAssignment -GroupId $groupId -AppRoleAssignmentId $appRoleAssignmentId

Supported parameters

The table below lists key parameters that can be used with the Remove-MgGroupAppRoleAssignment cmdlet to delete app role assignments granted to Microsoft Entra ID groups.

Parameters	Description
-AppRoleAssignmentId	This is the unique identifier of the app role assignment.
-GroupId	This is the unique identifier of the group.
-Headers	This is for optional headers that will be added to the request.
-Confirm	This prompts the admin to confirm before running the cmdlet.
-WhatIf	This shows what would happen if the cmdlet was run. The cmdlet is not actually run.

Challenges of using Graph PowerShell scripts to delete app role assignments of Microsoft Entra ID groups

IT admins must transition from Azure AD PowerShell to Graph PowerShell and be comfortable with PowerShell scripting.
The Microsoft Graph API enforces throttling limits, which can slow down bulk data retrieval.
Troubleshooting errors can be complex and time-consuming, requiring technical expertise.
The absence of a user-friendly interface makes it harder to use, especially for those unfamiliar with scripting.

Why use ADManager Plus for Entra ID management and reporting

ADManager Plus offers bulk management of Microsoft 365 objects like users and groups without the need for any scripting.
Easily manage Microsoft 365 with an intuitive interface.
Automate various routine Microsoft 365 management tasks to save time and reduce effort.
Generate detailed reports on the activities happening in your organization and schedule, export, and email them.
Streamline user provisioning and deprovisioning with ADManager Plus.

Your go-to solution for managing Microsoft Entra ID groups.

Try it now for free

Deleting app roles assignments of Microsoft Entra ID groups
Delete app roles assignments of Microsoft Entra ID groups using Microsoft Graph PowerShell
Challenges of using Graph PowerShell scripts to delete app role assignments of Microsoft Entra ID groups
Why use ADManager Plus for management and reporting

Related features:

Related Powershell Guides: