How to list users and principals assigned to app roles using Graph PowerShell

The Get-MgServicePrincipalAppRoleAssignedTo cmdlet retrieves the users, groups, and service principals that have been assigned a specific app role from a resource application. This is useful for auditing who has permission to use the application's defined roles.

Get principals assigned to app roles using Graph PowerShell

Prerequisites

• Before using the cmdlet, ensure that the Microsoft Graph PowerShell module is installed. If not, install it using this PowerShell command:
  Copy Install-Module Microsoft.Graph -Scope CurrentUser
• Also, use the following PowerShell command to connect to Microsoft Graph with the required permissions (e.g., AppRoleAssignment.Read.All):
  Copy Connect-MgGraph -Scopes "AppRoleAssignment.Read.All"

Using the Get-MgServicePrincipalAppRoleAssignedTo cmdlet

Run the Graph PowerShell command below to retrieve users, groups, and service principals that have been assigned a specific app role. Replace <service-principal-id> with the required service principal object ID:

Examples

Example 1: Get all app role assignments assigned to a service principal

This Graph PowerShell command retrieves a list of principals that have been assigned a role for the specific resource application represented by the provided service principal ID:

Example 2: Limit returned assignments to five

This Graph PowerShell command restricts output to five assignments:

Example 3: Filter assignments by principal type

This Graph PowerShell command shows only assignments where the principal type is User:

Supported parameters

The following are some essential parameters that can be used along with the Get-MgServicePrincipalAppRoleAssignedTo command:

Limitations of using Microsoft Graph PowerShell to get app role assignments

• PowerShell commands can get complicated with different use cases and scenarios.
• IT admins can spend a lot of time debugging errors, which in turn negatively impacts productivity.
• Delegation can get tricky since technicians require elevated permissions.