How to get application role assignments for service principals using Microsoft Graph PowerShell

The Get-MgServicePrincipalAppRoleAssignment cmdlet retrieves the app role assignments granted to a specified service principal in Microsoft Entra ID (previously Azure AD). App role assignments are delegated permissions granted to service principals (applications), allowing them to access specific application roles or APIs.

Get application role assignments using Microsoft Graph PowerShell

Prerequisites

• Before using the cmdlet, ensure that the Microsoft Graph PowerShell module is installed. If not, install it using the following PowerShell command:
  Copy Install-Module Microsoft.Graph -Scope CurrentUser
• Also, use the following PowerShell command to connect to Microsoft Graph with the required permissions (e.g., AppRoleAssignment.Read.All):
  Copy Connect-MgGraph -Scopes "AppRoleAssignment.Read.All"

Using the Get-MgServicePrincipalAppRoleAssignment cmdlet

Run the cmdlet below in Microsoft Graph PowerShell to retrieve all application role assignments of a service principal. Replace <service-principal-id> with the actual service principal object ID:

Examples

Example 1: Get all application role assignments for a service principal

This Graph PowerShell command retrieves all application role assignments associated with the specified service principal ID:

Example 2: Filter application role assignments where the resource ID equals a specific value

This Graph PowerShell command filters the assignments to display only those with the specified resource (target application) ID:

Supported parameters

The following are some essential parameters that can be used along with the Get-MgServicePrincipalAppRoleAssignment cmdlet:

Limitations of using Microsoft Graph PowerShell to get application role assignments

• PowerShell commands can get complex with different use cases and scenarios.
• IT admins can spend a lot of time troubleshooting errors, which in turn negatively impacts productivity.
• Delegation can get tricky since technicians require elevated permissions.