How to update Entra ID authorization policy using Microsoft Graph PowerShell

The Update-MgPolicyAuthorizationPolicy cmdlet lets you modify the settings of the authorization policy in Microsoft Entra ID (previously Azure AD). This policy controls core permissions and constraints for user and admin activities across your directory.

Update authorization policy using Microsoft Graph PowerShell

Prerequisites

• Before using the cmdlet, ensure that the Microsoft Graph PowerShell module is installed. If not, install it using the following PowerShell command:
  Copy Install-Module Microsoft.Graph -Scope CurrentUser
• Also, use the following PowerShell command to connect to Microsoft Graph with the required permissions (e.g., Policy.ReadWrite.Authorization):
  Copy Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"

Using the Update-MgPolicyAuthorizationPolicy cmdlet

Run the following Graph PowerShell command below to update a configuration in the authorization policy. Replace <policy-id> with the ID of the authorization policy and <object> with the updated property values:

Examples

Example 1: Restrict default user permissions

This Graph PowerShell command restricts users from creating applications:

Example 2: Allow downloading apps

This Graph PowerShell command allows users to download applications in the directory:

Supported parameters

The following are some essential parameters that can be used along with the Update-MgPolicyAuthorizationPolicy command:

Limitations of using Microsoft Graph PowerShell to update Entra ID authorization policy

• PowerShell commands can become complicated with different use cases and scenarios.
• IT admins can spend a lot of time debugging errors, which in turn negatively impacts productivity.
• Delegation can be challenging, as technicians may need elevated privileges.