{"id":9069,"date":"2022-08-23T13:39:37","date_gmt":"2022-08-23T13:39:37","guid":{"rendered":"https:\/\/blogs.aaddevsup.xyz\/?p=9069"},"modified":"2022-08-24T19:29:49","modified_gmt":"2022-08-24T19:29:49","slug":"using-microsoft-graph-powershell-sdk-to-manage-user-consented-permissions","status":"publish","type":"post","link":"https:\/\/blogs.aaddevsup.xyz\/2022\/08\/using-microsoft-graph-powershell-sdk-to-manage-user-consented-permissions\/","title":{"rendered":"Using Microsoft Graph PowerShell SDK to manage user consented permissions"},"content":{"rendered":"\n<p>The <a href=\"https:\/\/docs.microsoft.com\/en-us\/graph\/api\/resources\/oauth2permissiongrant?view=graph-rest-1.0\" target=\"_blank\" rel=\"noopener\" title=\"oAuth2PermissionGrant\">oAuth2PermissionGrant<\/a> object keeps a record of user consented permissions (Delegated Permissions) in a tenant.  There is one OAuth2PermissionGrant object (identified by Consent ID) for each combination of client application, resource application, and user.  The sample PowerShell script in this post will perform the following tasks:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Remove all MS Graph Delegated permissions (if any) for the user<\/li><li>Perform user consent for an initial set of MS Graph permission<\/li><li>Update the consented permission list with some additional permissions<\/li><li>Remove some permissions from the consented permission list<\/li><li>Remove (revoke) all consented permissions for the user <\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Pre-Requisite<\/h2>\n\n\n\n<p>This post assumes you already have an app registration created in your tenant and a user you intend to perform consent on.<\/p>\n\n\n\n<p><b>Note: There might be a short time delay for the permissions to get updated in the portal<\/b><br>\n[gist id=&#8221;9bbae0c0660a83ddf2aadb844b03a454&#8243; file=&#8221;OAuth2PermissionGrant.ps1&#8243;]\n<\/p>\n\n\n\n<p>For removing Admin Consented Delegated permission refer to <a href=\"https:\/\/blogs.aaddevsup.xyz\/2022\/06\/revoke-admin-consent-for-a-delegated-permission-on-a-service-principal-with-the-ms-graph-powershell-sdk\/\">Revoke Admin Consent for a delegated permission on a Service Principal with the MS Graph PowerShell SDK | Azure Active Directory Developer Support Team (aaddevsup.xyz)<\/a> for more info<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The oAuth2PermissionGrant object keeps a record of user consented permissions (Delegated Permissions) in a tenant. There is one OAuth2PermissionGrant object (identified by Consent ID) for each combination of client application, resource application, and user. The sample PowerShell script in this post will perform the following tasks: Remove all MS Graph Delegated permissions (if any) for the user Perform user consent for an initial set of MS Graph permission Update the&hellip;<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,5,185,268,284,225],"tags":[279,286],"class_list":["post-9069","post","type-post","status-publish","format-standard","hentry","category-authentication","category-azure-ad","category-consent","category-microsoft-graph-powershell-module","category-oauth2","category-powershell","tag-microsoft-graph-powershell-sdk","tag-oauth2permissiongrants"],"_links":{"self":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/posts\/9069"}],"collection":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/comments?post=9069"}],"version-history":[{"count":10,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/posts\/9069\/revisions"}],"predecessor-version":[{"id":9084,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/posts\/9069\/revisions\/9084"}],"wp:attachment":[{"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/media?parent=9069"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/categories?post=9069"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.aaddevsup.xyz\/wp-json\/wp\/v2\/tags?post=9069"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}