How to assign an application role to a service principal in Microsoft Entra ID

Assigning application roles to a service principal is central to defining how applications interact with resources and other services. For IT admins, this process can get complicated when multiple applications need different permission levels or when service principals extend across environments. The main hurdles are mapping roles accurately, preventing over-permissions, and keeping assignments aligned with security and compliance standards. Luckily, there are dependable methods to review, assign, and manage application roles effectively.

How to assign application role to a service principal using Windows PowerShell

• Connect to Microsoft Graph PowerShell.
  Copy Connect-MgGraph -Scopes "AppRoleAssignment.ReadWrite.All"
• Assign an application role to a service principal.
  Copy # Define variables
$spId = "<ServicePrincipalId>" # The object ID of the service principal
$appRoleId = "<AppRoleId>" # The ID of the application role you want to assign
$resourceId = "<ResourceServicePrincipalId>" # The service principal representing the app/resource
# Assign the role
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $spId -PrincipalId $spId -ResourceId $resourceId -AppRoleId $appRoleId

Example

Assign the Reader application role of "TestApp" to the service principal representing "TestBot".

Example query:

Example output:

How to assign an application role to a service principal in Microsoft Entra ID using Microsoft Graph PowerShell

The syntax is as follows:

Example

Assign the Contributor application role of the “TestApp” application to a service principal representing “TestBot”.

Example query:

Example output:

This output shows that the service principal has been assigned the Contributor application role for the Testapplication application. PrincipalId identifies the service principal receiving the role, ResourceId and ResourceDisplayName indicate the application, and AppRoleId specifies the assigned role. Id is the unique identifier for this assignment, and CreatedDateTime shows when it was created.

Highlights of using ADManager Plus for management and reporting

ADManager Plus makes it easier for admins to manage Microsoft 365 with a simple, centralized console.

User, group, and license management

Create, modify, and manage users, groups, contacts, and licenses at scale. Perform bulk management, adjust memberships, assign or revoke licenses, and streamline day-to-day administrative work.

Comprehensive reporting

Schedule and export over 200 prebuilt reports, including logon activity and account status reports. Take quick actions directly from the reports.

Risk and exposure management

Track privilege assignments, spot risky accounts, map potential attack paths, enforce compliance, and strengthen your Zero Trust strategy.

Automation

Automate repetitive tasks like bulk user changes, license management, and group updates. Save time on routine administrative work.

Delegation and governance

Use role-based access delegation to distribute responsibilities safely. Empower teams to handle day-to-day tasks while you maintain visibility and control.