How to remove service principal app role assignments Using Microsoft Graph PowerShell

With organizational security needs, regularly managing app role assignments for service principals is crucial. The Remove-MgServicePrincipalAppRoleAssignment cmdlet enables administrators to revoke delegated app permissions from service principals, ensuring permissions align with current requirements and reducing lateral movement risk.

This article shows you how to remove service principal app role assignments using both the Microsoft Entra admin center and Microsoft Graph PowerShell:

Remove app role assignments using Microsoft Graph PowerShell

Prerequisites

• You must have the AppRoleAssignment.ReadWrite.All or equivalent permissions.
• Install and connect Microsoft Graph PowerShell by running the script below:
  Copy Install-Module Microsoft.Graph -Scope CurrentUser Connect-MgGraph -Scopes "AppRoleAssignment.ReadWrite.All"

Using the Remove-MgServicePrincipalAppRoleAssignment cmdlet

Run the script below by providing the target service principal and app role assignment IDs

Examples

Example 1: Prompt for confirmation before removal

Example 2: Test removal with WhatIf

Supported parameters

The following essential parameters can be used along with the Remove-MgServicePrincipalAppRoleAssignment cmdlet:

Limitations of using native tools to remove app role assignments

• PowerShell commands can get complex with different use cases and scenarios.
• IT admins can spend a lot of time troubleshooting errors, which negatively impacts productivity.
• Delegation can get tricky since technicians require elevated permissions.